Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
vendors:cisco:uc:cube:media-proxy [2026/10/22 10:13] – [Importing Certs into Router Trust Pool] gerardorourkevendors:cisco:uc:cube:media-proxy [2026/10/27 11:45] (current) – [Importing Certs into Router Trust Pool] gerardorourke
Line 842: Line 842:
  
 ==== Importing Certs into Router Trust Pool ==== ==== Importing Certs into Router Trust Pool ====
 +<alert type="info">Make sure to first confirm TCP Connectivity to the SIP endpoint on port 5061 is available if dial-peer is unable to get established. When testing using telnet make sure to set the source address to loopback0 (or whatever the FW as been setup for).</alert>
  
 <code>crypto pki trustpool import terminal</code> <code>crypto pki trustpool import terminal</code>
Line 849: Line 850:
 <code>show crypto pki trustpool verbose</code> <code>show crypto pki trustpool verbose</code>
  
-Not all certs need to be imported! +So you can see just CN of each certificate - use the following: 
-Test again by reimporting default trustpool and then import cert one by one and confirm when dial-peer comes into service / we stop getting the HANDSHAKE errors. +<code>show crypto pki trustpool verbose | in cn</code>
-We should see a %SIP-5-TLS_CONNECTION: Connect successful for addr=x.x.x.x, port=5061, connId=1234+
  
 +**Note - the only cert that we found that is needed to be imported into the trustpool, is the immediate parent cert of the SIP endpoint we were trying to connect to.**
 +
 +Reference: https://www.cisco.com/c/en/us/td/docs/routers/ios/config/17-x/sec-vpn/b-security-vpn/m_sec-pki-trustpool-mgmt.html
 +<code>show crypto pki trustpool policy</code>
 +<code>show crypto pki certificates verbose | in end</code>
 +
 +//**The PKI Trustpool Management feature is enabled by default and uses the built-in CA certificate bundle in the PKI trustpool, which receives automatic updates from Cisco. Perform this task to manually update certificates in the PKI trustpool if they are not current, are corrupt, or if certain certificates need to be updated.**//
 +
 +SUMMARY STEPS
 +To remove auto updates attempts to Cisco CA bundle which is enabled by default:
 +<code>
 +conf t
 +crypto pki trustpool policy
 +no cabundle url http://www.cisco.com/security/pki/trs/ios_core.p7b
 +</code>
 +
 +<alert type="info">The default has validation stopping at the peer certificate's issuer.</alert>
  
 ===== Troubleshooting TLS / Certificate issues ===== ===== Troubleshooting TLS / Certificate issues =====
  • vendors/cisco/uc/cube/media-proxy.1792660392.txt.gz
  • Last modified: 2026/10/22 10:13
  • by gerardorourke