For this release, the certificate management changes are as follows:

• The validity period for self-signed certificates has been updated, allowing you to select either one year or two years for newly generated certificates, in addition to the existing options. The default validity period remains unchanged. For more information, see the ‘Self-Signed Certificate Fields’ section in the “Certificates” chapter of the Security Guide for Cisco Unified Communications Manager.

• For all self-signed certificates, the CA flag has been changed from CA:TRUE to CA:FALSE except for CAPF certificates. For more information, see the ‘Generate Self-Signed Certificate’ section in the “Certificates” chapter of the Security Guide for Cisco Unified Communications Manager.

• You can configure up to five distribution point URI settings to support multiple CRL file downloads (1 per Certificate Authority). You can perform full-chain validation instead of leaf certificate validation by default. This option is available on both publisher and subscriber nodes. For more information, see the ‘Certificate Revocation Configuration’ section in the “Certificates” chapter of the Security Guide for Cisco Unified Communications Manager.

From Release 15SU3 onwards:

• The Unified Communications Manager and IM and Presence Service that is available is FIPS 140-3 compliant.

• CiscoSSL has been upgraded to Cisco SSL 7.3, which is FIPS 140-3 compliant.

From Release 15SU3 onwards, DH groups 17 and 18 are no longer available on the IPSec Policy Configuration page. If your source cluster uses policies based on DH groups 17 or 18, reconfigure the policies to exclude these groups before proceeding with the upgrade. This applies to both FIPS and Non-FIPS mode.

For more information, see the ‘Upgrade Considerations with FIPS Mode’ and the ‘IPsec Requirements’ sections in the “Planning the Upgrade" chapter of the Upgrade and Migration Guide for Cisco Unified Communications Manager and the IM and Presence Service.

From this release onwards, Unified Communications Manager has added support for conference calls and call transfers (redirection) when the Single Number Reach (SNR) voicemail policy has been configured for User Control.

For more information, see the ‘CMC RD Feature Interaction’ section in the “Manage Phones" chapter of the Administration Guide for Cisco Unified Communications Manager.

Starting with this release, Unified CM supports precedence call originating related MLPP notifications on specific SIP phone models when precedence call is placed using translation or route pattern. When you enable MLPP notifications on either the Cisco Desk Phone 9841, Cisco Desk Phone 9851, Cisco Desk Phone 9861, Cisco Desk Phone 9871, or Cisco Video Phone 8875 (including Non-Radio models), the phones receive notifications for precedence calls, before the call is connected. These notifications include precedence ringback tones and display alerts.

For more information, see the ‘Multilevel Precedence and Preemption Restrictions’ section in the “Configure Multilevel Precedence and Preemption” chapter of the Feature Configuration Guide for Cisco Unified Communications Manager.

From this release onwards, Unified Communications Manager will support 130 lines on KEM modules for the Cisco Desk Phone 9861 and Cisco Desk Phone 9871 models.

From this release onwards, the Cisco Session Manager Edition (SME) introduces a feature designed to enhance the upgrade process by allowing administrators to manage the Busy Out state of the SME cluster. Using a new CLI command, administrators can enable or disable this functionality.

When activated, the SME cluster responds to SIP OPTIONS ping requests with a 503 Service Unavailable message. This signals Unified Communications Manager Leaf clusters to stop routing new calls to the affected SME cluster. Importantly, ongoing calls on the SME cluster remain unaffected. During this period, new calls from Unified Communications Manager Leaf clusters are automatically redirected to alternative SME clusters.

This feature ensures a seamless upgrade experience by maintaining service continuity and preventing call disruptions. Once the upgrade is complete, the Busy Out state can be deactivated, restoring normal call routing operations.

For more information, see the "Set Commands" chapter in the Command Line Interface Reference Guide for Cisco Unified Communications Solutions.

From this release onwards, Unified CM provides a dual stack (IPv4 and IPv6) for a hardware conference bridge provided the following conditions are fulfilled:

• The Unified Communications Manager should be dual-stack (IPv4 and IPv6).

• An IOS Gateway that has dual stack support (IPv4 and IPv6) should be used for registering hardware conference bridge to Unified Communications Manager.

For more information, see the ‘Conference Bridge Types’ section in the “Configure Conference Bridges” chapter of the System Configuration Guide for Cisco Unified Communications Manager.

For SSH interface, you can configure SSH host key algorithm using the Cipher Management page. For more information, see the ‘Recommended Ciphers’ section in the “Cipher Management” chapter of the Security Guide for Cisco Unified Communications Manager.

The minimum TLS version configuration is now enabled for the calendaring service in the IM and Presence Service.

In this release, the IM and Presence Service adds support for TLS 1.3 connections with the MSSQL database.

Cisco Unified Communications Manager (Unified Communications Manager) requirements for the Cisco Desk Phone 9800 Series include:

• Unified Communications Manager 12.5(1)SU9, 14SU4 and later.

• Installation of the following Cisco Options Package (COP) files on Unified Communications Manager: Phone firmware—Firmware for the Cisco Desk Phone 9800 Series phones is not bundled with Unified Communications Manager. A firmware update may be required to enable the new features. The phone firmware COP files can be downloaded from Cisco.com.

For information on the list of supported features for the Cisco Desk Phone 9800 Series, see the Release Notes for Cisco Desk Phone 9800 Series.

Location Bandwidth Manager (LBM) running on Unified Communication Manager version 15 cannot communicate with Unified CM versions with a newer version of Release 15 (for example, Release 15 SU1 or later). Hence, we recommend that you do the following if you are using LBM across multiple clusters:

• Ensure that you install the ciscocm.V15FCS_CSCwi82830-lbm_C0211-1.cop.sha512 COP file on Unified Communications Manager Release 15 to interoperate with LBM running on Unified Communication Manager versions 15SU1 or later.

Cisco Unified Communications Manager does not support Call Control Discovery via Service Advertisement Framework. Therefore, we recommend that you migrate to Global Dial Plan Replication using the Intercluster Lookup Service (ILS). For more information, see the following:

• Deprecation of Call Control Discovery via Service Advertisement Framework in Cisco Unified Communications Manager

• System Configuration Guide for Cisco Unified Communications Manager

Unified Communications Manager Release 15 does not support Remote Call Control with Microsoft Lync Server for IM and Presence Service. If you are using this feature currently in your deployment and you are trying to upgrade to Release 15, you cannot use this feature after the upgrade.

Note	This feature continues to be supported in Releases 12.5.x and 14 and SUs until their EOL/EOS.

For more information, see Deprecation of Remote Call Control with Microsoft Lync Server for IM and Presence Service on Cisco Unified Communications Manager, Release 15.

Starting with Release 15 onwards, phone firmware that is end of support will no longer be included in the Unified Communications Manager ISO. These endpoints will still be allowed to register, unless they have been officially deprecated, but the firmware will not be present in the TFTP directory following a fresh install. For more details, see the ReadMe for Cisco Unified Communications Manager.

Although the Cipher Management configuration page allows you to configure any number of ciphers, if you are using one of the following cipher that relies on RSA for key exchange, ensure that you add at least one more strong cipher to maintain compatibility before upgrading from pre-15SU3 releases:

• AES128-GCM-SHA256

• AES256-SHA256

• AES128-SHA256

• AES256-SHA

• AES128-SHA