Mailing List Archive: Wildcard certificates

Wildcard certificates

Jun 18, 2020, 9:55 PM

Post #1 of 5 (1139 views)

Hi voipers,

I'm trying to update the wildcard on our CUCM/IMP servers, and am
hitting a problem. We have a digicert wildcard, which I used
successfully before, but now when generating the certificate the UI
complains that *.ccgs.wa.edu.au isn't a valid certificate name or SAN. I
hacked the javascript to ignore this warning, and generated a CSR with
*.ccgs.wa.edu.au in the SAN:

$ openssl req -in tomcat$8$.csr -text|grep DNS
DNS:callmanager1.voip.ccgs.wa.edu.au,
DNS:*.ccgs.wa.edu.au, DNS:ccgs.wa.edu.au,
DNS:speeddial.voip.ccgs.wa.edu.au, DNS:callmanager2.voip.ccgs.wa.edu.au,
DNS:voip.ccgs.wa.edu.au, DNS:callmanager.voip.ccgs.wa.edu.au,
DNS:presence.voip.ccgs.wa.edu.au

But when I try to upload the certificate to CUCM, it complains "CSR SAN
and Certificate SAN does not match". But the SANs on the certificate are
the same (albeit in a different order):

$ openssl x509 -in ../ssl/digicert/cucm-star_ccgs_wa_edu_au.crt -text
|grep DNS
DNS:*.ccgs.wa.edu.au, DNS:ccgs.wa.edu.au,
DNS:voip.ccgs.wa.edu.au, DNS:callmanager1.voip.ccgs.wa.edu.au,
DNS:callmanager2.voip.ccgs.wa.edu.au, DNS:speedidal.voip.ccgs.wa.edu.au,
DNS:callmanager.voip.ccgs.wa.edu.au, DNS:presence.voip.ccgs.wa.edu.au

I found
https://community.cisco.com/t5/unified-communications/wildcard-certificate-on-call-manager-10-5/td-p/2757989
from 2016 which says they got it working then, and I also got it working
in 2018 when the cert was last renewed, with *.ccgs.wa.edu.au as the
common name and a SAN. But I can't get it working now. Anyone got any
thoughts? Running CUCM 10.5.2.15900-8

Thanks,

--
James Andrewartha
Network & Projects Engineer
Christ Church Grammar School
Claremont, Western Australia
Ph. (08) 9442 1757
Mob. 0424 160 877
_______________________________________________
cisco-voip mailing list
cisco-voip@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip

Re: Wildcard certificates [ In reply to ]

w at woka

Jun 18, 2020, 10:51 PM

Post #2 of 5 (1138 views)

Permalink

It has never been supported, so, if you run into any issues and TAC sees
it, they may tell you to remove it, just FYI.

Given that, with Digicert, can you duplicate a wildcard cert, like you can
a Multi-San?

On Thu, Jun 18, 2020 at 11:57 PM James Andrewartha <
jandrewartha@ccgs.wa.edu.au> wrote:

> Hi voipers,
>
> I'm trying to update the wildcard on our CUCM/IMP servers, and am
> hitting a problem. We have a digicert wildcard, which I used
> successfully before, but now when generating the certificate the UI
> complains that *.ccgs.wa.edu.au isn't a valid certificate name or SAN. I
> hacked the javascript to ignore this warning, and generated a CSR with
> *.ccgs.wa.edu.au in the SAN:
>
> $ openssl req -in tomcat$8$.csr -text|grep DNS
> DNS:callmanager1.voip.ccgs.wa.edu.au,
> DNS:*.ccgs.wa.edu.au, DNS:ccgs.wa.edu.au,
> DNS:speeddial.voip.ccgs.wa.edu.au, DNS:callmanager2.voip.ccgs.wa.edu.au,
> DNS:voip.ccgs.wa.edu.au, DNS:callmanager.voip.ccgs.wa.edu.au,
> DNS:presence.voip.ccgs.wa.edu.au
>
> But when I try to upload the certificate to CUCM, it complains "CSR SAN
> and Certificate SAN does not match". But the SANs on the certificate are
> the same (albeit in a different order):
>
> $ openssl x509 -in ../ssl/digicert/cucm-star_ccgs_wa_edu_au.crt -text
> |grep DNS
> DNS:*.ccgs.wa.edu.au, DNS:ccgs.wa.edu.au,
> DNS:voip.ccgs.wa.edu.au, DNS:callmanager1.voip.ccgs.wa.edu.au,
> DNS:callmanager2.voip.ccgs.wa.edu.au, DNS:speedidal.voip.ccgs.wa.edu.au,
> DNS:callmanager.voip.ccgs.wa.edu.au, DNS:presence.voip.ccgs.wa.edu.au
>
> I found
>
> https://community.cisco.com/t5/unified-communications/wildcard-certificate-on-call-manager-10-5/td-p/2757989
> from 2016 which says they got it working then, and I also got it working
> in 2018 when the cert was last renewed, with *.ccgs.wa.edu.au as the
> common name and a SAN. But I can't get it working now. Anyone got any
> thoughts? Running CUCM 10.5.2.15900-8
>
> Thanks,
>
> --
> James Andrewartha
> Network & Projects Engineer
> Christ Church Grammar School
> Claremont, Western Australia
> Ph. (08) 9442 1757
> Mob. 0424 160 877
> _______________________________________________
> cisco-voip mailing list
> cisco-voip@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
>

Re: Wildcard certificates [ In reply to ]

avholloway+cisco-voip at gmail

Jun 18, 2020, 11:21 PM

Post #3 of 5 (1138 views)

Permalink

I've got some thoughts, though, I've never done this before, so it's just
guessing.

You don't need *.domain.com in your SAN.

Just generate your CSR on CUCM as if you were not using wildcard
certificates. Then when you dupe your wildcard on digitcert's site,
manually add the exact same SANs in your CSR.

The resulting identity certificate will not have a CN which matches your
CSR, but the SANs will match, and according to the thread you linked:

*"The CN doesn't match but CUCM doesn't seem to care as long as the SAN
fields line up."*

On Thu, Jun 18, 2020 at 11:58 PM James Andrewartha <
jandrewartha@ccgs.wa.edu.au> wrote:

> Hi voipers,
>
> I'm trying to update the wildcard on our CUCM/IMP servers, and am
> hitting a problem. We have a digicert wildcard, which I used
> successfully before, but now when generating the certificate the UI
> complains that *.ccgs.wa.edu.au isn't a valid certificate name or SAN. I
> hacked the javascript to ignore this warning, and generated a CSR with
> *.ccgs.wa.edu.au in the SAN:
>
> $ openssl req -in tomcat$8$.csr -text|grep DNS
> DNS:callmanager1.voip.ccgs.wa.edu.au,
> DNS:*.ccgs.wa.edu.au, DNS:ccgs.wa.edu.au,
> DNS:speeddial.voip.ccgs.wa.edu.au, DNS:callmanager2.voip.ccgs.wa.edu.au,
> DNS:voip.ccgs.wa.edu.au, DNS:callmanager.voip.ccgs.wa.edu.au,
> DNS:presence.voip.ccgs.wa.edu.au
>
> But when I try to upload the certificate to CUCM, it complains "CSR SAN
> and Certificate SAN does not match". But the SANs on the certificate are
> the same (albeit in a different order):
>
> $ openssl x509 -in ../ssl/digicert/cucm-star_ccgs_wa_edu_au.crt -text
> |grep DNS
> DNS:*.ccgs.wa.edu.au, DNS:ccgs.wa.edu.au,
> DNS:voip.ccgs.wa.edu.au, DNS:callmanager1.voip.ccgs.wa.edu.au,
> DNS:callmanager2.voip.ccgs.wa.edu.au, DNS:speedidal.voip.ccgs.wa.edu.au,
> DNS:callmanager.voip.ccgs.wa.edu.au, DNS:presence.voip.ccgs.wa.edu.au
>
> I found
>
> https://community.cisco.com/t5/unified-communications/wildcard-certificate-on-call-manager-10-5/td-p/2757989
> from 2016 which says they got it working then, and I also got it working
> in 2018 when the cert was last renewed, with *.ccgs.wa.edu.au as the
> common name and a SAN. But I can't get it working now. Anyone got any
> thoughts? Running CUCM 10.5.2.15900-8
>
> Thanks,
>
> --
> James Andrewartha
> Network & Projects Engineer
> Christ Church Grammar School
> Claremont, Western Australia
> Ph. (08) 9442 1757
> Mob. 0424 160 877
> _______________________________________________
> cisco-voip mailing list
> cisco-voip@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
>

Re: Wildcard certificates [ In reply to ]

jandrewartha at ccgs

Jun 18, 2020, 11:59 PM

Post #4 of 5 (1138 views)

Permalink

It helps if I spell speeddial instead of speedidal ????

On 19/6/20 2:21 pm, Anthony Holloway wrote:
> I've got some thoughts, though, I've never done this before, so it's
> just guessing.
>
> You don't need *.domain.com <http://domain.com> in your SAN.
>
> Just generate your CSR on CUCM as if you were not using wildcard
> certificates. Then when you dupe your wildcard on digitcert's site,
> manually add the exact same SANs in your CSR.
>
> The resulting identity certificate will not have a CN which matches your
> CSR, but the SANs will match, and according to the thread you linked:
>
> /"The CN doesn't match but CUCM doesn't seem to care as long as the SAN
> fields line up."/
>
> On Thu, Jun 18, 2020 at 11:58 PM James Andrewartha
> <jandrewartha@ccgs.wa.edu.au <mailto:jandrewartha@ccgs.wa.edu.au>> wrote:
>
> Hi voipers,
>
> I'm trying to update the wildcard on our CUCM/IMP servers, and am
> hitting a problem. We have a digicert wildcard, which I used
> successfully before, but now when generating the certificate the UI
> complains that *.ccgs.wa.edu.au <http://ccgs.wa.edu.au> isn't a
> valid certificate name or SAN. I
> hacked the javascript to ignore this warning, and generated a CSR with
> *.ccgs.wa.edu.au <http://ccgs.wa.edu.au> in the SAN:
>
> $ openssl req -in tomcat$8$.csr -text|grep DNS
> DNS:callmanager1.voip.ccgs.wa.edu.au
> <http://callmanager1.voip.ccgs.wa.edu.au>,
> DNS:*.ccgs.wa.edu.au <http://ccgs.wa.edu.au>, DNS:ccgs.wa.edu.au
> <http://ccgs.wa.edu.au>,
> DNS:speeddial.voip.ccgs.wa.edu.au
> <http://speeddial.voip.ccgs.wa.edu.au>,
> DNS:callmanager2.voip.ccgs.wa.edu.au
> <http://callmanager2.voip.ccgs.wa.edu.au>,
> DNS:voip.ccgs.wa.edu.au <http://voip.ccgs.wa.edu.au>,
> DNS:callmanager.voip.ccgs.wa.edu.au
> <http://callmanager.voip.ccgs.wa.edu.au>,
> DNS:presence.voip.ccgs.wa.edu.au <http://presence.voip.ccgs.wa.edu.au>
>
> But when I try to upload the certificate to CUCM, it complains "CSR SAN
> and Certificate SAN does not match". But the SANs on the certificate are
> the same (albeit in a different order):
>
> $ openssl x509 -in ../ssl/digicert/cucm-star_ccgs_wa_edu_au.crt -text
> |grep DNS
> DNS:*.ccgs.wa.edu.au <http://ccgs.wa.edu.au>,
> DNS:ccgs.wa.edu.au <http://ccgs.wa.edu.au>,
> DNS:voip.ccgs.wa.edu.au <http://voip.ccgs.wa.edu.au>,
> DNS:callmanager1.voip.ccgs.wa.edu.au
> <http://callmanager1.voip.ccgs.wa.edu.au>,
> DNS:callmanager2.voip.ccgs.wa.edu.au
> <http://callmanager2.voip.ccgs.wa.edu.au>,
> DNS:speedidal.voip.ccgs.wa.edu.au
> <http://speedidal.voip.ccgs.wa.edu.au>,
> DNS:callmanager.voip.ccgs.wa.edu.au
> <http://callmanager.voip.ccgs.wa.edu.au>,
> DNS:presence.voip.ccgs.wa.edu.au <http://presence.voip.ccgs.wa.edu.au>
>
> I found
> https://community.cisco.com/t5/unified-communications/wildcard-certificate-on-call-manager-10-5/td-p/2757989
> from 2016 which says they got it working then, and I also got it working
> in 2018 when the cert was last renewed, with *.ccgs.wa.edu.au
> <http://ccgs.wa.edu.au> as the
> common name and a SAN. But I can't get it working now. Anyone got any
> thoughts? Running CUCM 10.5.2.15900-8
>
> Thanks,
>
> --
> James Andrewartha
> Network & Projects Engineer
> Christ Church Grammar School
> Claremont, Western Australia
> Ph. (08) 9442 1757
> Mob. 0424 160 877
> _______________________________________________
> cisco-voip mailing list
> cisco-voip@puck.nether.net <mailto:cisco-voip@puck.nether.net>
> https://puck.nether.net/mailman/listinfo/cisco-voip
>

--
James Andrewartha
Network & Projects Engineer
Christ Church Grammar School
Claremont, Western Australia
Ph. (08) 9442 1757
Mob. 0424 160 877
_______________________________________________
cisco-voip mailing list
cisco-voip@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip

Re: Wildcard certificates [ In reply to ]

nateccie at gmail

Jun 19, 2020, 5:53 AM

Post #5 of 5 (1135 views)

Permalink

Yeah. In my experience, the cert can have as many extra sans as you want, but all of the sans the cucm csr has have to be there, and spelled correctly.

Sent from my iPhone

> On Jun 19, 2020, at 1:02 AM, James Andrewartha <jandrewartha@ccgs.wa.edu.au> wrote:
>
> ?It helps if I spell speeddial instead of speedidal ????
>
>> On 19/6/20 2:21 pm, Anthony Holloway wrote:
>> I've got some thoughts, though, I've never done this before, so it's
>> just guessing.
>>
>> You don't need *.domain.com <http://domain.com> in your SAN.
>>
>> Just generate your CSR on CUCM as if you were not using wildcard
>> certificates. Then when you dupe your wildcard on digitcert's site,
>> manually add the exact same SANs in your CSR.
>>
>> The resulting identity certificate will not have a CN which matches your
>> CSR, but the SANs will match, and according to the thread you linked:
>>
>> /"The CN doesn't match but CUCM doesn't seem to care as long as the SAN
>> fields line up."/
>>
>> On Thu, Jun 18, 2020 at 11:58 PM James Andrewartha
>> <jandrewartha@ccgs.wa.edu.au <mailto:jandrewartha@ccgs.wa.edu.au>> wrote:
>>
>> Hi voipers,
>>
>> I'm trying to update the wildcard on our CUCM/IMP servers, and am
>> hitting a problem. We have a digicert wildcard, which I used
>> successfully before, but now when generating the certificate the UI
>> complains that *.ccgs.wa.edu.au <http://ccgs.wa.edu.au> isn't a
>> valid certificate name or SAN. I
>> hacked the javascript to ignore this warning, and generated a CSR with
>> *.ccgs.wa.edu.au <http://ccgs.wa.edu.au> in the SAN:
>>
>> $ openssl req -in tomcat$8$.csr -text|grep DNS
>> DNS:callmanager1.voip.ccgs.wa.edu.au
>> <http://callmanager1.voip.ccgs.wa.edu.au>,
>> DNS:*.ccgs.wa.edu.au <http://ccgs.wa.edu.au>, DNS:ccgs.wa.edu.au
>> <http://ccgs.wa.edu.au>,
>> DNS:speeddial.voip.ccgs.wa.edu.au
>> <http://speeddial.voip.ccgs.wa.edu.au>,
>> DNS:callmanager2.voip.ccgs.wa.edu.au
>> <http://callmanager2.voip.ccgs.wa.edu.au>,
>> DNS:voip.ccgs.wa.edu.au <http://voip.ccgs.wa.edu.au>,
>> DNS:callmanager.voip.ccgs.wa.edu.au
>> <http://callmanager.voip.ccgs.wa.edu.au>,
>> DNS:presence.voip.ccgs.wa.edu.au <http://presence.voip.ccgs.wa.edu.au>
>>
>> But when I try to upload the certificate to CUCM, it complains "CSR SAN
>> and Certificate SAN does not match". But the SANs on the certificate are
>> the same (albeit in a different order):
>>
>> $ openssl x509 -in ../ssl/digicert/cucm-star_ccgs_wa_edu_au.crt -text
>> |grep DNS
>> DNS:*.ccgs.wa.edu.au <http://ccgs.wa.edu.au>,
>> DNS:ccgs.wa.edu.au <http://ccgs.wa.edu.au>,
>> DNS:voip.ccgs.wa.edu.au <http://voip.ccgs.wa.edu.au>,
>> DNS:callmanager1.voip.ccgs.wa.edu.au
>> <http://callmanager1.voip.ccgs.wa.edu.au>,
>> DNS:callmanager2.voip.ccgs.wa.edu.au
>> <http://callmanager2.voip.ccgs.wa.edu.au>,
>> DNS:speedidal.voip.ccgs.wa.edu.au
>> <http://speedidal.voip.ccgs.wa.edu.au>,
>> DNS:callmanager.voip.ccgs.wa.edu.au
>> <http://callmanager.voip.ccgs.wa.edu.au>,
>> DNS:presence.voip.ccgs.wa.edu.au <http://presence.voip.ccgs.wa.edu.au>
>>
>> I found
>> https://community.cisco.com/t5/unified-communications/wildcard-certificate-on-call-manager-10-5/td-p/2757989
>> from 2016 which says they got it working then, and I also got it working
>> in 2018 when the cert was last renewed, with *.ccgs.wa.edu.au
>> <http://ccgs.wa.edu.au> as the
>> common name and a SAN. But I can't get it working now. Anyone got any
>> thoughts? Running CUCM 10.5.2.15900-8
>>
>> Thanks,
>>
>> --
>> James Andrewartha
>> Network & Projects Engineer
>> Christ Church Grammar School
>> Claremont, Western Australia
>> Ph. (08) 9442 1757
>> Mob. 0424 160 877
>> _______________________________________________
>> cisco-voip mailing list
>> cisco-voip@puck.nether.net <mailto:cisco-voip@puck.nether.net>
>> https://puck.nether.net/mailman/listinfo/cisco-voip
>>
>
>
> --
> James Andrewartha
> Network & Projects Engineer
> Christ Church Grammar School
> Claremont, Western Australia
> Ph. (08) 9442 1757
> Mob. 0424 160 877
> _______________________________________________
> cisco-voip mailing list
> cisco-voip@puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-voip
_______________________________________________
cisco-voip mailing list
cisco-voip@puck.nether.net
https://puck.nether.net/mailman/listinfo/cisco-voip