An external Jabber device cannot register. While troubleshooting this issue, the engineer discovers that privately signed certificates are being used on Expressway-C and Expressway-E. What action…

Question

Options

• AThe private CA certificate must be placed in the phone trust store.
• BThe Jabber client must register to the Cisco UCM internally before it will register externally.
• CThe device running the Jabber client must use a VPN to register.
• DThe device running the Jabber client must download and trust the private CA certificate.

• A
  5% (3)
• B
  9% (5)
• C
  2% (1)
• D
  84% (46)

Explanation

When Expressway-C and Expressway-E present TLS certificates signed by a private (internal) Certificate Authority, any client that does not already trust that private CA will reject the TLS handshake and fail to register. Public CAs are pre-installed in operating system and application trust stores, but private CAs are not. To resolve the issue, the end-user device running Jabber must download and install the private CA root certificate into its trust store. This allows the device to validate the certificates presented by the Expressway servers and complete the TLS connection required for MRA registration. VPN is an alternative approach but is not required when MRA is properly configured.

No community discussion yet for this question.