Field Notice: FN74094 - Ending Support for CSR Signing on Cisco CDA (Customer Device Activation) service – Product Migration or Configuration Updates Required - Workaround Provided

Cisco Customer Device Activation (CDA), formerly Cisco Enablement Data Orchestration System (EDOS), will end support of Certificate Signing Requests (CSRs) from the following root certificates: 

The end of support for CSRs affects all the variants of the Product IDs (PIDs) that are in the Products Affected list. The affected PID list does not list all variants.

Prior to this notice, service providers could create a CSR, upload it to the Cisco CDA portal, and get a signed certificate, which would be installed on the provisioning server. The phone could then validate the server certificate and trust the communication. 

The following table lists product options that were previously available on the Cisco CDA web portal to sign CSRs. Currently, only the last option is available for self-service. 

After CSR signing support has ended, service providers will not be able to get Cisco signed server certificates through the CDA service to provision and operate their Cisco IP Phones and Analog Telephone Adapters (ATAs).

Solution

On devices for which CSR signing is still supported, renew the certificate one more time. Note the following:

• For certificates issued by Cisco Small Business Provisioning Root Authority 2, renew from the Cisco CDA web portal.
• For certificates issued starting June 1, 2024, maximum certificate validity will be limited to May 31, 2025.

Going forward, get the server certificate signed by a preferred certificate authority. To get ready for the transition, review the following information carefully to become familiar with options based on the type of devices that are deployed, and act now while there is still a working server certificate.

Multiplatform Phones (MPP) / ATAs

• This applies to Cisco 6800, 7800, and 8800 Series desk/conference phones that are running MPP firmware, Cisco 6800 Series IP DECT phones with base stations, MPP ATA191/192, Cisco 8875 and 9800 Series phones deployed in MPP mode. 
• All these phones and ATAs have built-in trust store and already contain some well-known CA root certificates. For more information, see https://www.cisco.com/security/pki/ (Cisco Trusted Core Root Bundle)
• If a phone does not have the preferred CA root certificate in its trust store, use a custom CA URL configuration. Details on installing a custom CA root certificate is provided later in this section.

Linksys and SPA Phones and ATAs

These devices are already at the end of software support and are vulnerable due to a lack of security patches. The best course of action is to replace those devices with currently supported devices before the impact date:

• https://www.cisco.com/c/en/us/support/collaboration-endpoints/desk-phone-9800-series/series.html
• http://cisco.com/go/mpp
• MPP ATAs 191 / 192

As workaround for Linksys, SPA Phones, and ATAs, while implementing a device replacement plan and if the end-of-support device and its firmware support custom CA URL configuration, consider getting the server certificate signed by well-known certificate authority. 

Install a Custom CA Root Certificate

Host the custom CA root cert on the server and install it by specifying the path to the custom CA cert using the Custom CA URL parameter for the phone or ATA configurations. Cisco recommends trying this first in a lab setup and then deploying in production.

Configuration examples:

• Web portal: Voice > Provisioning > CA Settings > Custom CA Rule
• XML configuration: <Custom_CA_Rule ua="na">http://your-file-server.test/root-cert.crt</Custom_CA_Rule>
• Plain text file: Custom_CA_RULE "" ;

Verify the custom CA installation status:

• Web portal: Info > Download Status > Custom CA Status
• XML Status:

<Custom_CA_Status> 
<Custom_CA_Provisioning_Status>[06/16/2024 15:48:28][ http://your-file-server.test/root-cert.crt]Custom CA Download Succeeded.
</Custom_CA_Provisioning_Status> 
<Custom_CA_Info>Installed - /C=US/O=Your-Telephony-Org/CN=Your-favorite-CA</Custom_CA_Info> 
</Custom_CA_Status> 

Resources

• https://app.vidcast.io/share/b84862da-1191-427d-a0ed-83e07f6e83e3
• https://community.cisco.com/t5/collaboration-knowledge-base/how-to-install-a-custom-security-certificate-on-mpp-devices/ta-p/3986014
• https://community.cisco.com/t5/voice-systems/secure-provisioning/td-p/3233479
• https://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/csbpvga/ata/provisioning/guide/Provisioning.pdf

The end of support for CSR affects all the variants of the PIDs listed in the Products Affected list. The affected PID list does not list all variants.

Check the server certificate and device software release and compare it against the following table to determine CSR signing support end: