An Expressway pairs deployed for Mobile and Remote Access. An administrator installs a new server certificate on the Expressway-E. After installing the new certificate, the UC Traversal zone between…

Question

Options

• AFQDN of the Expressway-C, "expc01.example.local"
• Bregistration domain, "example.com" or "collab-edge.example.com"
• CCisco UCM cluster FQDN, "cucmcluster.example.local"
• DFQDN of the Expressway-E, "expe01.example.com"

• A
  5% (1)
• B
  74% (14)
• C
  5% (1)
• D
  16% (3)

Explanation

For Jabber Mobile and Remote Access (MRA) clients to successfully connect and validate the Expressway-E server certificate, the certificate must contain the registration domain or the 'collab-edge' subdomain (e.g., 'collab-edge.example.com') as a Subject Alternate Name (SAN). This is because the external DNS SRV record used by Jabber for MRA discovery is '_collab-edge._tls.<domain>', which resolves to the Expressway-E FQDN. When the Jabber client connects, it verifies the server certificate against the hostname it used for discovery. If the certificate only contains the Expressway-E's own FQDN as the CN with no SANs, the certificate validation fails for the collab-edge service name, preventing client login. Adding the registration domain or collab-edge hostname as a SAN resolves this mismatch.

No community discussion yet for this question.