Differences

This shows you the differences between two versions of the page.

--- vendors:cisco:uc:cube:tls [2021/04/01 16:01] – gerardorourke
+++ vendors:cisco:uc:cube:tls [2026/05/19 17:50] (current) – [Generating CSR] gerardorourke
@@ Line 1: / Line 1: @@
-====== CUCM-CUBE TLS SIP Trunk ======
+====== CUBE - TLS ======
+===== Generating CSR =====
+We need to create a CSR which will be signed by a CA (and likely also an intermediate CA).
+Steps:
+  *Create trustpoint 'CUBETLS2' (we could call it anything) as per below config
+    * <code>
+crypto pki trustpoint CUBETLS2
+  enrollment terminal pem
+  serial-number none
+  ip-address none
+  subject-name cn=ROUTER1.mydomain.com
+  subject-alt-name ROUTER1.mydomain.com
+  revocation-check none
+  resakeypair CUBETLS2
+  hash sha512
+</code>
+  *Request the CSR
+    * <code>
+! This displays the Certificate Signing Request (CSR) to the terminal
+configure terminal
+  crypto pki enroll CUBETLS2
+!
+</code>
+Then once you have the PEM file returned - which should contain the signed cert, as well as the inter and root CAs)
+you need to import the intermediate and CA certs (in that order and both together)
+  * <code>
+conf terminal
+  crypto pki authenticate CUBETLS2
+</code>
+  *Paste the 2 certs into above. Each Cert will start and end with -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----
+  *You will paste both the inter and CA cert (in that order) and then after pasting in each leave a line space to complete the import.
+Finally import the actual certificate for that router.
+  *<code>
+crypt pki import CUBETLS2 certificate
+</code>
+===== CUCM-CUBE TLS SIP Trunk =====
 What we want - TLS between CUBE and CUCM - but not have SRTP - Note enabling SRTP can have a 75% impact on sizing on the 4431s)
@@ Line 5: / Line 50: @@
 Reference: https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-border-element/212090-Configure-SIP-TLS-between-CUCM-CUBE-CUBE.html
-===== Summary Steps =====
+==== Summary Steps ====
   * Make sure CUBE and CUCM are both NTP synced, i.e. their times are correct.
   * Enabling SIP over TLS requires the CUBE to have a Security License as well as the UC License
@@ Line 17: / Line 62: @@
   * Same Details Steps and example config extracts below
-===== Detailed Steps =====
+==== Detailed Steps ====
-==== CUBE Config =====
+=== CUBE Config ====
 ==Create Trustpoint for self signed CUBE certificate==
 <code>
@@ Line 210: / Line 255: @@
 {{:vendors:cisco:uc:cube:cube-a.png?400|}}
+**The GUI informs you to restart the CUCM Service after uploading this certificate, but you do not need in this case**
 === Create SIP Security Profile for each CUBE ===