A Jabber user is being prompted to trust the Expressway-E certificate when using Mobile and Remote Access. The administrator has validated that the Expressway-E certificate is being trusted by the…

Question

Options

• ACreate a new CSR with new information on the SAN field.
• BInclude Cisco Unified Communications Manager registration domain in the Expressway-E
• CChange the domain name.
• DChange the FQDN of the Expressway.

• A
  4% (1)
• B
  83% (19)
• C
  9% (2)
• D
  4% (1)

Explanation

When the machine already trusts the CA that signed the Expressway-E certificate but Jabber still prompts the user to trust it, the issue is typically that the certificate's Subject Alternative Name (SAN) field does not include the domain name used by Jabber clients to discover the Expressway-E. Specifically, the CUCM registration domain (the domain Jabber uses for DNS SRV lookup during MRA) must be listed in the Expressway-E certificate's SAN field. If it is absent, Jabber cannot verify that the certificate is valid for that domain, causing the trust prompt. Simply creating a new CSR with generic SAN info (A) or changing the domain name (C) or FQDN (D) would not resolve this - the fix is targeted: add the specific CUCM registration domain to the SAN of the Expressway-E certificate.

No community discussion yet for this question.