Using SSL to Secure Client/Server Connections in Cisco Unity Connection

This chapter contains information on creating a certificate signing request, issuing an SSL certificate (or having it issued by an external certification authority), and installing the certificate on the Cisco Unity Connection server to secure Cisco Personal Communications Assistant (Cisco PCA) and IMAP email client access to Cisco Unity Connection.

The Cisco PCA website provides access to the web tools that users use to manage messages and personal preferences with Unity Connection. Note that IMAP client access to Unity Connection voice messages is a licensed feature.

See the following sections:

Related Documentation

This chapter contains several instances where a user needs to create, generate, download and upload the Certificate Signing Request (CSR) using Multi-Server certificates or Single-Server Certificate. For more information see the chapter ‘Security’ of Cisco Unified Communications Operating System Administration Guide for Cisco Unity Connection Release 10.x at http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/connection/10x/os_administration/guide/10xcucosagx/10xcucosag060.html

Deciding Whether to Install an SSL Certificate to Secure Cisco PCA, Cisco Unity Connection SRSV, and IMAP Email Client Access to Cisco Unity Connection

When you install Cisco Unity Connection, a local self-signed certificate is automatically created and installed to secure communication between the Cisco PCA and Unity Connection, communication between IMAP email clients and Unity Connection, and communication between Unity Connection SRSV and the central Unity Connection server. This means that all the network traffic (including usernames, passwords, other text data, and voice messages) between the Cisco PCA and Unity Connection is automatically encrypted, the network traffic between IMAP email clients and Unity Connection is automatically encrypted if you enable encryption in the IMAP clients, and the network traffic between Unity Connection SRSV and the central Unity Connection server is automatically encrypted. However, if you want to reduce the risk of man-in-the-middle attacks, do the procedures in this chapter.

If you decide to install an SSL certificate, we recommend that you also consider adding the trust certificate of the certification authority to the Trusted Root Store on user workstations. Without the addition, the web browser displays security alerts for users who access the Cisco PCA and for users who access Unity Connection voice messages with some IMAP email clients.

For information on managing security alerts, see the “Managing Security Alerts When Using Self-Signed Certificates with SSL Connections in Cisco Unity Connection” section in “Setting Up Access to the Cisco Personal Communications Assistant” chapter of the User Workstation Setup Guide for Cisco Unity Connection Release 10.x at http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/connection/10x/user_setup/guide/10xcucuwsx/10xcucuws010.html

For more information on self-signed certificate, refer to the “Securing Connections in Cisco Unity Connection Survivable Remote Site Voicemail 10.x” chapter of the Complete Reference Guide for Cisco Unity Connection Survivable Remote Site Voicemail (SRSV) guide at http://www.cisco.com/en/US/docs/voice_ip_comm/connection/10x/srsv/guide/10xcucsrsvx.html.

Securing Connection Administration, Cisco PCA, Cisco Unity Connection SRSV, and IMAP Email Client Access to Cisco Unity Connection

Revised April 30, 2014

Do the following tasks to create and install an SSL server certificate to secure Cisco Unity Connection Administration, Cisco Personal Communications Assistant, Unity Connection SRSV, and IMAP email client access to Cisco Unity Connection:

1.blank.gif If you are using Microsoft Certificate Services to issue certificates, install Microsoft Certificate Services.

2.blank.gif If you are using another application to issue certificates, install the application. See the manufacturer documentation for installation instructions. Then skip to Task 3.

If you are using an external certification authority to issue certificates, skip to Task 3.

note.gif

Noteblank.gif If you already have installed Microsoft Certificate Services or another application that can create certificate signing requests, skip to Task 3.


3.blank.gif If a Unity Connection cluster is configured, run the set web-security CLI command or generate a Multi-server SAN certificate (only for SIP integration) for both Unity Connection servers in the cluster and assign both servers the same alternate name. The alternate name will automatically be included in the certificate signing request and in the certificate. For information on the set web-security CLI command, see the applicable Command Line Interface Reference Guide for Cisco Unified Communications Solutions at http://www.cisco.com/en/US/products/ps6509/prod_maintenance_guides_list.html.

4.blank.gif If a Unity Connection cluster is configured, configure a DNS A record that contains the alternate name that you assigned in Task 3. List the publisher server first. This allows all IMAP email applications, Cisco Personal Communications Assistant, and Unity Connection SRSV to access Unity Connection voice messages by using the same Unity Connection server name.

5.blank.gif Create a certificate signing request. Then download the certificate signing request to the server on which you installed Microsoft Certificate Services or another application that issues certificates, or download the request to a server that you can use to send the certificate signing request to an external CA see Chapter 9, “Related Documentation” section.

If a Unity Connection cluster is configured with Single-server certificate signing request, do this task for both servers in the Unity Connection cluster.

6.blank.gif If you are using Microsoft Certificate Services to export the root certificate and to issue the server certificate, see Chapter 9, “Related Documentation” section.

If you are using another application to issue the certificate, see the documentation for the application for information on issuing certificates.

If you are using an external CA to issue the certificate, send the certificate signing request to the external CA. When the external CA returns the certificate, continue with Task 7.

Only PEM-formatted (also known as Base-64 encoded DER) certificates can be uploaded to Unity Connection. The certificate must have a.pem filename extension. If the certificate is not in this format, you can usually convert what you have to PEM format by using freely available utilities like OpenSSL.

If a Unity Connection cluster is configured with Single-server certificate signing request, do this task for both servers in the Unity Connection cluster

7.blank.gif Upload the root certificate and the server certificate to the Unity Connection server, see Chapter 9, “Related Documentation” section.

If a Unity Connection cluster is configured with Single-server certificate signing request, do this task for both servers in the Unity Connection cluster.

8.blank.gif Restart the Unity Connection IMAP Server service so that Unity Connection and the IMAP email clients use the new SSL certificates. Do the To Restart the Unity Connection IMAP Server Service.

If a Unity Connection cluster is configured, do this task for both servers in the Unity Connection cluster.

9.blank.gif Restart the Connection Jetty service so that Connection Jetty and comet notification client use the new SSL certificates. Do the To Restart the Connection Jetty Service.

If a Unity Connection cluster is configured, do this task for both servers in the Unity Connection cluster.

note.gif

Noteblank.gif You need to restart the Connection Jetty service, if comet notification over SSL mode is enabled.


10.blank.gif To prevent users from seeing a security alert whenever they access Unity Connection by using the Connection Administration, Cisco PCA, or an IMAP email client, do the following tasks on all computers from which users will access Unity Connection:

blank.gif Import the server certificate that you uploaded to the Unity Connection server in Task 7. into the certificate store. The procedure differs based on the browser or IMAP email client. For more information, see the documentation for the browser or IMAP email client.

blank.gif Import the server certificate that you uploaded to the Unity Connection server in Task 7. into the Java store. The procedure differs based on the operating system running on the client computer. For more information, see the operating system documentation and the Java Runtime Environment documentation.

 

a.blank.gif

 


 

To Restart the Unity Connection IMAP Server Service


Step 1blank.gif Sign in to Cisco Unity Connection Serviceability.

Step 2blank.gif On the Tools menu, select Service Management.

Step 3blank.gif In the Optional Services section, for the Unity Connection IMAP Server service, select Stop.

Step 4blank.gif When the Status area displays a message that the Unity Connection IMAP Server service was successfully stopped, select Start for the service.

To Restart the Connection Jetty Service


Step 1blank.gif Sign in to Cisco Unity Connection Serviceability.

Step 2blank.gif On the Tools menu, select Service Management.

Step 3blank.gif In the Optional Services section, for the Connection Jetty service, select Stop.

Step 4blank.gif When the Status area displays a message that the Connection Jetty service was successfully stopped, select Start for the service.


 

Securing Access to Cisco Unified MeetingPlace

To secure access to MeetingPlace, do the following tasks.

1.blank.gif Configure SSL for MeetingPlace. For more information, see the “Configuring SSL for the Cisco Unified MeetingPlace Application Server” chapter of the Administration Documentation for Cisco Unified MeetingPlace Release 8.0 at http://www.cisco.com/en/US/products/sw/ps5664/ps5669/prod_maintenance_guides_list.html.

2.blank.gif Integrate Unity Connection with MeetingPlace. When you configure Unity Connection for the MeetingPlace calendar integration, specify SSL for the security transport.

3.blank.gif On the Unity Connection server, upload the root certificate of the certification authority from which you got the server certificate that you installed on the MeetingPlace server in Task 1. Note the following:

blank.gif The root certificate is not the same thing as the certificate that was installed on the MeetingPlace server. The root certificate for the certification authority contains a public key that can be used to verify the authenticity of the certificate uploaded to the MeetingPlace server.

blank.gif Only PEM-formatted (also known as Base-64 encoded DER) certificates can be uploaded to Unity Connection. The certificate must have a.pem filename extension. If the certificate is not in this format, you can usually convert what you have to PEM format by using freely available utilities like OpenSSL.

blank.gif The root certificate filename must not contain any spaces.

Step 5blank.gif


 

Securing Communication Between Unity Connection and Cisco Unity Gateway Servers When Unity Connection Networking Is Configured

Do the following tasks to create and install an SSL server certificate to secure Connection Administration, Cisco Personal Communications Assistant, and IMAP email client access to Cisco Unity Connection:

If you are using Microsoft Certificate Services to issue certificates, install Microsoft Certificate Services.For information on installing Microsoft Certificate Services on a server running a later version of Windows Server, refer to Microsoft documentation.If you are using another application to issue certificates, install the application. See the manufacturer documentation for installation instructions. Then skip to Task 4.

If you are using an external certification authority to issue certificates, skip to Task 4.

note.gif

Noteblank.gif If you already have installed Microsoft Certificate Services or another application that can create certificate signing requests, skip to Task 4.


4.blank.gif If a Unity Connection cluster is configured for the Unity Connection gateway server, run the set web-security CLI command on both Unity Connection servers in the cluster and assign both servers the same alternate name. The alternate name will automatically be included in the certificate signing request and in the certificate. For information on the set web-security CLI command, see the applicable Command Line Interface Reference Guide for Cisco Unified Communications Solutions at http://www.cisco.com/en/US/products/ps6509/prod_maintenance_guides_list.html.

5.blank.gif If a Unity Connection cluster is configured for the Unity Connection gateway server, configure a DNS A record that contains the alternate name that you assigned in Task 4. List the publisher server first. This allows Cisco Unity to access Unity Connection voice messages by using the same Unity Connection server name.

6.blank.gif On the Unity Connection gateway server, create a certificate signing request. Then download the certificate signing request to the server on which you installed Microsoft Certificate Services or another application that issues certificates, or download the request to a server that you can use to send the certificate signing request to an external CA. see Chapter 9, “Related Documentation” section.

note.gif

Noteblank.gif If a Unity Connection cluster is configured, do this task for both servers in the Unity Connection cluster.


7.blank.gif On the Cisco Unity gateway server, create a certificate signing request. Then download the certificate signing request to the server on which you installed Microsoft Certificate Services or another application that issues certificates, or download the request to a server that you can use to send the certificate signing request to an external CA, see Chapter 9, “Related Documentation” section.

note.gif

Noteblank.gif If Cisco Unity failover is configured, do this task for the primary and secondary servers.


8.blank.gif If you are using Microsoft Certificate Services to export the root certificates and to issue the server certificates, do the procedure in the “Exporting the Root Certificate and Issuing the Server Certificate (Microsoft Certificate Services Only)” section.

If you are using another application to issue the certificate, see the documentation for the application for information on issuing certificates.

If you are using an external CA to issue certificates, send the certificate signing request to the external CA. When the external CA returns the certificates, continue with Task 9.

Only PEM-formatted (also known as Base-64 encoded DER) certificates can be uploaded to Unity Connection. The certificate must have a pem filename extension. If the certificate is not in this format, you can usually convert what you have to PEM format by using freely available utilities like OpenSSL.

Do this task for the Unity Connection server (both servers if a Unity Connection cluster is configured) and for the Cisco Unity server (both servers if failover is configured).

9.blank.gif Upload the root certificate and the server certificate to the Unity Connection server, see Chapter 9, “Related Documentation” section.

note.gif

Noteblank.gif If a Unity Connection cluster is configured, do this task for both servers in the Unity Connection cluster.


10.blank.gif Restart the Unity Connection IMAP Server service so that Unity Connection and the IMAP email clients use the new SSL certificates. Do the To Restart the Unity Connection IMAP Server Service.

If a Unity Connection cluster is configured, do this task for both servers in the Unity Connection cluster.

11.blank.gif Upload the root certificate and the server certificate to the Cisco Unity server, see Chapter 9, “Related Documentation” section.

note.gif

Noteblank.gif If failover is configured, do this task for the primary and secondary servers.



 

To Create and Download a Certificate Signing Request on a Cisco Unity Gateway Server


Step 1blank.gif On the Windows Start menu, select Programs > Administrative Tools > Internet Information Services (IIS) Manager.

Step 2blank.gif Expand the name of the Cisco Unity server.

Step 3blank.gif Expand Web Sites.

Step 4blank.gif Right-click Default Web Site, and select Properties.

Step 5blank.gif In the Default Web Site Properties dialog box, select the Directory Security tab.

Step 6blank.gif Under Secure Communications, select Server Certificate.

Step 7blank.gif In the Web Server Certificate Wizard:

a.blank.gif Select Next.

b.blank.gif Select Create a New Certificate, and select Next.

c.blank.gif Select Prepare the Request Now, But Send It Later, and select Next.

d.blank.gif Enter a name and a bit length for the certificate.

We strongly recommend that you select a bit length of 512. Greater bit lengths may decrease performance.

e.blank.gif Select Next.

f.blank.gif Enter the organization information, and select Next.

g.blank.gif For the common name of the site, enter either the system name of the Cisco Unity server or the fully qualified domain name.

caut.gif

Caution The name must exactly match the name that the Unity Connection site gateway server uses to construct a URL to access the Cisco Unity server. This name is the value of the Hostname field in Connection Administration on the Networking > Links > Intersite Links page.

h.blank.gif Select Next.

i.blank.gif Enter the geographical information, and select Next.

j.blank.gif Specify the certificate request filename and location, and write down the filename and location because you will need the information in the next procedure.

k.blank.gif Save the file to a disk or to a directory that the certificate authority (CA) server can access.

l.blank.gif Select Next.

m.blank.gif Verify the request file information, and select Next.

n.blank.gif Select Finish to exit the Web Server Certificate wizard.

Step 8blank.gif Select OK to close the Default Web Site Properties dialog box.

Step 9blank.gif Close the Internet Information Services Manager window.


 

To Restart the Unity Connection IMAP Server Service


Step 1blank.gif Sign in to Cisco Unity Connection Serviceability.

Step 2blank.gif On the Tools menu, select Service Management.

Step 3blank.gif In the Optional Services section, for the Unity Connection IMAP Server service, select Stop.

Step 4blank.gif When the Status area displays a message that the Unity Connection IMAP Server service was successfully stopped, select Start for the service.


 

To Upload the Root and Server Certificates to the Cisco Unity Server


Step 1blank.gif On the Cisco Unity server, install the Certificates MMC for the computer account.

Step 2blank.gif Upload the certificates. For more information, refer to Microsoft documentation.


 

Installing Microsoft Certificate Services (Windows Server 2008)

If you want to use a third-party certificate authority to issue SSL certificates, or if Microsoft Certificate Services is already installed, skip this section.

Do the procedure in this section if you want to use Microsoft Certificate Services to issue your own certificate and if you want to install the application on a server running Windows Server 2008.

To Install Microsoft Certificate Authority (MCA)


Step 1blank.gif Open Server Manager, click Add Roles, click Next, and click Active Directory Certificate Services. Click Next two times.

Step 2blank.gif On the Select Role Services page, click Certification Authority. Click Next.

Step 3blank.gif On the Specify Setup Type page, click Standalone or Enterprise. Click Next.

note.gif

Noteblank.gif You must have a network connection to a domain controller in order to install an enterprise CA.


Step 4blank.gif On the Specify CA Type page, click Root CA. Click Next.

Step 5blank.gif On the Set Up Private Key page, click Create a new private key. Click Next.

Step 6blank.gif On the Configure Cryptography page, select a cryptographic service provider, key length, and hash algorithm. Click Next.

Step 7blank.gif On the Configure CA Name page, create a unique name to identify the CA. Click Next.

Step 8blank.gif On the Set Validity Period page, specify the number of years or months that the root CA certificate will be valid. Click Next.

Step 9blank.gif On the Configure Certificate Database page, accept the default locations unless you want to specify a custom location for the certificate database and certificate database log. Click Next.

Step 10blank.gif On the Confirm Installation Options page, review all of the configuration settings that you have selected. If you want to accept all of these options, click Install and wait until the setup process has finished.

Step 11blank.gif Right click the Active Directory Certificate Authority. Select Add Role Services and select the check box for Certificate Authority Web Enrollment, Online Responder, Network Device Enrollment Service and install these services.

Step 12blank.gif Go to Server Manager -> Add Role -> Next-> check the Web Server (IIS) box and install it.

Step 13blank.gif Right click the Web Server (IIS). Select Add Role Services and check all the role services and install them.


 

Exporting the Root Certificate and Issuing the Server Certificate (Microsoft Certificate Services Only)

Do the following procedure only when you are using Microsoft Certificate Services to issue the certificate.

To Export the Root Certificate and to Issue the Server Certificate


Step 1blank.gif On the server on which you installed Microsoft Certificate Services, sign in to Windows by using an account that is a member of the Domain Admins group.

Step 2blank.gif On the Windows Start menu, select Programs > Administrative Tools > Certification Authority.

Step 3blank.gif In the left pane, expand Certification Authority (Local) > <Certification authority name>, where <Certification authority name> is the name that you gave to the certification authority when you installed Microsoft Certificate Services in the To Install Microsoft Certificate Authority (MCA).

Step 4blank.gif Export the root certificate:

a.blank.gif Right-click the name of the certification authority, and select Properties.

b.blank.gif On the General tab, select View Certificate.

c.blank.gif Select the Details tab.

d.blank.gif Select Copy to File.

e.blank.gif On the Welcome to the Certificate Export Wizard page, select Next.

f.blank.gif On the Export File Format page, select Next to accept the default value of DER Encoded Binary X.509 (.CER).

g.blank.gif On the File to Export page, enter a path and filename for the.cer file. Select a network location that you can access from the Unity Connection server.

Write down the path and filename. You will need it in a later procedure.

h.blank.gif Follow the onscreen prompts until the wizard has finished the export.

i.blank.gif Select OK to close the Certificate dialog box, and select OK again to close the Properties dialog box.

Step 5blank.gif Issue the server certificate:

a.blank.gif Right-click the name of the certification authority, and select All Tasks > Submit New Request.

b.blank.gif Browse to the location of the certificate signing request file that you created in the and double-click the file.

c.blank.gif In the left pane of Certification Authority, select Pending Requests.

d.blank.gif Right-click the pending request that you submitted in b., and select All Tasks > Issue.

e.blank.gif In the left pane of Certification Authority, select Issued Certificates.

f.blank.gif Right-click the new certificate, and select All Tasks > Export Binary Data.

g.blank.gif In the Export Binary Data dialog box, in the Columns that Contain Binary Data list, select Binary Certificate.

h.blank.gif Select Save Binary Data to a File.

i.blank.gif Select OK.

j.blank.gif In the Save Binary Data dialog box, enter a path and filename. Select a network location that you can access from the Cisco Unity Connection server.

Write down the path and filename. You will need it in a later procedure.

k.blank.gif Select OK.

Step 6blank.gif Close Certification Authority.