Cisco TelePresence Administrator's Manual page 287

Maintenance
The certificate request includes automatically the public key that will be used in the certificate, and the
l
client and server authentication Enhanced Key Usage (EKU) extension.
4. Click Generate CSR. The system will produce a signing request and an associated private key.
Note that the private key is stored securely on the VCS and cannot be viewed or downloaded. You must
never disclose your private key, not even to the certificate authority.
5. You are returned to the
Download the request to your local file system so that it can be sent to a certificate authority. You are
l
prompted to save the file (the exact wording depends on your browser).
View the current request (click Show (decoded) to view it in a human-readable form, or click Show
l
(PEM file) to view the file in its raw format).
Note that only one signing request can be in progress at any one time. This is because the VCS has to keep
track of the private key file associated with the current request. To discard the current request and start a
new request, click Discard CSR.
When the signed server certificate is received back from the certificate authority it must be uploaded to the
VCS as described below.
Uploading a new server certificate
The Upload new certificate
certificate.
To upload a server certificate:
1. Go to Maintenance > Security certificates > Server
2. Use the Browse button to select and upload the server certificate PEM file.
3. If you used an external system to generate the certificate request you must also upload the server private
key PEM file that was used to encrypt the server certificate. (The private key file will have been
automatically generated and stored earlier if the VCS was used to produce the signing request for this
server certificate.)
The server private key must not be password protected.
l
You cannot upload a server private key if a certificate signing request is in progress.
l
4. Click Upload server certificate data.
Server certificates and clustered systems
When a CSR is generated, a single request and private key combination is generated for that peer only.
If you have a cluster of VCSs, you must generate a separate signing request on each peer. Those requests
must then be sent to the certificate authority and the returned server certificates uploaded to each relevant
peer.
You must ensure that the correct server certificate is uploaded to the appropriate peer, otherwise the stored
private key on each peer will not correspond to the uploaded certificate.
Server certificates and Unified Communications
VCS Control server certificate requirements
The VCS Control server certificate needs to include the following elements in its list of subject alternate
names:
Cisco VCS Administrator Guide (X8.1.1)
Server certificate page. From here you can:
section is used to replace the VCS's current server certificate with a new
certificate.
About security certificates
Page 287 of 507