Microsoft Office Communicator Call Control with Microsoft OCS for IM and Presence Service on Cisco Unified Communications Manager, Release 9.1(1)
Security certificate configuration for IM and Presence
Download this chapter
Security certificate configuration for IM and PresenceSecurity certificate configuration for IM and Presence
Download the complete book
Microsoft Office Communicator Call Control with Microsoft OCS for IM and Presence Service on Cisco Unified Communications Manager, Release 9.1(1)Microsoft Office Communicator Call Control with Microsoft OCS for IM and Presence Service on Cisco Unified Communications Manager, Release 9.1(1) (PDF - 2 MB)
 Feedback

Security certificate configuration for IM and Presence

This topic is only applicable if you require a secure connection between IM and Presence and Microsoft OCS.

This topic describes how to configure security certificates using a standalone CA. If you use an enterprise CA, refer to the Interdomain Federation for IM and Presence Service on Cisco Unified Communications Manager for an example of the certificate exchange procedure using an enterprise CA.


Note

SIP Proxy certificates (own and trust) should be X.509 version 3 compliant.

Configure Standalone Root Certificate Authority (CA)

Procedure
    Step 1   Sign in to the CA server with Domain Administrator privileges.
    Step 2   Insert the Windows Server 2003 CD.
    Step 3   SelectStart > Settings > Control Panel.
    Step 4   Double-click Add or Remove Programs.
    Step 5   Select Add/Remove Windows Components.
    Step 6   Select Application Server.
    Step 7   Select Internet Information Services (IIS).
    Step 8   Complete the installation procedure.
    Step 9   Select Add/Remove Windows Components.
    Step 10   Select Certificate Services.
    Step 11   Select Next.
    Step 12   Select Standalone root CA.
    Step 13   Select Next.
    Step 14   Type the name of the CA root.
    Note   

    This name can be a friendly name for the CA root in the forest root.

    Step 15   Change the time to the number of years required for this certificate.
    Step 16   Select Next to begin installation.
    Step 17   Select the location for the certificate database and the certificate database files.
    Step 18   Select Next.
    Step 19   Select Yes when prompted to stop IIS.
    Step 20   Select Yes when prompted with a message regarding Active Server Pages.
    Step 21   Select Finish.
    What to Do Next

    Download root certificate from CA server.

    Download root certificate from CA server

    Before You Begin

    Configure the Standalone Root Certificate Authority.

    Procedure
      Step 1   Sign in to your CA server and open a web browser.
      Step 2   Open the URL http://<ca_server_IP_address>/certsrv.
      Step 3   Select on Download a CA certificate, certificate chain, or CRL.
      Step 4   Select Base 64 for the Encoding Method.
      Step 5   Select Download CA Certificate.
      Step 6   Save the certificate file certnew.cer to the local disk.

      Troubleshooting Tips

      If you do not know the Subject Common Name (CN) of the root certificate, you can use an external certificate management tool to find out. On Windows operating system, you can right-click the certificate file with a .cer extension and open the certificate properties.

      What to Do Next

      Upload root certificate onto IM and Presence

      Related Tasks

      Upload root certificate onto IM and Presence

      Before You Begin

      Download the Root Certificate from the CA Server.

      Procedure
        Step 1   Copy the certnew.cer file to the local computer that you use to administer the IM and Presence server.
        Step 2   Select Cisco Unified IM and Presence Operating System Administration > Security > Certificate Management.
        Step 3   Select Upload Certificate.
        Step 4   Select cup-trust from the Certificate Name menu.
        Note   

        Leave the Root Name field blank.

        Step 5   Select Browse.
        Step 6   Locate the certnew.cer file on your local computer.
        Note   

        You may need to change the certificate file to a .pem extension.

        Step 7   Select Upload File.
        Tip   

        Make a note of the new CA certificate filename you have uploaded to the cup-trust using the Certificate Management Find screen. This certificate filename (without the .pem or .der extension) is the value you enter in the 'Root CA' field when uploading the CA-signed SIP proxy certificate.

        What to Do Next

        Generate a certificate signing request for IM and Presence

        Related Tasks

        Generate a certificate signing request for IM and Presence

        Before You Begin

        Upload the Root Certificate onto IM and Presence.

        Procedure
          Step 1   Select Cisco Unified IM and Presence Operating System Administration > Security > Certificate Management.
          Step 2   Select Generate CSR.
          Step 3   Select cup from the Certificate Name menu.
          Step 4   Select Generate CSR.
          What to Do Next

          Download certificate signing request from IM and Presence

          Related Tasks

          Download certificate signing request from IM and Presence

          Before You Begin

          Generate a Certificate Signing Request for IM and Presence.

          Procedure
            Step 1   Select Cisco Unified IM and Presence Operating System Administration > Security > Certificate Management.
            Step 2   Select Download CSR.
            Step 3   Select cup from the Certificate Name menu.
            Step 4   Select Download CSR.
            Step 5   Select Save to save the cup.csr file to your local computer.
            What to Do Next

            Submit certificate signing request on CA server

            Related Tasks

            Submit certificate signing request on CA server

            Before You Begin

            Download the Certificate Signing Request from IM and Presence.

            Procedure
              Step 1   Copy the certificate request file cup.csr to your CA server.
              Step 2   Open the URL http://local-server/certserv or http://127.0.0.1/certsrv.
              Step 3   Select Request a certificate.
              Step 4   Select Advanced certificate request.
              Step 5   Select Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file.
              Step 6   Using a text editor like Notepad, open the cup self-certificate that you generated.
              Step 7   Copy all information from and including

              -----BEGIN CERTIFICATE REQUEST

              to and including

              END CERTIFICATE REQUEST-----

              Step 8   Paste the content of the certificate request into the Certificate Request text box.
              Step 9   Select Submit.

              The Request ID number displays.

              Step 10   Open Certificate Authority in Administrative Tools.

              The Certificate Authority window displays the request you just submitted under Pending Requests.

              Step 11   Right-click on your certificate request.
              Step 12   Select All TasksIssue.
              Step 13   Select Issued certificates and verify that your certificate has been issued.
              What to Do Next

              Download signed certificate from CA Server

              Related Tasks

              Download signed certificate from CA Server

              Before You Begin

              Submit the Certificate Signing Request on the CA Server.

              Procedure
                Step 1   Open http://<local_server>/certsrv on the Windows server that CA is running on.
                Step 2   Select View the status of a pending certificate request.
                Step 3   Select the option to view the request that was just submitted.
                Step 4   Select Base 64 encoded.
                Step 5   Select Download certificate.
                Step 6   Save the signed certificate to the local disk
                Step 7   Rename the certificate cup.pem.
                Step 8   Copy the cup.pem file to your local computer.
                What to Do Next

                Upload signed certificate to IM and Presence

                Related Tasks

                Upload signed certificate to IM and Presence

                Before You Begin

                Download the Signed Certificate from the CA Server.

                Procedure
                  Step 1   Select Cisco Unified IM and Presence Operating System Administration > Security > Certificate Management.
                  Step 2   Select Upload Certificate.
                  Step 3   Select cup from the Certificate Name menu.
                  Step 4   Specify the root certificate name. The root certificate name must contain the .pem or .der extension.
                  Step 5   Select Browse.
                  Step 6   Locate the signed cup.pem certificate on your local computer.
                  Step 7   Select Upload File.
                  What to Do Next

                  Security certificate configuration for Microsoft OCS

                  Related Tasks