An engineer attempts to upload a server certificate to an Expressway-C server but receives an error when they click the upload button that says that the file is invalid. The engineer is advised that…

Question

Options

• ACreate a certificate request via Certificate Services Web Page and ensure that the certificate
• BCreate a certificate request via the Certificate Services Web Page and ensure that the Subject
• CCreate a new certificate template with "Server authentication" and "Client authentication" enabled
• DCreate a new certificate template with the certificate attribute "Allow private key to be exported"

• A
  15% (6)
• B
  2% (1)
• C
  76% (31)
• D
  7% (3)

Explanation

Cisco Expressway requires server certificates that include both 'Server Authentication' (OID 1.3.6.1.5.5.7.3.1) and 'Client Authentication' (OID 1.3.6.1.5.5.7.3.2) in the certificate's Enhanced Key Usage (EKU) extension. This is because Expressway operates as both a server (accepting inbound TLS connections) and a client (initiating outbound TLS connections to other systems like UCM or the cloud). If the certificate template used to sign the CSR does not include both EKU values, the certificate upload will fail with an 'invalid file' error. The fix is to create or use a certificate template with both authentication purposes enabled.

No community discussion yet for this question.