300-820 · Question #136
An administrator configures a secure SIP trunk in Cisco UCM to Expressway-C. The SIP trunk fails to become active, and an examination of a packet capture finds that the TLS handshake failed with a…
The correct answer is B. CallManager-trust. For a SIP TLS trunk between Cisco UCM and Expressway-C, CUCM must trust the certificate presented by the Expressway-C during the TLS handshake. The 'Certificate Unknown' error indicates that CUCM does not have the Expressway-C certificate (or its signing CA) in its trust store…
Question
An administrator configures a secure SIP trunk in Cisco UCM to Expressway-C. The SIP trunk fails to become active, and an examination of a packet capture finds that the TLS handshake failed with a "Certificate Unknown" error from Cisco UCM. To allow the Cisco UCM to trust the Expressway-C and establish a TLS connection, the administrator will upload the Expressway server certificate to the trust store. To which trust store must the certificate be uploaded?
Options
- Atomcat-trust
- BCallManager-trust
- CTVS-trust
- Dipsec-trust
How the community answered
(60 responses)- A7% (4)
- B78% (47)
- C12% (7)
- D3% (2)
Explanation
For a SIP TLS trunk between Cisco UCM and Expressway-C, CUCM must trust the certificate presented by the Expressway-C during the TLS handshake. The 'Certificate Unknown' error indicates that CUCM does not have the Expressway-C certificate (or its signing CA) in its trust store. The correct trust store for SIP TLS connections on CUCM is 'CallManager-trust'. This store is specifically used to validate certificates for SIP TLS trunks. 'Tomcat-trust' is for HTTPS/web UI connections, 'TVS-trust' is for Token Verification Service, and 'ipsec-trust' is for IPsec. Uploading the Expressway-C server certificate (or its CA) to CallManager-trust will allow the TLS handshake to complete successfully.
Topics
Community Discussion
No community discussion yet for this question.