Field Notice: FN - 72593 - Expiring Manufacturer Installed Certificate in Multiplatform Phones - Configuration Change Recommended

Notice

THIS FIELD NOTICE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE FIELD NOTICE OR MATERIALS LINKED FROM THE FIELD NOTICE IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS FIELD NOTICE AT ANY TIME.

Revision History

Revision	Publish Date	Comments
1.0	24-Aug-23	Initial Release

Products Affected

Affected Product ID	Comments
CP-6821-3PCC-K9=
CP-6841-3PCC-K9=
CP-6851-3PCC-K9=
CP-6861-3PW-K9
CP-6871-3PCC-K9=
CP-7811-3PCC-K9=
CP-7821-3PCC-K9=
CP-7832-3PCC-K9=
CP-7841-3PCC-K9=
CP-7861-3PCC-K9=
CP-8811-3PCC-K9=
CP-8831-3PCC-K9=
CP-8832-3PCC-K9=
CP-8841-3PCC-K9=
CP-8845-3PCC-K9=
CP-8851-3PCC-K9=
CP-8861-3PCC-K9=
CP-8865-3PCC-K9=
ATA191-3PW-K9
ATA192-3PW-K9

Defect Information

Defect ID	Headline
CSCwf82386	Expiring SUDI/MIC in phones

Problem Description

Multiplatform phones (MPPs) will fail to provision or operate properly due to an expiring Manufacturer Installed Certificate (MIC).

Background

The MIC issued by the Cisco Manufacturing Certificate Authority (CMCA) is used to provide a Secure Unique Device Identifier (SUDI) certificate in phones. A MIC is valid up to 10 years from the date of manufacture or on May 14, 2029, whichever comes first.

The products listed in the Products Affected section are base Product ID's (PIDs). PIDs related to the listed base PIDs are still affected.

Problem Symptom

Once the MIC expires:

• Secure provisioning might not work if the server challenges the phone to present the client certificate.
• Any HTTPS communication will not work if it requires Mutual Transport Layer Security (TLS).
• Phone media might not work.
• Phone software upgrades might fail if the server validates the phone MIC before providing the firmware files.
• 802.1x authentication will fail if the phone is authenticated via a MIC.

Workaround/Solution

For MPP desk and conference phones, upgrade to the latest firmware and then turn on SUDI refresh. In firmware versions later than Version 12.0.3, the refresh is completed automatically.

For devices running firmware versions between Version 11.3.5 and Version 12.0.2, you have these options:

• Option 1: In the phone configuration file (cfg.xml) with XML, enter a string in this format:

  <MIC_Cert_Refresh_Enable ua="na">Yes</MIC_Cert_Refresh_Enable>

• Option 2: On the phone web page, navigate to Voice > Provisioning > MIC Cert Settings and choose Yes in order to enable the MIC certificate renewal.

Be sure to update your server trust store to include new Cisco manufacturing root certificates listed in field notice FN72302.

Notes:

• There is no workaround for 8831-3PCC.  In order to have secure communications, plan on procuring a Cisco 8832 MPP.
• The ATA-191 MPP and ATA-192 MPP do not have a SUDI refresh feature available yet. The earliest expiry of these devices’ certificates starts in 2027.

For More Information

If you require further assistance, or if you have any further questions regarding this field notice, please contact the Cisco Systems Technical Assistance Center (TAC) by one of the following methods:

• Open a service request on Cisco.com
• By email or telephone

Receive Email Notification For New Field Notices

My Notifications—Set up a profile to receive email updates about reliability, safety, network security, and end-of-sale issues for the Cisco products you specify.