Field Notice: FN - 70496 - Cisco IP Phones Might Fail to Operate Correctly Due to Expired Manufacturer Installed Certificate - Configuration Change Recommended

Notice

THIS FIELD NOTICE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE FIELD NOTICE OR MATERIALS LINKED FROM THE FIELD NOTICE IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS FIELD NOTICE AT ANY TIME.

Revision History

Revision	Publish Date	Comments
1.0	04-Feb-20	Initial Release
1.1	27-Apr-20	Updated the Products Affected Section

Products Affected

Affected Product ID	Comments
CP-9971-W-K9	Includes all 9971 Series Phones.
CP-9951-C-K9	Includes all 9951 Series Phones.
CP-8961-W-K9	Includes all 8961 Series Phones.
CP-8945-K9	Includes all 8945 Series Phones.
CP-8941-K9	Includes all 8941 Series Phones.
CP-7975	Includes all 7975 /7975G Series Phones.
CP-7965	Includes all 7965/7965G Series Phones.
CP-7962G	Includes all 7962 Series Phones.
CP-7945G	Includes all 7945 Series Phones.
CP-7942G=	Includes all 7942 Series Phones.
CP-7811-K9	Includes all 7811 Series Phones.
CP-7821-K9=	Includes all 7821 Series Phones.
CP-7832-K9=	Includes all 7832 Series Phones.
CP-7841-K9=	Includes all 7841 Series Phones.
CP-7861-K9	Includes all 7861Series Phones.
CP-6921	Includes all 6921 Series Phones.
CP-6941	Includes all 6941 Series Phones.
CP-6945-W-K9	Includes all 6945 Series Phones.
CP-8811-K9	Includes all 8811 Series Phones.
CP-8821-K9	Includes all 8821 Series Phones.
CP-8831-K9++=	Includes all 8831 Series Phones.
CP-8832-K9	Includes all 8832 Series Phones.
CP-8841-K9	Includes all 8841 Series Phones.
CP-8845-K9	Includes all 8845 Series Phones.
CP-8851-K9	Includes all 8851 Series Phones.
CP-8861-K9	Includes all 8861 Series Phones.
CP-8865NR-K9=	Includes all 8865 Series Phones.
CP-8865-K9=	Includes all 8865 Series Phones.
CP-8865NR-K9++=	Includes all 8865 Series Phones.
CP-8865-K9	Includes all 8865 Series Phones.
CP-8865-K9++=	Includes all 8865 Series Phones.
CP-8865-NC-K9=	Includes all 8865 Series Phones.
ATA190	Includes all ATA190 On Prem. Devices.
ATA191-K9	Includes all ATA191 On Prem. Devices.

Defect Information

Defect ID	Headline
CSCvs52559	Expiring SUDI/MIC in phones

Problem Description

Cisco IP Phones that only contain and utilize the Manufacturer Installed Certificate (MIC) for secure network deployment will fail to operate when the certificate expires. In the event of certificate expiration, an administrator must install a Locally Significant Certificate (LSC) in order to ensure secure device communication and operation.

See Configure LSC on Cisco IP Phone with CUCM for more information.

Background

Phones manufactured prior to 2018 might contain a MIC with a 10-year expiration date that could impact phone functionality in certain secure deployment scenarios. In non-secure deployments, phones that contain expired MICs will continue to operate as normal. Customers that previously configured phones in a secure deployment reported to the Technical Assistance Center (TAC) that phones older than 10 years no longer work. Cisco TAC has analyzed the conditions and provided a resolution.

Problem Symptom

Phone failure symptoms vary from the inability to register to Unified Communications Manager (Unified CM) to not completing call media path setup for a placed call.

The known scenarios in which a phone will not work properly with an expired MIC are:

• 802.1x authentication at a switching level (RADIUS, Identity Services Engine, and so on)
• VPN connection that utilizes certificate-based authentication (Adaptive Security Appliance or Cisco IOS^®)
• Secure device registration with Unified CM
• Restricted access to the phone's webpage via any current browser
• Secure Survivable Remote Site Telephony (SRST) registration on a voice gateway in the case of a Unified CM failure

Problem Impact

The impact to the customer’s network includes loss of voice communications, intermittent call interruptions, or non-deterministic endpoint behavior. Phones previously deployed and configured in a secure manner that use the supported LSC method and also contain an expired MIC will continue to operate normally.

Workaround/Solution

Cisco IP Phones do not support field replacement of the MIC. No hardware replacement is necessary as the LSC method is tested, supported, and adds additional security to the phone and the Unified Communications deployment.

If a customer encounters issues related to secure deployment or features on the phones, then the administrator should follow the procedure in Configure LSC on Cisco IP Phone with CUCM in order to install LSCs for secure communication.

For More Information

If you require further assistance, or if you have any further questions regarding this field notice, please contact the Cisco Systems Technical Assistance Center (TAC) by one of the following methods:

• Open a service request on Cisco.com
• By email
• By telephone

Receive Email Notification For New Field Notices

My Notifications—Set up a profile to receive email updates about reliability, safety, network security, and end-of-sale issues for the Cisco products you specify.