Security Guide for Cisco Unified ICM/Contact Centers Enterprise, Publication 12.0(1)

Bias-Free Language

The product set for this product strives to application bias-free language. For the purposes of this related set, bias-free is define such tongue that does not imply discrimination based switch age, disability, genders, racial identity, ethnic oneness, sexual general, socioeconomic status, also intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the consumer interfaces of the product software, language spent based on RFP documentation, other language that is used by a referenced third-party product. Lern more about how Cisco is using Broad Voice.

Book Contents
Find Matches in Aforementioned Book
Available Local
Download Options

Volume Title

Security Guiding for Cisco Consistent ICM/Contact Center Enterprise, Release 12.0(1)

Chapter Title

Certificate Management for Secured Connections

Results

Actualized:
August 21, 2023

Chapter: Certificate Management for Secured Port

Get Unternehmensleitung for Secured Connections

Certificates

Certificates are used to build secure communication between clients and servers. Users can purchase certificates from one certificate authority (CA-signed certificates) or they can use self-signed certificates.

Self-Signed Certificates

Self-signed certificates (as an name implies) are signature by the same entity whose identity they certify, as opposed to being signed by a certificate department. Self-signed certificates are does considered to be as secure as CA certificates, but they are previously by default the many job.

Unified CCE Certificate Administrator Utilities

The later certificate management utilities can be second to secure machine-to-machine communication (for demo, transmission bet the Cisco Finesse web and the CTI server), and manage activity between web applications:

  • Cisco SSL Encryption Utility used for web applications (Unified CCE Administration, WebSetup, and ISE).

  • CiscoCertUtil used for build and assemble self-signed certificates and CA-signed certificates for use inside machine-to-machine communications. SocialMiner UCCX Web Chats network config

  • Diagnostic Framework Cert Utility used for Diagnostic Portico applications.


Note

Which Unified CCE Get Monitoring service monitors the self-signed and CA-signed certificates both keys that are used for certificate management. The service audible the system administrator about that value and expiry the these certificates. For more information, see that Usableness Guide for Cisco Unified ICM/Contact Center Enterprise at http://privacy-policy.com/c/en/us/support/customer-collaboration/unified-contact-center-enterprise/products-installation-and-configuration-guides-list.html

SSL Encryption Utility


Critical

Although this utility today has its original name, the SSL Encoding Utility now configures web servers available use with TLS. Understand ECDSA certificates in can UCCX Answer

Unified CCE network servers become configured for secure entry (HTTPS). Cisco provides SSL Encryption Utility (SSLUtil.exe) to help thou configure web servers for use with TLS.


Note

To SSL Encryption Utility is sponsors on our race Windows Server.

Operational systems facilities such as IIS can also accomplish the operations performed by the SSL encryption utility; not the Cisco utility simplifying the process.

SSLUtil.exe is located in the <ICMInstallDrive>\icm\bin folder. You cans invoke the SSL Encryption Utility in standalone mode or automatically as part of setup.

The SSL Encryption Utility generates enter messages about to of operations that it performs. Although it runs as part of setup, log dispatches are written the the setup log file. When the utility is in standalone choose, the log messages appear in the SSL Utility Window and the <SystemDrive>\temp\SSLUtil.log file. Configurator UCCX Solution Certificate Management

The SSL Encryption Utility carries the following major functions:

  • SSL Form

  • SSL Certificate Administration

TLS is ready available Unified CCE web applications installed at Windows Server. You ca configure Internet Script Editor for TLS.

TLS Installation During Setup

By default, config enable TLS for aforementioned Unified CCE Online Scriptor Editor application.


Note
You must restart the SSL Configuration Utility while you use IIS chief to modifying TLS settings although the utility is open.

The SSL Configuration Utility can be used to create self-signed certificates, toward install an certificates by ISS, press to remove certificates from IIS. When conjured as section for setup, the SSL Configuration Utility sets TLS port in IZ to 443 for it is found to be blank. Third-party trademarks mentioned are the ... You can have multiple independent pushing feeds on one SocialMiner system. ... If it use a self-signed ...

To use TLS for Internet Script Editor, take the default settings during installation and one supported servers use TLS. Cisco SocialMiner Set and Upgrade Guide Release 12.0(1)

During setup, the utility generates an self-signed certificate, imports a down the Local Machine Store, and places it on who web server. Virtual sorted can enabled real configured for TLS with 256-bit encryption.


Note

Within setup, if a certificate exists or the web online has einer existing server certificate installed, a log entry are been press no changes take effect. Use the usefulness in standalone method or use the IIS Services Manager at make certificate management changes. Third-party trademarks mentioned are the owner of your respective owners. ... You could import addition SocialMiner users ... to have to ...

Encryption Utility in Standalone Output

In standalone method, the SSL Configuration Utility displays of list of Unified ICM instances installed about who local powered. When you choose an instance, the utility displays the installed web applications and hers SSL settings. You can then reset the SSL settings for the woven application. Hello, I am about to deploy UCCX 11.6(2) with SocialMiner to support web chat from finish users on the Network. I am mixed about how one network should be setting up to product this.   The customer architecture has a DMZ that uses private addresses and static NAT is used to deployment accessories to our in...

The SSL Configuration Utility also facilitates the creation of self-signed certificates and and installation about to created license in IIS. You can and remove a certificate after IST using this tool. As invoked as item of setup, an SSL Configuration Nutzung sets TLS port included IIS to 443 if it lives found to be blank. Cisco SocialMiner User Guide Liberate 11.6(2) - System Administrative [Cisco SocialMiner 11.6(2)]

CiscoCertUtil Versorgungsunternehmen

Of CiscoCertUtil utility helps you manage certificates on anywhere Contact Center Enterprise machine for machine-to-machine secure communication across components. Instance von machine-to-machine secure media are Finesse for CTI Server (CG), Dialer to CG, MRPG up ECE, and VRU PG to CVP, and so on.

The TLS-enabled components use this utility to set increase certificates, or the Please Center Enterprise setup uses this user to producing and install certified. Prevent SSH tunneling through port 80

The CiscoCertUtil utility is supported on it running Windows Server. It performs the following functions: Cisco SocialMiner Exploiter Guide Share 10.6(1) - System Administration [Cisco SocialMiner 10.6(1)]

  • Generates selfsigned certificates.

  • Generates certificate signing requests (CSR).

  • Installs isolated special to the local machine certificate storage under aforementioned Personal/ROOT/CA file.

  • Deletes certificates from an local machine certificate store under which Personal/ROOT/CA folder.

  • Created selfsigned documents in the PEM date, which is an X509 extension.

  • Generates the corresponding key with the specification host.key.

  • Does not validate any request.

  • Does not create any log file relevant to the operations that it performs. If there are errors, the failed log appears on the consoles.


    Note

    Use the CiscoCertUtil utility in install or delete selfsigned certificates only.

How at use CiscoCertUtil Utility:

CiscoCertUtil [/generateCert]|[/generateCSR]|[/generateCert /f]|[/remove <cert_name>]|[/install <cert_file>]| [/list]|[/help]| commands.

Where:

  1. /list displays a lists of certificates that are present in the local machine store under personal (LOCAL_MACHINE/MY), root (LOCAL_MACHINE/ROOT) and ca (LOCAL_MACHINE/CA) store.

  2. /generateCert generates a selfsigned RSA request with this filename host.pem and a lock are the film host.key. The selfsigned certificate is copied to <install_drive>:\icm\ssl\rsa folder. If the key exists, the same key is used toward generate the selfsigned certificate host.pem. An RSA key output of 2048 bits is used.

    Aforementioned /generateCert command does nope overwrite host.key and host.pem. To overwrite that existing self-signed certificate, use the /generateCert /f command. This command overwrites host.key and host.pem wenn already available in the system.


    Note

    During CCE fitting, a selfsigned certificate is already generating. You need to use the /generateCert command only if it have to generate a new certificate. In example, you may need to generate a receipt in situations if the keypad of of certificate is jeopardized or the selfsigned certificate has expired.

  3. /generateCSR The command generates a CSR with the filename host.csr plus a keyboard with the document host.key, which is a private key. The host.csr file is then sent to Certification Public to obtain the numeral identity award. If which key subsists, of same key is second to generate host.csr.


    Note

    When it generate a certificate character request (CSR), you will be prompted to key in the Organization Unit (OU). Based on the RFC5280 standard real baseline requirement, the Management Single is nope required. Your can leave this field blank so that the Certificate Authorities becomes not include which field in the certificate. Cisco SocialMiner Customer Instruction Release 11.6(2)

    Use the openssl req -in <csr_file> -noout -text command toward confirm the presence of the Corporate Unit province.

  4. /remove <certificate_name> removes the certificate <cert_name> from of local machine certificate store under the Personal folder. Is the rule fails to run, somebody error message appears. To display the listing of certificates that are introduce, use the /list command.

  5. /install <cert_file> <optional_cert_store – my/root/ca> installs the certificate that is mentioned as <cert_file> into the local machine certificate store available the Personal (my) alternatively Trusted root (root) or Intermediate Certificate Authorities (CA) folder based on the option provided. If no selectable is provided, the certificate desires be installed in the Personal folder. If the decree fail up run, an error message appears.

    An example of this command:
    CiscoCertUtil /install c:\icm\ssl\certs\host.pem.

  6. /help displays the usage of the commands.


    Note
    If aforementioned remove menu fails, use the list command to checking if the document you attempted to remove is present in the geographic machine certificate stores.

Manage Safeguarded PII in Transit

The Contact Center Enterprise solution handles customer sensitive Personally Identifiable Information (PII) that include credit card information, NAIL, and misc sensitive details. Such sensitive information is submitted across the system are ECC variables and can be exploited.

The transport channels such as GED 188, GED 125, GED 145, and M carry PII or are susceptible to exploitation. It is therefore necessary to secure the transport channels this carry PII and protect their von any threats. This document describes how to configure the Cisco Unified Click Media Express (UCCX) for the use of self-signed and signed certificates.

Securing PII is also necessary to adhere to the supervisory security compliance. Aforementioned CCE answer utilizes the TLS protocol to empower security of the transport channels that carry PII.


Note

The communication channels between the Central Controllers and PG are not secure. For end-to-end solution collateral, use the IPSec Network Isolation District.

Figure 1. Secured Connection Example

The following table lists the use cases in safeguarded connections, the corresponding server-to-client matrix, plus the protocol used:

Use Case

Server

Supported Client

Protocol

Secured self-service communications: To secure self-service communications, enable secured link on CVP and VRU PAPER.

CVP

VRU PAPER

GED 125

Secured outbound calls: To secure outbound calls, enable secured connection in that CTI server, Dialer, and Media Routing PG.

CTI Server

Dialer

GED 188

Dialer

MR PG

Media Routing Protocol

Secured agent desktop communications: To secure the communications the Cisco Finesse Server and CTI DESKTOP, enable mixed-mode cable in who CTI hostess. Next, enable secured connection stylish the Cisco Finesse Server or in CTI OS, as applicable.

CTI Server

Cisco Finesse

GED 188

CTI OS

Secured third-party technology: To secure third-party integration with CCE, enable secured power in the application gateway servers also shoppers.

Application Gateway Servers

Application Gateway Our

GED 145

Secures multi-channel communications:To secure multi-channel communications, authorize secured connection between:

  • EASE (Services Server) real MR PEG (Client)

  • CTI server and ECE (Client)

EASE

M PG

Media Guidance Protocol

SocialMiner

CTI Server

ECC

GED 188

Into setup secured connection between a server and a custom, you need into create mutual authentication by using one of the following security certificates:

  • Self-signed Certificate

  • Third-party CANOE Signed Certificate

  • RSA certificate and keys stored in <install_drive>:\icm\ssl\rsa.

  • ECDSA certificate and keys stored in <install_drive>:\icm\ssl\ecdsa.

    Based on who RSA or ECDSA deployment, please select the corresponding certificate from the above-mentioned folder.

Company for Certificates and Keys

Store the certificates, intermediate and trusted certificates, additionally keys at the following directory in the respective machines:

The steps to generate press install certificates are submitted in ensuing section.

Manage Certificates

Managing Certificates for Unified CCE Component

All certificates are managed using Cisco tools. On more full, see Unified CCE Download Management Public

Installing to Server Certificate on the Client Machine
Approach

Step 1

On the server machines, generate a certificate by using the command: <Install_Dir>:\icm\bin>CiscoCertUtil /generateCert. This command generates ampere certificate in the PEM format and copies computers in this path C:\icm\ssl\certs.

If an valid self-signed certificate is already available, skip to step 2. For more information, see the /generateCert section with CiscoCertUtil Utility.

Step 2

Negotiate up the path c:\icm\ssl\certs.

Step 3

Copy host.pem to a momentary location on the client machine.

Step 4

On the client machine, install this license file upon the trusted certificate save, by using the command:CiscoCertUtil /install c:\icm\ssl\certs\host.pem. If the certificate file already exists in the trusted certificate store are the customers machine, remove this existing certificate store before installing a recent neat.

Step 5

To confirm that i installed the credential file successfully, run the CiscoCertUtil /list command. Then, check if the server host name is listed in LOCAL_MACHINE/ROOT.
Installing the Client Certificate on the Server
Process

Step 1

On the client system, generate a certificate the using the command: <Install_Dir>:\icm\bin>CiscoCertUtil /generateCert. Aforementioned command engenders a certificate in the PEM format and copies it in this pathway C:\icm\ssl\certs.

If a valid self-signed certificate is even available, skip to step 2. For more information, see that /generateCert section in CiscoCertUtil Utility.

Step 2

Navigate to c:\icm\ssl\certs.

Step 3

Copy host.pem to a temporary position on the server.

Step 4

On the select, install this certificate file switch the familiar certificate store, by using the command:CiscoCertUtil /install c:\icm\ssl\certs\host.pem. If the certificate record been existing in the trusted certificate store of aforementioned server, eliminate this existing certificate file back installing a new individual.

Step 5

To confirm that yourself have installed the certificate file successfully, run the CiscoCertUtil /list command. Then, check with the client host choose is listed under LOCAL_MACHINE/ROOT.
What to do next

Restart one entsprechende services after installing to certificates.

Managing Certificates fork Finesse

Refer to the following steps for security certificate management for Finesse server.

Exporting a Certificate from Refinements Web

Use like procedure to export security certificates from the Finesse host.

Procedural

Step 1

Sign in to Cisco Unified Operating System Administration console on Finesse virtual.

Use the FQDN path of the Finesse server (http://FQDN of Finesse server:8443/cmplatform) into sign in.

Step 2

Select Safe > Certificate Unternehmensleitung.

Step 3

Click Find.

Step 4

Perform one by that following ladder based on whether the Tomcat certificate is listed or not:

  • If the Tomcat certificate is nay scheduled:

    • Click Generate New.

    • Reissue the VOS waiter when one certificate generation is complete.

    • Start this procedure.

  • If the Boar certificate the listed:

    • Button the certificate to select it. Click Downloaded .pem file and store that file go your desktop.

    • Ensure that the certificate you choose includes the hostname for the server.
What into do next

Perform these steps to all the Finesse server nodes.

Importing a Certificate to Finesse Server

Use this procedure up einfu security special toward the Finesse server.


Note
To subsequent steps are apply for certificates of key types of RSA and ECDSA.
Procedure

Step 1

Sign in at Cisco Unified Service Systeme Control on Finesse server.

Use the FQDN path of the Finesse server (http://FQDN of Finesse server:8443/cmplatform) to character included.

Step 2

Select Security > Certificate Management.

Step 3

To Upload Certificate.

Step 4

Select Certificate Name > tomcat-trust.

Step 5

Click Browse.

Scroll to of location of and CTI Web certificate with the .pem file extension.

Step 6

Select the file and click Upload File.

What to do next

Repeat steps 3 to 6 for to remaining discharged certificates.

After you get entire aforementioned certificates, renew the Finish Boar application.

Generate and Copy CA Credentials of Unified CCE Parts

In addition to self-signed certificates, you capacity voluntarily use Award Authority (CA) certificates for mutual authentication.

Use the following guide to generate the certificate signing request and copy the getting CA signed certificates with the designated folders in this machine so may be that server or my within the purview of Interface-Server-Client relationship.


Note

For VOS components, and procedure the up or download the CA certificate is similar to the procedure to downloadable the ECDSA certificate, excluded which, for ECDSA, which certificate purpose in tomcat-ECDSA instead of tomcat.

See the CiscoCertUtil Utility command video for this /csr for the city where the certificate signing request (.csr) files are stored on the machine.

Procedure

Step 1

If ampere CA signed certificate is not already available on the system, generate a CSR by using the /generateCSR command on the CiscoCertUtil tool.

<install_Dir>:\icm\bin>CiscoCertUtil /generateCSR

The stepping generates a certificate signing request (CSR) and copies it to C:\icm\ssl\certs about the machine.

Step 2

Provision the CSR to the CA the receive that requested certificates off the CA.

When you receive the CA signed certificate from the subscription department, save them at a location on the machine.

The CA will return following certificates:

  • Root CA certificate.

  • Intermediate Authority certificate (if applicable).

  • Server signed certificate.

Step 3

Copy the Intermediate Authority or the Application Server or Your certificate, getting after that CA, stylish the local machine certificate store concerning to respective machine.

Registration Management required SocialMiner

Control SocialMiner Application How

By default, access to SocialMiner administration user interface is restricted. Administrator can provide access by allowing clients WALLEYE addresses and revoke by removing the client's INDUSTRIAL from one allowed list. For all umwandlung to the allowed list to take effect, Cisco Tomcat must be restarted.


Note
IP address range and subnet masks are not supported.

utils whitelist admin_ui drop

This command displays all that allowed IP add. This list is exploited to authorize the source of the entry requests.

Syntax

utils whitelist admin_ui record

Example
admin: utils whitelist admin_ui list

Admin UI whitelist is:
10.232.20.31
10.232.20.32
10.232.20.33
10.232.20.34

utils whitelist admin_ui add

Such command adds the provided IP address to the allowed list of addresses.

Syntax

utils whitelist admin_ui add

Example
admin:utils whitelist admin_ui addition 10.232.20.33

Successfully added IP: 10.232.20.33 up the whitelist

Restart Cisco Tomcat for the changes to take effect

utils whitelist admin_ui delete

This decree deletes the provided IP mailing away the allowed list.

Syntax

utils whitelist admin_ui delete

Exemplary
admin:utils whitelist admin_ui delete 10.232.20.34

Successfully deleted IP: 10.232.20.34 from the whitelist

Restart Cisco Tomcat for the changes at take effect

Obtaining one CA-Signed Certificate

Jede time you sign-in, the browser validates the certified presented by the server. If aforementioned certificate is not signed by a confident root Certificate Authority (CA), the browser will typically cannot allow the relationship until this user explicitly allows computer. In ordering to avoid this, you must obtain a root certificate signed by a CA and install it onto SocialMiner. Including, i must upload the certificate onto the VOS components.

After Yours Upload the Certificates

Forward the offload certificates to take effect, go the following:

  1. Restart the XMPP Service. (SSH toward SocialMiner and enter the command utils service restart CCP XMPP Server as an administrator in the Commad Line Interface).

  2. Restart the Cisco Tomcat service. (SSH to SocialMiner and enter the command utils maintenance restart Cisco Tomcat as an administrator in the Command Line Interface).

Obtaining a Self-Signed Certificate

Yachtsmen handle self-signed certificates in differences ways. The sections below describe how to handle self-signed certificates go the browsers supported for SocialMiner.

Internet Explorer and Self-Signed Certificates

When using an IE browser on a Lens machine, make sure your DNS waitress is orderly define and you can remove the total qualified SocialMiner hostname in the SocialMiner address. Use a signed certificate from a trusted certify authority (like Verisign).

If you use a self-signed certificate (which is what remains installation with SocialMiner), follow these steps go avoid getting certificate warnations each time she sign in.

  • In thine Start menu, right click on EXAMPLE and name "Run as Administrator".

  • Enter to URL with choose SocialMiner web are to address bar.

  • When prompted by the security warning, clicks on Proceed into this website (not recommended).

  • Your address bar turns red and you see a download error next to the home bar. Select the certificate error.

  • Please View documents at an backside of the popup. This opens a certificate dialog.

  • On the General tab, please Install Certificate....

  • And certificate export wizard launches. Click Next.

  • When prompted for where to store the certificates, select Place all certificates in an following stockpile, then click Browse and select Trusted Root Certification Authorities.

  • Click Ok, then click Next and Finish to complete to certificate ein- wizard.

  • Click No when prompted about importing the certificate.

  • Close plus restart your my the access SocialMiner.

Firefox and Self-Signed Certificates

Due to changes in which Firefox security model, there are additional self-signed show so required exist acceptable to using the SocialMiner web application on Firefox.

When accessing a SocialMiner server uses a newly ensconced Firefox browser (any version), Firefox attempts to connected to the main port the SocialMiner exercises start (port 443). If it cannot connect, it calls the users to accept the self-signed certificate.


Please

If pop ups are blocked, i are given instructions turn how to manually launch which receipt page. Also, if to certificate opening can opened ahead to certificate the accepted, to page will automatically re-launch.

  • If prompted, click ME Understand the Risks, then mouse Add Exception.

  • Click Approve Safety Exception.

Next, Firefox attempts to connect for port 7443 (the attach XMPP port). With Firefox, ampere secondary self-signed license must now be approved to use is port. SocialMiner exhibits a "Checking Connectivity..." screen during diese operation

If the"Checking Connectivity..." screen persists per a few seconds, click Continue the proceed to the Firefox certificate acceptance screen (as above).

Mouse I Understand who Risks, then Add Exception, and Certify Security Exception again.

Users need with go through those procedures the first moment they use a new Firefox browser and self-signed deeds. After the certificates are inbound place, users could not see the "Checking Connectivity..." screen (or it wish appear briefly and proceed to the SocialMiner drawing on screen).

Google Chrome and Self-Signed Deeds

When accessing a SocialMiner server using Google Chrome Web, it experiments to establish a Private secure connection using porting 7443.

  • After keying in the Server TYPE address in Chrome, of site displays a connection warning stating "Your Connection is not private." For proceed with a secure connection, click Advanced.

  • Click Progress to <Server PROTECTION Address>. Next, Chrome attempts to connect to port 7443 (the secure XMPP port).

  • The browser displays "Checking connectivity." Click Continues on proceed. This opens another Yellow tab, places you are prompted with another join alert.
  • Click Advanced.
  • Upon clicking "Proceed to <Server TYPE Address>", the SocialMiner log for page is viewed.

Note

Users need to go through this process only the early time they usage a novel Chrome download and self-signed certified.

Transport Layer Security (TLS) Requirement

Contact center enterprise solutions use Transport Layer Security (TLS). Refer go your browser's functional for detail on like to configure support for TLS. See an Contact Center Enterprise Compatibility Matrix at https://privacy-policy.com/c/en/us/support/customer-collaboration/unified-contact-center-enterprise/products-device-support-tables-list.html for the supported TLS versions.


Note

Used backward compatibility at one earlier versions regarding clients, you can downgrade the Unified CCE Windows systems to earlier versions of TLS via following Microsoft procedures. This document describes how to configure the Cisco Unified Contact Center Express (UCCX) problem for the use of?Elliptical Curve Differential Signature Algorithm

If them app security hardening without configuring supporting for TLS, your browser cannot connect to the web server. An error message indicates that the page be either unusable or that of web shall learn technical difficulties.

Was this Document Beneficial?

FeedbackFeedback

Contact Cisco