300-820 · Question #209
Refer to the exhibit. The neighbor zone to Cisco UCM fails to come up when TLS verify mode is enabled on the Expressway-C for B2B traffic. Which Issue correctly describes the cause of the error?
The correct answer is D. The neighbor system FQDN is missing from Subject Alternative Name attributes of the certificate. When TLS verify mode is enabled on Expressway-C, it validates the certificate presented by the neighbor system (Cisco UCM) against the FQDN configured in the neighbor zone. If the FQDN of the UCM neighbor system is not present in the Subject Alternative Name (SAN) fields of the…
Question
Refer to the exhibit. The neighbor zone to Cisco UCM fails to come up when TLS verify mode is enabled on the Expressway-C for B2B traffic. Which Issue correctly describes the cause of the error?
Exhibit
Options
- AThe certificate has a key length of 8192 bits.
- BTLS verify mode is enabled on the neighbor zone.
- CSubject Alternative Name fields are longer than 999 characters.
- DThe neighbor system FQDN is missing from Subject Alternative Name attributes of the certificate.
How the community answered
(33 responses)- A6% (2)
- B3% (1)
- C15% (5)
- D76% (25)
Explanation
When TLS verify mode is enabled on Expressway-C, it validates the certificate presented by the neighbor system (Cisco UCM) against the FQDN configured in the neighbor zone. If the FQDN of the UCM neighbor system is not present in the Subject Alternative Name (SAN) fields of the UCM certificate, TLS verification fails and the zone cannot come up. This is the most common cause of TLS verify failures - the certificate's SAN must include the exact FQDN used in the neighbor zone configuration.
Topics
Community Discussion
No community discussion yet for this question.