Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision | |||
| vendors:cisco:uc:cube:tls [2021/04/01 17:05] – [CUCM Config] gerardorourke | vendors:cisco:uc:cube:tls [2026/05/19 17:50] (current) – [Generating CSR] gerardorourke | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== CUCM-CUBE TLS SIP Trunk ====== | + | ====== CUBE - TLS ====== |
| + | ===== Generating CSR ===== | ||
| + | |||
| + | We need to create a CSR which will be signed by a CA (and likely also an intermediate CA). | ||
| + | Steps: | ||
| + | *Create trustpoint ' | ||
| + | * < | ||
| + | crypto pki trustpoint CUBETLS2 | ||
| + | enrollment terminal pem | ||
| + | serial-number none | ||
| + | ip-address none | ||
| + | subject-name cn=ROUTER1.mydomain.com | ||
| + | subject-alt-name ROUTER1.mydomain.com | ||
| + | revocation-check none | ||
| + | resakeypair CUBETLS2 | ||
| + | hash sha512 | ||
| + | </ | ||
| + | *Request the CSR | ||
| + | * < | ||
| + | ! This displays the Certificate Signing Request (CSR) to the terminal | ||
| + | configure terminal | ||
| + | crypto pki enroll CUBETLS2 | ||
| + | ! | ||
| + | </ | ||
| + | |||
| + | Then once you have the PEM file returned - which should contain the signed cert, as well as the inter and root CAs) | ||
| + | you need to import the intermediate and CA certs (in that order and both together) | ||
| + | |||
| + | * < | ||
| + | conf terminal | ||
| + | crypto pki authenticate CUBETLS2 | ||
| + | </ | ||
| + | *Paste the 2 certs into above. Each Cert will start and end with -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- | ||
| + | *You will paste both the inter and CA cert (in that order) and then after pasting in each leave a line space to complete the import. | ||
| + | |||
| + | Finally import the actual certificate for that router. | ||
| + | *< | ||
| + | crypt pki import CUBETLS2 certificate | ||
| + | </ | ||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | |||
| + | ===== CUCM-CUBE TLS SIP Trunk ===== | ||
| What we want - TLS between CUBE and CUCM - but not have SRTP - Note enabling SRTP can have a 75% impact on sizing on the 4431s) | What we want - TLS between CUBE and CUCM - but not have SRTP - Note enabling SRTP can have a 75% impact on sizing on the 4431s) | ||
| Line 5: | Line 50: | ||
| Reference: https:// | Reference: https:// | ||
| - | ===== Summary Steps ===== | + | ==== Summary Steps ==== |
| * Make sure CUBE and CUCM are both NTP synced, i.e. their times are correct. | * Make sure CUBE and CUCM are both NTP synced, i.e. their times are correct. | ||
| * Enabling SIP over TLS requires the CUBE to have a Security License as well as the UC License | * Enabling SIP over TLS requires the CUBE to have a Security License as well as the UC License | ||
| Line 17: | Line 62: | ||
| * Same Details Steps and example config extracts below | * Same Details Steps and example config extracts below | ||
| - | ===== Detailed Steps ===== | + | ==== Detailed Steps ==== |
| - | ==== CUBE Config | + | === CUBE Config ==== |
| ==Create Trustpoint for self signed CUBE certificate== | ==Create Trustpoint for self signed CUBE certificate== | ||
| < | < | ||