Field Notice: FN74094 - Ending Support for CSR Signing for SPA Phones and SPA ATAs - Product Migration Required
Available Languages
Notice
THIS FIELD NOTICE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE FIELD NOTICE OR MATERIALS LINKED FROM THE FIELD NOTICE IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS FIELD NOTICE AT ANY TIME.
Products Affected
| Affected Product Name | Description | Comments |
|---|---|---|
| PAP2T-AS | ^Phone Adapter with 2 Ports for Voice-over-IP (North America) | |
| PAP2T-AU | ^Phone Adapter with 2 Ports for Voice-over-IP (North America) | |
| PAP2T-CN | ^Phone Adapter with 2 Ports for Voice-over-IP | |
| PAP2T-EU | ^Phone Adapter with 2 Ports for Voice-over-IP (Europe) | |
| PAP2T-KR | ^Phone Adapter with 2 Ports for Voice-over-IP | |
| PAP2T-NA | ^Phone Adapter with 2 Ports for Voice-over-IP (North America) | |
| PAP2T-R1 | Phone Adapter with 2 Ports for Voice-over-IP (North America) | |
| PAP2T-R2 | ^Phone Adapter with 2 Ports for Voice-over-IP (Europe) | |
| PAP2T-SG | ^Phone Adapter with 2 Ports for Voice-over-IP (Singapore) | |
| PAP2T-TB | ^Internet Phone Adapter with 2 Ports for Voice-over-IP | |
| PAP2T-UK | ^Phone Adapter with 2 Ports for Voice-over-IP (UK) | |
| PAP2T-VN | ^Phone Adapter with 2 Ports for Voice-over-IP (UK) | |
| RTP300-EU | ^Broadband Router with 2 Phone Ports | |
| RTP300-NA | ^Broadband Router with 2 Phone Ports | |
| SPA112 | ^2 Port Phone Adapter | |
| SPA112-BR | ^2 Port Phone Adapter | |
| SPA112-XU | ^2 Port Phone Adapter, SRTP Removed | |
| SPA122 | ^ATA with Router | |
| SPA122-BR | ^ATA with Router | |
| SPA122-XU | ^ATA with Router, SRTP Removed | |
| SPA2002 | ^Phone Adapter ( 2 FXS ports) | |
| SPA2100-S6 | ^Phone Adapter with 2 FXS and 2 Ethernet Ports (LAN + WAN) | |
| SPA2102-AN | ^Single Port Router with 2 Phone Ports | |
| SPA2102-AS | Single Port Router with 2 Phone Ports | |
| SPA2102-AU | Single Port Router with 2 Phone Ports (ANZ) | |
| SPA2102-BU | ^Single Port Router with 2 Phone Ports | |
| SPA2102-CN | Single Port Router with 2 Phone Ports | |
| SPA2102-EL | ^Single Port Router with 2 Phone Ports | |
| SPA2102-EU | ^Single Port Router with 2 Phone Ports (Europe) | |
| SPA2102-NA | Single Port Router with 2 Phone Ports (North America) | |
| SPA2102-PU | ^Single Port Router with 2 Phone Ports | |
| SPA2102-R1 | ^Single Port Router with 2 Phone Ports (North America) | |
| SPA2102-R2 | ^Single Port Router with 2 Phone Ports (Europe) | |
| SPA2102-R3 | Single Port Router with 2 Phone Ports (United Kingdom) | |
| SPA2102-R4 | Single Port Router with 2 Phone Ports | |
| SPA2102-SF | ^Single Port Router with 2 Phone Ports | |
| SPA2102-SU | ^Single Port Router with 2 Phone Ports | |
| SPA2102-TO | ^Single Port Router with 2 Phone Ports (Telio) | |
| SPA2102-UK | Single Port Router with 2 Phone Ports (United Kingdom) | |
| SPA232D | ^Analog Telephone Adapter with DECT Base Station | |
| SPA232D-G1 | ^Multi-Line DECT ATA | |
| SPA232D-G1-1 | ^Multi-Line DECT ATA | |
| SPA232D-G7 | ^Multi-Line DECT ATA | |
| SPA232D-G7-1 | ^Multi-Line DECT ATA | |
| SPA232D-R1 | ^Multi-Line DECT ATA | |
| SPA232D-R7 | ^Multi-Line DECT ATA | |
| SPA232D-XU | ^Multi-Line DECT ATA, SRPT Removed | |
| SPA301-G1 | ^1 Line IP Phone | |
| SPA301-G2 | ^1 Line IP Phone | |
| SPA301-G3 | ^1 Line IP Phone | |
| SPA301-G4 | ^1 Line IP Phone | |
| SPA302 EXP | SPA302 EXPAND | |
| SPA302 EXPAND | OPT EXPAND | |
| SPA302D-G1 | ^Mobility Enhanced Cordless Handset | |
| SPA302D-G1-1 | ^Mobility Enhanced Cordless Handset | |
| SPA302D-G7 | ^Mobility Enhanced Cordless Handset | |
| SPA302D-G7-1 | ^Mobility Enhanced Cordless Handset | |
| SPA302DKIT-G1 | ^Multi-Line DECT Handset with Base Station | |
| SPA302DKIT-G7 | ^Multi-Line DECT Handset with Base Station | |
| SPA302DKIT-XU | ^Multi-Line DECT Handset with Base Station, SRTP Removed | |
| SPA303-G1 | ^3 Line IP Phone w/Display, PC Port & NA Power Adapter | |
| SPA303-G2 | ^3 Line IP Phone w/ Display and PC Port, Europe Power Adapter | |
| SPA303-G3 | ^3 Line IP Phone with Display and PC Port, UK Power Adapter | |
| SPA303-G4 | ^3 Line IP Phone w/Display, PC Port & Australia Power Adapter | |
| SPA303-R1 | ^3 Line IP Phone with Display and PC Port, RC SKU | |
| SPA303-R2 | ^3 Line IP Phone with Display and PC Port | |
| SPA3102-AN | ^Single Port Router with 1 Phone Port and 1 FXO Port | |
| SPA3102-AS | ^Single Port Router with 1 Phone Port and 1 FXO Port | |
| SPA3102-AU | ^Single Port Router with 1 Phone Port and 1 FXO Port (ANZ) | |
| SPA3102-EA | ^Single Port Router with 1 Phone Port and 1 FXO Port (Europe) | |
| SPA3102-EU | ^Single Port Router with 1 Phone Port and 1 FXO Port (Europe) | |
| SPA3102-KR | ^Voice Gateway with Router | |
| SPA3102-NA | ^Single Port Router with 1 Phone Port and 1 FXO Port (NA) | |
| SPA3102-R1 | ^Single Port Router with 1 Phone Port and 1 FXO Port (NA) | |
| SPA3102-R2 | ^Single Port Router with 1 Phone Port and 1 FXO Port (NA) | |
| SPA3102-R3 | ^Single Port Router with 1 Phone Port and 1 FXO Port (UK) | |
| SPA3102-R4 | ^Single Port Router with 1 Phone Port and 1 FXO Port (ANZ) | |
| SPA3102-UK | ^Single Port Router with 1 Phone Port and 1 FXO Port (UK) | |
| SPA400-AU | ^Internet Telephony Gateway with 4 FXO Ports (Australia) | |
| SPA400-EU | ^Internet Telephony Gateway with 4 FXO Ports (Europe) | |
| SPA400-NA | ^Internet Telephony Gateway with 4 FXO Ports (North America) | |
| SPA500-HANDSET= | ^Cisco SPA 500 Series Handset | |
| SPA501G | ^8 Line IP Phone With PoE and PC Port | |
| SPA502G | ^1 Line IP Phone With Display, PoE, PC Port | |
| SPA502G-TLS | ^Telstra-AU SKU : 1 Line IP Phone With Display, PoE, PC Port | |
| SPA502G-XU | ^1 Line IP Phone With Display, PoE, PC Port- Crypto Disabled | |
| SPA504G | ^4 Line IP Phone With Display, PoE and PC Port | |
| SPA504G-TLS | ^Telstra-SKU : 4 Line IP Phone With Display, PoE and PC Port | |
| SPA504G-XU | ^4 Line IP Phone With Display, PoE and PC Port-Crypto Disable | |
| SPA508G | ^8 Line IP Phone With Display, PoE and PC Port | |
| SPA509G | ^12 Line IP Phone With Display, PoE and PC Port | |
| SPA512G | ^1 Line IP Phone with Display, PoE and Gigabit PC Port | |
| SPA514G | ^4 Line IP Phone with Display, PoE and Gigabit PC Port | |
| SPA514G-XU | ^4 Line IP Phone , PoE and Gigabit PC Port -Crypto disabled | |
| SPA525G | ^5 Line IP Phone with Color Display, PoE, 802.11g | |
| SPA525G-TLS | ^Telstra-AU : 5-Line IP Phone with Color Display, PoE, 802.11 | |
| SPA525G2 | ^5-Line IP Phone with Color Display, PoE, 802.11g, Bluetooth | |
| SPA525G2-EU | ^5-Line IP Phone, 802.11g ( EU Version), Bluetooth | |
| SPA525G2-TLS | Telstra SKU: 5-Line IP Phone with Color Display, PoE, 802.11 | |
| SPA525G= | ^5 Line IP Phone with Color Display, PoE, 802.11g | |
| SPA8000-BR | ^8-Port IP Telephony Gateway | |
| SPA8000-G1 | ^8-Port IP Telephony Gateway | |
| SPA8000-G4 | ^8-Port IP Telephony Gateway | |
| SPA8000-G5 | ^8-Port IP Telephony Gateway | |
| SPA8000-XU | ^8-Port IP Telephony Gateway, SRTP Removed | |
| SPA8800 | ^IP Telephony Gateway with 4 FXS and 4 FXO Ports | |
| SPA8800-G1 | ^IP Telephony Gateway with 4 FXS and 4 FXO Ports | |
| SPA8800-G4 | ^IP Telephony Gateway with 4 FXS and 4 FXO Ports | |
| SPA8800-G5 | ^IP Telephony Gateway with 4 FXS and 4 FXO Ports | |
| SPA8800-XU | ^IP Telephony Gateway with 4 FXS and 4 FXO Ports SRTP Removed | |
| SPA9000-AU | ^IP Communication System (ANZ) | |
| SPA9000-EU | ^IP Communication System (Europe) | |
| SPA9000-NA | ^IP Telephony System | |
| SPA9000-UK | ^IP Communication System (United Kingdom) | |
| SPA901-AU | ^1-Line IP Telephone (ANZ) | |
| SPA901-EU | ^1-Line IP Telephone (Europe) | |
| SPA901-NA | 1-Line IP Telephone (North America) | |
| SPA901-SG | ^1-Line IP Telephone (Singapore) | |
| SPA901-UK | ^1-Line IP Telephone (United Kingdom) | |
| SPA921-EU | ^1-Line IP Telephone with 1-Port Ethernet, Display (Europe) | |
| SPA921-NA | 1-Line IP Telephone with 1-Port Ethernet, Display (NA) | |
| SPA921-SG | ^1-Line IP Telephone with 1-Port Ethernet, Display (SG) | |
| SPA921-UK | ^1-Line IP Telephone with 1-Port Ethernet, Display (UK) | |
| SPA922-EU | ^1-Line IP Telephone with 2-Port Switch, PoE and Display | |
| SPA922-NA | ^1-Line IP Telephone with 2-Port Switch, PoE and Display | |
| SPA932 | 32 Button Attendant Console for the SPA962 IP Phone | |
| SPA941-AS | ^IP Phone | |
| SPA941-AU | ^IP Phone | |
| SPA941-EU | ^IP Phone | |
| SPA941-KR | ^IP Phone | |
| SPA941-NA | IP Phone | |
| SPA941-SG | ^IP Phone | |
| SPA941-UK | ^IP Phone | |
| SPA942-AS | ^2- or 4-Line IP Telephone with 2-Port Ethernet Switch (NA) | |
| SPA942-EU | ^2- or 4-Line IP Telephone with 2-Port Ethernet Switch (EU) | |
| SPA942-NA | ^2- or 4-Line IP Telephone with 2-Port Ethernet Switch (NA) | |
| SPA942P-AU | ^2- or 4-Line IP Telephone with 2-Port Ethernet Switch (EU) | |
| SPA942P-NA | ^2- or 4-Line IP Telephone with 2-Port Ethernet Switch (EU) | |
| SPA962-EU | ^6-Line IP Telephone with 2-Port Switch, PoE and Display | |
| SPA962-NA | 6-Line IP Telephone with 2-Port Switch, PoE and Display | |
| SRP521W-K9-G1 | SRP521, FE WAN, 802.11n FCC, 2FXS/1FXO, US power | |
| SRP521W-K9-G4 | SRP521, FE WAN, 802.11n non-FCC, 2FXS/1FXO, ANZ power | |
| SRP521W-K9-G5 | SRP521, FE WAN, 802.11n ETSI, 2FXS/1FXO, EU/UK power | |
| SRP521W-U-A-K9 | ^SRP521W, FE WAN, 802.11n FCC, 128DRAM 64FLASH,2FXS/1FXO | |
| SRP521W-U-E-K9 | ^SRP521W, FE WAN, 802.11n ETSI, 128DRAM 64FLASH, 2FXS/1FXO | |
| SRP521W-U-K9-G4 | SRP521, FE WAN, 802.11n non-FCC, 128DRAM 64 FLASH, ANZ | |
| SRP526W-K9-G5 | SRP526, ADSL2+ AnnexB, 802.11n ETSI, 2FXS/1FXO, EU/UK power | |
| SRP526W-U-E-K9 | ^SRP526W, ADSL2+ Annex B, 802.11n ETSI, 128DR/64FL, 2FXS/1FXO | |
| SRP527W-K9-G1 | SRP527, ADSL2+ AnnexA, 802.11n FCC, 2FXS/1FXO, US power | |
| SRP527W-K9-G4 | SRP527, ADSL2+ AnnexA, 802.11n non-FCC, 2FXS/1FXO, ANZ power | |
| SRP527W-K9-G4-TLS | ^SRP527, ADSL2+, 802.11n,128DRAM 64FLASH, TELSTRA ONLY | |
| SRP527W-K9-G5 | SRP527, ADSL2+ AnnexA, 802.11n ETSI, 2FXS/1FXO, EU/UK power | |
| SRP527W-U-A-K9 | ^SRP527W, ADSL2+ Annex A, 802.11n FCC, 128DR/64FL, 2FXS/1FXO | |
| SRP527W-U-E-K9 | ^SRP527W, ADSL2+ Annex A, 802.11n ETSI, 128DR/64FL, 2FXS/1FXO | |
| SRP527W-U-K9-G4 | SRP527, ADSL2+ AnnexA, 802.11n non-FCC,128DRAM 64FLASH,ANZ | |
| SRP531W-CN-K9 | Cisco Service Ready Platform with WiFi | |
| SRP532W-CN-K9 | Cisco Service Ready Platform with WiFi and advanced security | |
| SRP541W-A-K9 | ^SRP541, GE WAN, 802.11n FCC, 4FXS/1FXO | |
| SRP541W-E-K9 | ^SRP541, GE WAN, 802.11n ETSI, 4FXS/1FXO | |
| SRP546W-BRI-E-K9 | ^SRP546, ADSL2+ AnnexB, 802.11n ETSI, 2BRI/4FXS/1FXO | |
| SRP546W-E-K9 | ^SRP546, ADSL2+ AnnexB, 802.11n ETSI, 4FXS/1FXO | |
| SRP547W-A-K9 | ^SRP547, ADSL2+ AnnexA, 802.11n FCC, 4FXS/1FXO | |
| SRP547W-BRI-E-K9 | ^SRP547, ADSL2+ AnnexA, 802.11n ETSI, 2BRI/4FXS/1FXO | |
| SRP547W-E-K9 | ^SRP547, ADSL2+ AnnexA, 802.11n ETSI, 4FXS/1FXO | |
| WRP400-G1 | ^Wireless-G Broadband Router with 2 Phone Ports | |
| WRP400-G2 | ^Wireless-G Broadband Router with 2 Phone Ports | |
| WRP400-G3 | ^WRP400-G3,V1.0,Wireless-G Broadband Router, 2 Phone Ports | |
| WRP400-G4 | ^Wireless-G Broadband Router with 2 Phone Ports | |
| WRP400-R1 | ^Wireless-G Broadband Router with 2 Phone Ports | |
| WRP400-R2 | ^Wireless-G Broadband Router with 2 Phone Ports | |
| WRP500-A-K9 | ^Wireless Router for NA; Pb-Free | |
| WRP500-E-K9 | ^Wireless Router for EU; Pb-Free | |
| WRP500-Z-K9 | ^Wireless Router for EU; Encryption Striped,Pb-Free | |
| WRTP54G-NA | ^Wireless-G IP Phone |
Defect Information
| Defect ID | Headline |
| CSCwi05418 | SPA504G, SPA303 : End of CSR Signing Support |
Problem Description
Cisco Customer Device Activation (CDA), formerly Cisco Enablement Data Orchestration System (EDOS), will end support for the signing of SPA products' certificate signing requests (CSRs) from the following root certificates:
- Sipura Technology Provisioning Root Authority 1 - Maximum validity until April 7, 2024
- Cisco Small Business Provisioning Root Authority 1 - Maximum validity until April 7, 2024
- Cisco Small Business Provisioning Root Authority 2 - Maximum validity until May 31, 2025
Background
Prior to this notice, service providers could create a CSR, upload it to the Cisco CDA portal, and get a signed certificate, which would be installed on the provisioning server. The phone could then validate the server certificate and trust the communication.
The following table lists product options that used to be available on the Cisco CDA web portal to sign CSRs. Currently, only the last option is available for self-service.
| Product | Root Certificate | Availability |
|---|---|---|
| PAP2 WRTP RTP |
Cisco Linksys Provisioning Root Authority 1 | Not available |
| PAP2T WRP400 SPA2xxx SPA3xxx SPA9xx SPA3xx SPA5xx |
Sipura Technology Provisioning Root Authority 1 | One-time exception to renew for maximum validity until April 7, 2024, by opening a support case here |
| SPA1xx SPA232D SPA3xx SPA5xx SRP5xx |
Cisco Small Business Provisioning Root Authority 1 | |
| SPA1xx Firmware Release 1.3.3 and later SPA232D Firmware Release 1.3.3 and later SPA5xx Firmware Release 7.5.6 and later CP-68xx-3PCC CP-78xx-3PCC/CP-88xx-3PCC ATA19X |
Cisco Small Business Provisioning Root Authority 2 | For SPA phones and SPA ATAs: Available until May 31, 2025 For MPP phones and MPP ATA191/192: Available (root cert may change in future) |
Problem Symptom
Once CSR signing support has ended, customers will not be able to deploy Cisco signed server certificates to provision their SPA phones and SPA ATAs.
Workaround/Solution
End of support has been announced for impacted devices. These devices are vulnerable as security patches are no longer offered. The best course of action is to replace those devices with currently supported devices before the impact date.
If CSR signing is still supported for a product, then renew the certificate by the following dates:
- For certificates issued by Cisco Small Business Provisioning Root Authority 2, renew from the Cisco CDA web portal. For certificates issued starting June 1, 2024, the certificate validity will be limited to May 31, 2025.
- For certificates issued by Sipura Technology Provisioning Root Authority 1 and Cisco Small Business Provisioning Root Authority 1, a one-time exception can be made to renew for maximum validity up to April 7, 2024, by opening a support case here.
Upgrade devices to the latest available firmware if it supports custom root certificate authority (CA) upload functionality.
Customers should use their custom root CA-issued certificate for their telephony service to let a device establish a secure connection by defining the path to the CA using the Custom CA URL parameter for their phone and ATA configurations. Customers can define the path using one of the following options:
- Web portal: Voice > Provisioning > CA Settings > Custom CA Rule
- XML configuration: <Custom_CA_Rule ua="na">http://your-file-server.test/root-cert.crt</Custom_CA_Rule>
- Plain text file: Custom_CA_RULE "" ;
References:
- https://community.cisco.com/t5/voice-systems/secure-provisioning/td-p/3233479
- https://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/csbpvga/ata/provisioning/guide/Provisioning.pdf
Reach out to the Cisco sales/account team to review upgrade options for the following products:
- http://cisco.com/go/mpp
- https://cisco.com/go/mpp6800
- https://cisco.com/go/mpp7800
- https://cisco.com/go/mpp8800
- MPP ATAs 191 / 192
How to Identify Affected Products
Check your server certificate and device software release and compare it against the following table to determine the end of CSR signing support:
| Device | End of CSR Signing Support |
|---|---|
| PAP2T SPA1xx SPA232D SPA2xxx SPA3xx SPA3xxx SPA4xx SPA5xx SPA8xxx SPA9xx SPA9xxx SRP5xx WRP400 WRP500 |
On April 7, 2024, if the server certificate is issued from either Sipura Technology Provisioning Root Authority or Cisco Small Business Provisioning Root Authority 1 |
| SPA1xx Firmware Release 1.3.3 and later SPA232D Firmware Release 1.3.3 and later SPA5xx Firmware Release 7.5.6 and later |
On May 31, 2025, if the server certificate is issued from Cisco Small Business Provisioning Root Authority 2 |
Revision History
| Version | Description | Section | Date |
| 1.0 | Initial Release | — | 2024-JAN-11 |
For More Information
For further assistance or for more information about this field notice, contact the Cisco Technical Assistance Center (TAC) using one of the following methods:
Receive Email Notification About New Field Notices
To receive email updates about Field Notices (reliability and safety issues), Security Advisories (network security issues), and end-of-life announcements for specific Cisco products, set up a profile in My Notifications
Feedback