Field Notice: FN - 72306 - Unified Contact Center Enterprise (UCCE)/Packaged Contact Center Enterprise (PCCE) and Unified Customer Voice Portal (CVP): QuoVadis Root CA 2 Decommission Might Affect Smart Licensing - Workaround Provided

Notice

THIS FIELD NOTICE IS PROVIDED ON AN "AS IS" BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTY OF MERCHANTABILITY. YOUR USE OF THE INFORMATION ON THE FIELD NOTICE OR MATERIALS LINKED FROM THE FIELD NOTICE IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS FIELD NOTICE AT ANY TIME.

Revision History

Revision	Publish Date	Comments
1.1	29-Mar-22	Updated the Products Affected, Defect Information, Problem Description, Background, Problem Symptom, and Workaround/Solution Sections and Added the Additional Information Section
1.0	22-Feb-22	Initial Release

Products Affected

Affected OS Type	Affected Software Product	Affected Release	Affected Release Number	Comments
NON-IOS	Cisco Customer Voice Portal Software Releases	CVP Ver 12	12.5(1), 12.6(1)	CVP
NON-IOS	Cisco Unified Intelligent Contact Management Software Releases	ICM Ver 12	12.5(1), 12.6(1)	UCCE/PCCE

Defect Information

Defect ID	Headline
CSCwb04917	ICM: Smart License - Registration & Authorization fails with "Communication send error"
CSCwb04933	CVP: Smart License - Registration & Authorization fails with "Communication send error"

Problem Description

For affected versions of the Cisco Unified Contact Center Enterprise (UCCE)/Packaged Contact Center Enterprise (PCCE) and Unified Customer Voice Portal (CVP) software, some Secure Sockets Layer (SSL) certificates issued from the QuoVadis root certificate authority (CA) trust chain before March 31, 2021 cannot be renewed from this CA. Once those certificates expire on devices or are removed from the Cisco cloud servers, functions such as Smart Licensing will fail to establish secure connections to Cisco and might not operate properly.

Background

The QuoVadis Root CA 2 Public Key Infrastructure (PKI) used by UCCE/PCCE and Unified CVP software to issue SSL certificates is subject to an industry-wide issue that affects revocation abilities. Due to this issue, no new QuoVadis Root CA 2 certificates will be issued or renewed by Cisco after March 31, 2021. This affects certificate renewals on devices, Cisco cloud servers, and third-party services.

Certificates issued before the QuoVadis Root CA 2 was decommissioned will continue to be valid. However, the certificates will not renew when they expire on either the device or the Cisco cloud server. This will cause functions such as Smart Licensing to fail to establish secure connections to Cisco cloud servers.

This table shows a summary of the QuoVadis Root CA 2 certificate expiration dates for affected Cisco services.

Cisco Cloud Server	QuoVadis Certificate Expiration Date	Affected Services
tools.cisco.com	February 5, 2022	Smart Licensing
smartreceiver.cisco.com	January 26, 2023	Smart Licensing

Problem Symptom

Expiration of the QuoVadis Root CA 2 certificates affects these services with the associated symptoms.

Affected Services	Symptoms for Affected Services
Smart Licensing	Failure to connect to the server (Details are provided in this section)

 

For UCCE/PCCE and Unified CVP devices, affected devices will be unable to connect to the Smart Licensing services hosted by Cisco. Smart licenses might fail entitlement and reflect an Out of Compliance status.

The features that use Smart Licensing will continue to function for one year after the last successful secure connection. Some Smart Licensing symptoms are:

• The device might indicate a failure to communicate with the Smart Licensing server within 30 days from the last successful connection.
• The device will show the "Authorization Expired" state if there is no communication with the Smart Licensing server within 90 days.
• The device will show the "Unregistered" state if there is no communication with the Smart Licensing server after one year and the licensed features usage become suspended.

Note: Offline licensing, such as Permanent License Reservation (PLR) and Specific License Reservation (SLR), is not affected by the certificate change on the Smart Licensing server.

For additional information, refer to the Cisco Smart Licensing Guide and the Administration/Installation and Upgrade Guide for UCCE/PCCE and Unified CVP:

• Administration Guide for Cisco Unified Contact Center Enterprise, Release 12.6(1)
• Administration Guide for Cisco Unified Contact Center Enterprise, Release 12.5(1)
• Installation and Upgrade Guide for Cisco Unified Customer Voice Portal, Release 12.6(1)
• Installation and Upgrade Guide for Cisco Unified Customer Voice Portal, Release 12.5(1)

For devices managed by UCCE/PCCE and Unified CVP, navigate to smart licensing status in order to view the licensing status:

• UCCE/PCCE - Log in to CCEAdmin and choose Infrastructure Settings > License Management > Smart Licensing Status > License Authorization Status.
• Unified CVP - Log in to CVP NOAMP and choose License Management > Smart Licensing Status > License Authorization Status.

UCCE/PCCE and Unified CVP will be authorized with this error message:

The last attempt to renew license authorization failed......

The error message is shown in this image:

Workaround/Solution

Cisco has migrated from the QuoVadis Root CA 2 to the IdenTrust Commercial Root CA 1 for SSL certificates. Cisco recommends to add the new IdenTrust Commercial Root CA 1 certificate to UCCE/PCCE and Unified CVP.

Software Downloads

• UCCE/PCCE/Unified CVP 12.6.x
• UCCE/PCCE/Unified CVP 12.5.x, choose "QuoVadis to IdenTrust migration for Smart Agent" can get from QuoVadis_IdenTrust_Migration

ICM Logger A Server

In order to add the new IdenTrust Commercial Root CA 1 certificate, complete these steps:

1. Make a backup of the folder <icm_install_drive>:\icm\.sl_truststore\.
2. Stop the Cisco Tomcat service.
3. Remove the "call_home_ca" file present in the path "<icm_install_drive>:\icm\.sl_truststore\".
4. Copy the downloaded "call_home_ca" file and place it in the path "<icm_install_drive>:\icm\.sl_truststore\".
5. Start the Cisco Tomcat service and wait for five minutes.
6. Re-attempt to "Renew Authorization" for Smart Licensing.

Unified CVP Call Server

In order to add the new IdenTrust Commercial Root CA 1 certificate, complete these steps:

1. Make a backup of the folder <cvp_install_drive>:\Cisco\CVP\conf\.sltruststore\.
2. Stop the Unified CVP WebServicesManager (WSM) service.
3. Remove the "call_home_ca" file present in the path "<cvp_install_drive>:\Cisco\CVP\conf\.sltruststore\".
4. Copy the downloaded "call_home_ca" file and place it in the path "<cvp_install_drive>:\Cisco\CVP\conf\.sltruststore\".
5. Start the Unified CVP WSM service and wait for five minutes.
6. Re-attempt to "Renew Authorization" for Smart Licensing.

Additional Information

Cisco has created a web page to provide customers and partners with additional information on this issue. Consult the QuoVadis Root CA 2 Decommission page for a full list of products affected, associated Field Notices, and frequently asked questions.

For More Information

If you require further assistance, or if you have any further questions regarding this field notice, please contact the Cisco Systems Technical Assistance Center (TAC) by one of the following methods:

• Open a service request on Cisco.com
• By email or telephone

Receive Email Notification For New Field Notices

My Notifications—Set up a profile to receive email updates about reliability, safety, network security, and end-of-sale issues for the Cisco products you specify.