CUCM Certificate Renewal Process, Step by Step

Certificate expiry is the 2 a.m. outage nobody saw coming. Here is the general renewal process for the main CUCM certificates, and how to stop tracking expiry dates in a spreadsheet.

Which CUCM certificates expire

• CallManager (device registration and secure signaling)
• Tomcat (the admin and user web interfaces)
• CAPF (Certificate Authority Proxy Function, for LSCs)
• TVS (Trust Verification Service)
• ITLRecovery, IPsec, and TFTP-related certificates

The general renewal steps

In Cisco Unified OS Administration, under Security and Certificate Management, you locate the certificate, regenerate it, then restart the service that uses it. For example, the CallManager certificate pairs with the Cisco CallManager and TFTP services, Tomcat with Cisco Tomcat, CAPF with the Certificate Authority Proxy Function service, and TVS with the Trust Verification Service.

Order matters, and some certificates touch the ITL, which means phones may need to re-download trust before they register. Always follow Cisco’s documented procedure for your exact version and certificate, and plan phone impact into the change window.

Stop tracking certs by hand

The real problem is not the renewal, it is never being surprised by one. Beacon tracks every certificate across every Call Manager, IM and Presence, Unity, and Expressway node, color-coded by days to expiry, and generates a renewal runbook built for that exact certificate on that exact cluster. Renewals become scheduled work instead of emergencies.

This guide is general. Follow Cisco’s official documentation for the exact steps and order on your version.

Frequently Asked Questions

How do I renew a certificate in CUCM?

In Cisco Unified OS Administration under Certificate Management, regenerate the certificate, then restart the service that uses it. Follow Cisco’s documented order for your version.

Which CUCM certificates expire?

The common ones are CallManager, Tomcat, CAPF, TVS, ITLRecovery, IPsec, and TFTP-related certificates.

What happens if a CUCM certificate expires?

Depending on the certificate, phones can fail to register, secure services can break, or the admin web interface can throw errors. Some certificates affect the ITL and phone trust.