Skip Navigation
  1. BlackBerry Docs
  2. BlackBerry Enterprise Mobility Server 3.1
  3. BEMS Installation Guide
  4. Prerequisites: Installing and configuring BEMS
  5. Prerequisites: Cisco Unified Communications Manager IM and Presence Service requirements for Presence
  6. Configure Cisco Unified Communications Manager and Cisco IM and Presence certificates with the enterprise certificate authority

Configure 
Cisco Unified Communications Manager
 and 
Cisco
 IM and Presence certificates with the enterprise certificate authority

Cisco Unified Communications Manager
 (CUCM) and 
Cisco
 IM and Presence (CIMP) version 10.5.1 and later provide the ability to use multi-server certificates with Subject Alternative Names for tomcat, cup-xmpp, and cup-xmpp-ECDSA services. This topic describes certificate configuration using these recent feature enhancements. Multi-server certificates need only be configured on the CUCM and CIMP Publishers. Regardless of CIMP version, the cup service certificate is not multi-server and must be configured on each CIMP server in the cluster.
If your environment is running an older version of 
Cisco Unified Communications Manager
 and 
Cisco
 IM and Presence or you are not using multi-server certificates, you must use the 
Cisco
 Operating System Administration user interface on all of the CUCM and CIMP nodes to configure the Tomcat certificates. You must use the 
Cisco
 Operating System Administration interface on all of the CIMP nodes to configure the cup,  cup-xmpp, and cup-xmpp-ECDSA certificates. The 
Cisco
 Tomcat service runs on both CUCM and CIMP servers. The cup, cup-xmpp, and cup-xmpp-ECDSA services only run on the CIMP servers.
When you configure the 
Presence
 service to communicate with 
Cisco Unified Communications Manager
 (CUCM) and Cisco IM and Presence (CIMP), you can configure the 
Cisco
 certificates to be signed by the enterprise certificate authority. You require the following certificates and certificate signing requests (CSR) when you want to configure the 
Presence
 service to communicate with the 
Cisco Unified Communications Manager
 and 
Cisco
 IM and Presence:
Service 
Certificates or CSRs
Configure the 
Connect
 service only
1
  • Enterprise Root CA certificate
  • Tomcat Certificate Signing Request (from CUCM)
  • Tomcat - CA signed certificate
  • Tomcat - ECDSA CA signed certificate (in a 
    Cisco
     11.x or later environment) 
  • Cup-xmpp Certificate Signing Request (from CIMP)
  • Cup-xmpp CA signed certificate
  • Cup-xmpp-ECDSA CA signed certificate (from CIMP in a 
    Cisco
     11.x or later environment) 
Configure the 
Presence
 service only
1
  • Enterprise Root CA certificate
  • Tomcat Certificate Signing Request (from CUCM)
  • Tomcat - CA signed certificate
  • Tomcat - ECDSA CA signed certificate (in a 
    Cisco
     11.x or later environment) 
  • Cup Certificate Signing Request (from CIMP)
  • Cup - CA signed certificate 
  • Cup-xmpp-ECDSA CA signed certificate (from CIMP in a 
    Cisco
     11.x or later environment) 
1
 If you configure both the 
Connect
 and 
Presence
 services, make sure that all of the required certificates or CSRs uploaded. 
You must upload the root CA certificate as a trust certificate for the corresponding services or you will receive the error message 
CA certificate is not available in the trust-store
. For example, if you want to use a CA-signed tomcat certificate, you must first upload the root CA certificate as a tomcat-trust certificate, if you want to use a CA-signed cup certificate, you must first upload the root CA certificate as a cup-trust certificate, and if you want to use a CA-signed cup-xmpp certificate, you must first upload the root CA certificate as a cup-xmpp-trust certificate.
  1. Complete steps 2 to 10 for all of the certificate pairs. For example, tomcat/tomcat-trust, cup/cup-trust, cup-xmpp/cup-xmpp-trust, and cup-xmpp-ECDSA/cup-xmpp-trust. 
  2. Log in to the 
    Cisco Unified OS Administration
     using your administrator credentials. If your environment is running CUCM and CIMP 10.5.1 or later, complete the following tasks on the CUCM Publisher and the IM and Presence Publisher. If your environment is running CUCM and IM and Presence version earlier than 10.5.1, or for the cup service certificate, complete the following tasks on all servers in the cluster. 
  3. Click 
    Security > Certificate Management
    . 
  4. Upload the root enterprise CA certificate. 
    The uploaded certificate is distributed to all of the servers in the cluster for the given service (for example, tomcat, cup, cup-xmpp, and cup-xmpp-ECDSA).
    1. Click 
      Upload Certificate/Certificate chain
      .
    2. In the 
      Certificate Purpose
       drop-down list, select the trust store (For example, tomcat-trust, cup-trust, or cup-xmpp-trust).
    3. Click 
      Browse
      . Navigate to the enterprise root certificate downloaded earlier. 
    4. Click 
      Open
      . 
    5. Click 
      Upload
      .
    6. If the certificate upload is successful, click 
      Close
      . 
  5. Request a CSR. 
    1. Click 
      Generate CSR
      . The new CSR will overwrite the existing CSR for that certifcate. 
    2. In the 
      Certificate Purpose
       drop-down list, click the service you want to generate the CSR for. For example, tomcat, cup, or cup-xmpp.
    3. In the 
      Distribution
       drop-down list, select 
      Multi-server (SAN)
      .
      Make sure that the list of auto-populated domains in the Subject Alternate Names section contain the FQDNs of the CUCM and CIMP servers that will be configured in 
      BEMS
      .
    4. Click 
      Close
      . A second copy of the <
      service
      > certificate appears in the certificate list as a CSR Only type.
    5. Click the CSR Only type version of the <
      service
      > certificate link.
    6. In the 
      CSR Details for <
      Publisher_Hostname-ms.domain
      >,<
      service
      > certificate
       dialog box, click 
      Download CSR
      . 
    7. Save the 
      <
      service
      >.csr
       file. Open the file in a text editor.
    8. Copy the certificate information, including the Begin and End Certifciate request lines.
  6. Paste the new CSR certificate information to the 
    Microsoft Active Directory
     Certificate Services server. 
    1. On the 
      Microsoft Active Directory Certificate Services
       server, click
       Request a certificate
      .
    2. Click 
      Advanced certificate request
      .
    3. On the 
      Submit a Certificate Request or Renewal request
       window, in the
       Saved Request
       field, paste the certificate information that you copied in step 6h.
    4. In the 
      Certificate Template
       drop-down list, click 
      Web Server
      .
    5. Click 
      Submit
      .
    6. On the 
      Certificate Issued
       window, select 
      DER
       encoded. Click 
      Download certificate
      . 
    7. Click 
      OK
      . By default, the certificate is saved to the Downloads folder.
  7. Upload the CA-signed certificate to 
    Cisco
     Unified Operating System Administration web page to replace the CSR Only version of the appropriate service certificate with the CA-signed version.
    1. On the 
      Cisco Unified Operating System Administration
       web page, click 
      Upload Certificate/Certificate chain
      . 
    2. Click 
      OK
      .
    3. Click 
      Close
      . The CSR version of the <
      service
      > certificate changes to CA-signed. 
  8. Restart 
    Cisco
     Services on all IM and Presence nodes. 
    1. Log in to the 
      Cisco Unified IM and Presence Serviceability
       server. 
    2. Click 
      Tools > Control Center - Network Services
      . 
    3. In the 
      Server
       drop-down list, select the IM and Presence server. Click 
      Go
      . 
    4. Under 
      IM and Presence Services
      , select 
      Cisco XCP Router
      . 
    5. Click 
      Restart
      . Click 
      OK
      .
    6. Click 
      Tools > Control Center - Feature Service
      . 
    7. In the 
      Server
       drop-down list, select the IM and Presence server. Click 
      Go
      . 
    8. Under 
      IM and Presence Services
      , select 
      Cisco SIP Proxy
      .
    9. Click 
      Restart
      . Click 
      OK
      .
    10. Repeat steps h and i for 
      Cisco Presence Engine
      .
  9. Restart the 
    Cisco Tomcat Service
     using SSH on all CUCM and CIMP nodes.
    In a command prompt, type 
    utils service restart Cisco Tomcat
    .