Problem
You cannot remove or overwrite your existing certificate with a new one.
Possible Cause
Cisco WebEx Meetings Server does not allow you to remove certificates but you can overwrite them. If you are unable to overwrite your certificate, SSO might be enabled.
Solution
Sign in to the Administration site and disable SSO before you attempt to overwrite your certificate. Refer to "Disabling SSO" in the Cisco WebEx Meetings Server Administration Guide for more information.
Cannot Remove an SSO IdP Certificate
Problem
You are unable to remove an SSO IdP certificate from your system.
Possible Cause
The certificate format is incorrect.
Solution
Upload new IdP certificates and make sure the certificate format is Base64 encoded X.509.
Certificate Chain Error
Problem
You receive a certificate chain error.
Possible Cause
One or more certificates are missing in the middle of the chain.
Possible Cause
The certificates are in the wrong order in the file.
Solution
Copy each individual certificate into a separate file.
Solution
Use your certificate viewer of choice
(OpenSSL, Keychain) to examine the subject and issuer of each certificate to make sure the chain is complete.
Solution
Reorder the file correctly or add missing certificates and try again.
Certificate Does not Match Private Key
Problem
You receive an error message indicating that your certificate does not match the private key.
Possible Cause
The private key that matches your certificate is no longer on your system. This can occur if you generated a second certificate signing request (CSR) or self-signed certificate, or performed any operation that changed hosts or URLs on your system.
Solution
If you saved the private key that you downloaded from your system when you generated your CSR, you can upload that together with your certificate. Make sure the certificate is in PEM format. Open the saved private key file with a text editor and copy the private key. Include the -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- lines. Open your PEM-format certificate in a text editor and paste the private key at the top of the file, above the -----BEGIN CERTIFICATE----- line. Make sure there are no extra blank lines or text. Save this combined file and upload to your system. Note that if you changed hosts or URLs since generating your CSR, and you are using a SAN certificate, that certificate is no longer valid for your system. If you are using a wildcard certificate, you can perform this procedure. If you do not have the private key saved, you will need to generate another CSR and purchase a new certificate.
Certificate Not Yet Valid Error
Problem
You receive an error message indicating that your certificate is not yet valid.
Possible Cause
The validity period of the certificate has not started yet.
Solution
Wait until the certificate becomes valid and upload it again.
Solution
Generate a new CSR and use it to obtain a new, valid certificate.
Solution
Ensure that the system time is correct.
Expired Certificate Error
Problem
You receive an expired certificate error.
Possible Cause
The validity period of the certificate has ended.
Solution
Generate a news CSR and use it to obtain a new, valid certificate. Ensure that the system time is correct.
Incorrect X.509 Certificate to Validate SAML Assertion
Problem
You receive the error message, "Incorrect X.509 certificate to validate SAML assertion. Contact your administrator for further support."
Possible Cause
Your certificate or IdP is not valid.
Solution
Validate your certificate or IdP as necessary.
Invalid Certificate Error
Problem
You receive an invalid certificate error.
Possible Cause
The certificate file is malformed.
Solution
If uploading a PEM file, make sure there is no text or blank lines before the -----BEGIN CERTIFICATE----
or after the -----END CERTIFICATE-----.
Solution
Make sure the certificate is in a supported format (X.509 in PEM, DER encoding or encrypted PKCS#12).
Solution
Generate a new CSR and use it to obtain a new, valid certificate.
Invalid Domain Error—Wildcard Certificate
Problem
You receive an invalid domain error message.
Possible Cause
The user uploaded a wildcard certificate. One or more of the host names in the system or the site or admin URL are not in the same domain as specified in the common name of the certificate. When using a wildcard certificate, all hosts and URLs in the system must be in a single domain. If using multiple domains, you need a SAN certificate instead.
Solution
Check that you are using the correct certificate and upload it again.
Solution
Obtain a new certificate and upload it.
Solution
Examine the certificate using OpenSSL to see what domain is present in the certificate.
Invalid Domain Error—SAN Certificate
Problem
You receive an invalid domain error message.
Possible Cause
The user uploaded a SAN certificate. The CN does not match the site URL.
Solution
Check that you are using the correct certificate and upload again.
Solution
Get a new certificate and upload again.
Solution
Examine the certificate using OpenSSL to see that all hosts are present.
Key Decryption Error
Problem
You receive a key decryption error.
Possible Cause
The key is encrypted and a password was not supplied.
Possible Cause
The key is encrypted and an incorrect password was supplied.
Possible Cause
The key is malformed.
Possible Cause
The key is not supported. Supported keys include PCKS#1, PKCS#8, encrypted PKCS#12.
Solution
Make sure that you are entering the correct password.
Solution
Try reading the key with OpenSSL.
Key Size Error
Problem
You receive a key size error message.
Possible Cause
The user is trying to upload a private key and certificate or a certificate alone but the key length is too small.
Solution
Obtain a new certificate and private key with a key size of at least 2048 bits. Use OpenSSL to verify the key length.
Revoked Certificate Prevents Administration Site Access
Problem
Your administrators and users cannot access the administration and end-user sites. The following error message is displayed: "There is a problem with this website's security certificate. This organization's certificate has been revoked."
Possible Cause
You regenerated your private key and imported a revoked SSL certificate. After turning off maintenance mode, you see the following security alert: "The security certificate for this site has been revoked. This site should not be trusted."
Solution
In Internet Explorer, select Tools > Internet Options, select the Advanced tab, and uncheck "Check for server certificate revocation." Regenerate and re-import your certificate. Refer to "Managing Certificates" in the Cisco WebEx Meetings Server Administration Guide for information on how to generate a new Certificate Signing Request (CSR), obtaining a certificate from a certificate authority, and importing the certificate to your system. Your administrators and users should be able to access the administration and end-user sites after you re-import your certificate.
Self-Signed Certificate After Upgrade
Problem
The system reverts to a self-signed certificate after a third-party certificate was uploaded.
Possible Cause
You performed an upgrade, expansion, added high availability, changed a site URL, or a similar change.
Solution
If the operation you performed changed the host names or URLs on your system, your existing certificate is no longer valid. Generate a new CSR and obtain a new certificate. If the operation did not change any host names or URLs, you might restore the private key and certificate by uploading them again.
Cannot Establish TLS Due to Missing Extension in Certificate
Problem
TLS cannot be established. When checking sniffing packets, it shows CUCM sends Un-Support certificate to Cisco WebEx Meetings Server during CUCM and Orion TLS handshaking.
Possible Cause
CUCM check X509 Extended Key Usage in certificate.
Solution
Use your certificate viewer of choice to ensure that your certificate authority has included the following extensions. If you find an extension is missing from your certificate, contact your certificate authority for assistance.
X509v3 Extended Key Usage:
TLS Web Server Authentication,
TLS Web Client Authentication
Unable to Access Cisco WebEx Meetings Server from My Mobile Device
Problem
I am unable to access Cisco WebEx Meetings Server from my mobile device.
Possible Cause
Your self-signed certificate prevents you from accessing your system.
Solution
Administrators who want to provide access to Cisco WebEx Meetings Server from mobile
devices must send the certificate to all their users by email. Users will not be able to sign in without the certificate.
In addition, some Cisco WebEx Meetings Server users might have certificates that are signed by a certificate authority that
is not recognized by their mobile devices.
Instructions for administrators: Sign in to the Administration site. Select Settings > Security > Certificates. Under SSL Certificate select More Options. Select Export SSL Certificate. The export process creates a file called CAcert.pem.txt. Rename this file with a .pem extension (for example, CAcert.pem). Email this .pem file to your users (Note that your users must be able to access the email on their mobile devices.). Make sure to include the following instructions to your users in the body of the email. Instructions for end-users: Open the .pem attachment to this email. On the Install Profile page, select Install, and then select Install again to confirm. Attempt to sign in to your Meetings application on your mobile device after making these changes.
Untrusted Connection
Problem
You receive an untrusted connection message. The client might not be able to verify the Cisco WebEx Meetings Server certificate using its truststore. Microsoft Internet Explorer uses the operating system truststore. Mozilla Firefox uses its own built-in truststore. To view Windows trusted root certificates: http://technet.microsoft.com/en-us/library/cc754841.aspx.
Possible Cause
The system is using a self-signed certificate. This may occur because the system is a new installation or the customer had an existing certificate but performed an operation which invalidated that certificate and the system generated a self-signed certificate in its place.
Solution
Purchase a certificate from a well-known certificate authority and upload it to the system. "Well known" means that the certificate authority's root certificate is in the truststore of all your browsers.
Possible Cause
The issuer of the Cisco WebEx Meetings Server certificate is not trusted by the client.
Solution
Make sure that the issuer of the certificate is in your client's truststore. In particular, if you use a private or internal certificate authority, you are responsible for distributing its root certificate to all your clients or each client can add it manually.
Solution
Upload an intermediate certificate to Cisco WebEx Meetings Server. Sometimes, while the issuer of the certificate is an intermediate certificate authority that is not well known, it's issuer, the root certificate authority, is well known. You can either distribute the intermediate certificate to all clients or upload it to Cisco WebEx Meetings Server together with the end entity certificate.
Meeting Client does not Launch in Vista64bit, IE8 64bit
Problem
After selecting Start, installing, and enabling ActiveX, the meeting client does not appear. Java also fails to launch.
Possible Cause
An unknown VeriSign root certificate in Vista.
Solution
Update the certificate from *VeriSign Class 3 Code Signing 2010 CA* to *VeriSign Class 3 Public Primary Certification Authority - G5* and retry the meeting client.