Certificate lifecycle management for voice

See also

Sources

1. 1
   Cisco states that a certificate can be shared with more than one Local Gateway provided the fully qualified domain name requirements are satisfied.

   Security requirements for Webex Calling · Requirements for secure SIP with mTLS, closing sentence · Checked 2026-09-16
2. 2
   Cisco requires that a signed Local Gateway certificate always has a valid expiry and that the root or intermediate certificates used to sign it also have a valid expiry and are not revoked, and separately requires the Webex trust bundle to be uploaded onto the Cisco Unified Border Element.

   Security requirements for Webex Calling · Requirements for secure SIP with mTLS, certificate validity bullets · Checked 2026-09-16
3. 3
   Cisco states that 4 of the 17 Local Gateway trunk error conditions, numbers 2 6 11 and 12, are shown only when all the edge proxy nodes experience an issue.

   Configure trunks, route groups, and dial plans for Webex Calling · note following the troubleshooting table · Checked 2026-09-16
4. 4
   The Webex Calling security requirements article dated 28 April 2026 states that a trunk configured with an SRV address must contain that SRV name in the certificate common name or subject alternative name and that the records the SRV address resolves to, meaning the CNAME the A record or the IP address, are optional in the subject alternative name.disputed

   Security requirements for Webex Calling · Requirements for secure SIP with mTLS, SRV example · Checked 2026-09-16
5. 5
   Control Hub publishes 17 numbered error conditions for a certificate-based Local Gateway trunk with a verification action for each, 8 of them describing a TLS connection to the Local Gateway failing and 6 describing a TLS connection from the Local Gateway to Webex Calling failing, covering DNS resolution, transport, an invalid or expired or revoked certificate, an invalid or expired certificate authority, a missing FQDN in the common name or subject alternative name, and absent or unsuccessful SIP OPTIONS.

   Configure trunks, route groups, and dial plans for Webex Calling · Troubleshooting table, SI No. 1 to 17, read as cells · Checked 2026-09-16
6. 6
   Webex Calling does not support wildcard certificates on the Local Gateway, and only certificates carrying the server authentication extended key usage are accepted.

   Cisco Preferred Architecture for Webex Calling — Design Overview · Certificate-based Local Gateway, pages 24-25 · Checked 2026-09-04
7. 7
   Webex Calling accepts a Local Gateway certificate carrying only the Server Authentication extended key usage and does not validate or enforce the presence of Client Authentication extended key usage during TLS handshake establishment.

   Get started with Local Gateway · Table 2 Compare trunking models, CA and certificate requirements row; repeated under Troubleshooting TLS Handshake establishment · Checked 2026-09-15
8. 8
   A TLS handshake failure after a Local Gateway certificate renewal may be a third-party session border controller enforcing strict extended key usage validation and rejecting a certificate without Client Authentication extended key usage, and Cisco states that any such requirement is determined by the session border controller vendor rather than by Webex Calling.

   Get started with Local Gateway · Troubleshooting TLS Handshake establishment, cause and resolution table plus the closing note · Checked 2026-09-15
9. 9
   Where a certificate-based trunk uses an SRV address, both the SRV record and the A record it derives must appear in the subject alternative name of the Local Gateway certificate, and the certificate's common name or subject alternative name must carry the fully qualified domain name chosen for the trunk in Control Hub.disputed

   Configure trunks, route groups, and dial plans for Webex Calling · Add a certificate-based trunk to a location, note following the record-type example table · Checked 2026-09-15

Documents

Cite this page

WarmTransfer. (2026, September 16). Certificate lifecycle management for voice. WarmTransfer. https://warmtransfer.net/knowledge/certificate-lifecycle

@misc{warmtransfer-certificate-lifecycle,
  title  = {Certificate lifecycle management for voice},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/certificate-lifecycle},
  note   = {Verified 2026-09-16}
}