Enabling mixed mode and encrypted calling in Unified CM

See also

Sources

1. 1
   A call registers as secure only if every device in the call registers as secure; one nonsecure device makes the call nonsecure even if the caller's or recipient's phone is secure.

   Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Phone Security · Phone Security > interactions / call security status · Checked 2026-09-30
2. 2
   The Cisco Certificate Authority Proxy Function service is activated on the publisher from Cisco Unified Serviceability > Tools > Service Activation; Online CA mode also needs the Cisco Certificate Enrollment Service.

   Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Certificate Authority Proxy Function · Certificate Authority Proxy Function > Activate or restart CAPF services · Checked 2026-09-30
3. 3
   The per-phone Certificate Operation field offers Install/Upgrade to deploy an LSC, Delete to remove it, and Troubleshoot to diagnose certificate issues.

   Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Certificate Authority Proxy Function · Certificate Authority Proxy Function > CAPF settings on the phone · Checked 2026-09-30
4. 4
   CAPF issues Locally Significant Certificates (LSCs) to supported Cisco IP phones, authenticates phones in mixed mode, upgrades existing LSCs and retrieves phone certificates for troubleshooting.

   Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Certificate Authority Proxy Function · Certificate Authority Proxy Function > overview · Checked 2026-09-30
5. 5
   CAPF runs in one of three modes: Cisco Authority Proxy Function (the default, where CAPF signs LSCs itself), Online CA (an external CA signs automatically) or Offline CA (CSRs are downloaded, signed externally and uploaded manually).

   Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Certificate Authority Proxy Function · Certificate Authority Proxy Function > CAPF modes · Checked 2026-09-30
6. 6
   LSC status can be checked on the Phone Configuration page, in CAPF reports, or from Find and List Phones.

   Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Certificate Authority Proxy Function · Certificate Authority Proxy Function > verify LSC / CAPF reports · Checked 2026-09-30
7. 7
   The CLI command utils ctl set-cluster mixed-mode updates the CTL file and sets the cluster to mixed mode.

   Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes · Security Modes > Mixed Mode > CLI commands table · Checked 2026-09-30
8. 8
   utils ctl reset localkey, run on the publisher, regenerates the CTL file signed with the CallManager key (secondary SAST role) for use when the ITLRecovery certificate has changed and endpoints are locked out; once endpoints have that file, the CTL update command is run again to re-sign it with ITLRecovery.

   Command Line Interface Reference Guide for Cisco Unified Communications Solutions, Release 15 and SUs - Utils Commands · utils ctl reset localkey > Description and Usage Guidelines · Checked 2026-09-30
9. 9
   From Unified CM 12.0(1) the tokenless CTL file is signed by the ITLRecovery certificate and carries two SAST records, ITLRecovery and CallManager.

   Security Guide for Cisco Unified Communications Manager, Release 12.5(1)SU2 - Cisco CTL Client Setup · Cisco CTL Client Setup > SAST roles in tokenless CTL · Checked 2026-09-30
10. 10
    For a CUCM-to-CUBE TLS trunk the CUBE certificate is uploaded to Unified CM as CallManager-Trust, the X.509 Subject Name matches the CUBE certificate CN, the trunk destination port changes from 5060 to 5061 and SRTP Allowed is checked.

    Configure SIP TLS between CUCM-CUBE/CUBE-SBC · Configure > Steps 4, 9 and 10 · Checked 2026-09-30
11. 11
    Cisco's CUCM-to-CUBE SIP TLS configuration note lists as a requirement that Unified CM be in mixed mode, with TCP 5061 open on transit firewalls and security and UCK9 licences on the CUBE.

    Configure SIP TLS between CUCM-CUBE/CUBE-SBC · Prerequisites > Requirements · Checked 2026-09-30
12. 12
    The lock icon on a phone means both call signaling (TLS) and call media (SRTP) are encrypted.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Secure Tones and Icons · Secure Tones and Icons > Secure icons · Checked 2026-09-30
13. 13
    The shield icon on a phone means call signaling is encrypted with TLS while call media is unencrypted or only partially encrypted; some phone models show only the lock icon and never the shield.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Secure Tones and Icons · Secure Tones and Icons > Secure icons · Checked 2026-09-30
14. 14
    When phones no longer trust the ITL signer, utils itl reset localkey re-signs the ITL file with the CallManager key; show itl confirms the reset, then phones are reset from System > Enterprise Parameters and the TFTP service is restarted.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Default Security · Default Security > Bulk reset of the ITL file · Checked 2026-09-30
15. 15
    The ITL file is built automatically when the TFTP service is activated and is signed by the ITLRecovery certificate.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Default Security · Default Security > Initial Trust List / ITL file contents · Checked 2026-09-30
16. 16
    The ITLRecovery key pair can be exported for disaster recovery with the CLI command file get tftp ITLRecovery.p12 to an SFTP server.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Default Security · Default Security > Back up ITLRecovery · Checked 2026-09-30
17. 17
    ITLRecovery was chosen as the CTL signer because it does not change for secondary reasons such as a hostname change; before 12.0(1) regenerating the CallManager certificate could lock endpoints out.

    Security Guide for Cisco Unified Communications Manager, Release 12.5(1)SU2 - Cisco CTL Client Setup · Cisco CTL Client Setup > tokenless CTL SAST roles · Checked 2026-09-30
18. 18
    In mixed mode Unified CM uses TLS for signaling and SRTP for media.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes · Security Modes > Mixed Mode · Checked 2026-09-30
19. 19
    A tokenless mixed-mode cluster is returned to non-secure mode by running utils ctl set-cluster non-secure-mode on the publisher.

    CUCM Cluster Changed from Mixed Mode to Non-Secure Mode Configuration Example · Configure > CLI method · Checked 2026-09-30
20. 20
    After a change to non-secure mode the CTL file still exists on servers and phones but contains no CCM+TFTP server certificates, and Cisco recommends deleting the CTL file from phones to avoid problems if certificates or cluster topology later change.

    CUCM Cluster Changed from Mixed Mode to Non-Secure Mode Configuration Example · Background / CTL file after non-secure mode · Checked 2026-09-30
21. 21
    Non-secure mode is the default security mode when Unified CM is first installed, and in it Unified CM provides no secure signaling or media services.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes · Security Modes > Non-Secure Mode (Default) · Checked 2026-09-30
22. 22
    After changing to non-secure mode, the TFTP and Cisco CallManager services must be restarted on all nodes that run them and all IP phones restarted to download the updated CTL file.

    CUCM Cluster Changed from Mixed Mode to Non-Secure Mode Configuration Example · Configure > after the change · Checked 2026-09-30
23. 23
    The CTL file on a phone can be checked under Settings > Security Configuration > Trust List > CTL File and its checksum compared with the output of show ctl.

    CUCM Cluster Changed from Mixed Mode to Non-Secure Mode Configuration Example · Verify · Checked 2026-09-30
24. 24
    Before setting mixed mode the Certificate Authority Proxy Function (CAPF) service and the Certificate Trust List (CTL) Provider service must be enabled on the publisher.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes · Security Modes > Mixed Mode > prerequisites · Checked 2026-09-30
25. 25
    Mixed mode requires Unified CM to be registered with Cisco Smart Software Manager or a Smart Software Manager satellite with export-controlled functionality enabled.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes · Security Modes > Mixed Mode > prerequisites · Checked 2026-09-30
26. 26
    A phone security profile is applied in Device > Phone by selecting it in Device Security Profile, clicking Save and then Apply Config, and the phone must be reset for the change to take effect.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Phone Security · Phone Security > Apply Security Profile to Phone · Checked 2026-09-30
27. 27
    The Authenticated device security mode provides integrity and authentication for the phone, using a TLS connection with NULL/SHA for signaling.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Phone Security · Phone Security Profile settings > Device Security Mode · Checked 2026-09-30
28. 28
    The phone security profile's CAPF Authentication Mode options include By Null String, By Existing Certificate (Precedence to LSC) and By Existing Certificate (Precedence to MIC).

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Phone Security · Phone Security Profile settings > Authentication Mode · Checked 2026-09-30
29. 29
    The Encrypted device security mode provides integrity, authentication and encryption for the phone.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Phone Security · Phone Security Profile settings > Device Security Mode · Checked 2026-09-30
30. 30
    Phone security profiles are created in Unified CM Administration under System > Security > Phone Security Profile, using Add New or by copying an existing profile.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Phone Security · Phone Security > Set Up Phone Security Profile · Checked 2026-09-30
31. 31
    Checking TFTP Encrypted Config in a phone security profile makes Unified CM encrypt the phone's downloads from the TFTP server.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Phone Security · Phone Security Profile settings > TFTP Encrypted Config · Checked 2026-09-30
32. 32
    When a phone security profile's Device Security Mode is Authenticated or Encrypted, TLS is set as the transport automatically.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Phone Security · Phone Security Profile settings > Transport Type · Checked 2026-09-30
33. 33
    After regenerating the CAPF certificate in mixed mode the CTL file must be updated and the Cisco Certificate Authority Proxy Function, Cisco Trust Verification Service and Cisco TFTP services restarted.

    Regenerate Certificates In Unified Communications Manager · CAPF certificate regeneration · Checked 2026-09-30
34. 34
    In a mixed-mode cluster, after regenerating the CallManager certificate, utils ctl update CTLFile must be run before the services are restarted; a non-secure cluster skips the CTL update.

    Regenerate Certificates In Unified Communications Manager · CallManager certificate regeneration · Checked 2026-09-30
35. 35
    From 12.5 the ITLRecovery certificate is regenerated only on the publisher, and in a mixed-mode cluster the CTL file must be updated before services are restarted.

    Regenerate Certificates In Unified Communications Manager · ITLRecovery certificate regeneration · Checked 2026-09-30
36. 36
    After certificate regeneration, encrypted and authenticated phones must be reset (via the Enterprise Parameters reset or bulk administration), and registration should be confirmed in RTMT before regenerating the next certificate.

    Regenerate Certificates In Unified Communications Manager · CallManager certificate regeneration > phone reset · Checked 2026-09-30
37. 37
    For endpoint trust recovery, utils itl reset localkey applies to non-secure clusters and utils ctl reset localkey applies to mixed-mode clusters.

    Regenerate Certificates In Unified Communications Manager · ITLRecovery certificate regeneration > recovery commands · Checked 2026-09-30
38. 38
    After enabling mixed mode all IP phones must be restarted so they obtain the CTL file from the Unified CM TFTP service.

    Migrate CUCM Mixed Mode with Tokenless CTL · Configure > tokenless mixed mode steps · Checked 2026-09-30
39. 39
    After running the mixed-mode CLI command, the TFTP and Cisco CallManager services must be restarted on all nodes in the cluster.

    Migrate CUCM Mixed Mode with Tokenless CTL · Configure > tokenless mixed mode steps · Checked 2026-09-30
40. 40
    The enterprise parameter Prepare Cluster for Rollback to pre-8.0 makes the cluster publish ITL files with empty TVS and TFTP certificate sections so phones accept a new ITL, and it should be set back once the migration is complete.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Default Security · Default Security > Bulk certificate management and phone migration · Checked 2026-09-30
41. 41
    Secure tones play only on phones configured as protected devices: three long beeps indicate a secure call and six short beeps a non-secure call.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Secure Tones and Icons · Secure Tones and Icons > Secure tones / protected devices · Checked 2026-09-30
42. 42
    The CLI command show ctl displays the contents of the CTL file, including its checksum.

    Migrate CUCM Mixed Mode with Tokenless CTL · Verify · Checked 2026-09-30
43. 43
    SIP OAuth mode is a separate Unified CM security mode, enabled with utils sipOAuth-mode enable on the publisher, that uses OAuth refresh tokens to authenticate Cisco Jabber and selected phone models.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes · Security Modes > SIP OAuth Mode · Checked 2026-09-30
44. 44
    The CLI query run sql select paramname,paramvalue from processconfig where paramname='ClusterSecurityMode' returns 1 when the cluster is in mixed mode.

    Migrate CUCM Mixed Mode with Tokenless CTL · Verify · Checked 2026-09-30
45. 45
    To move from a USB-token CTL to tokenless, endpoints must first download a token-generated CTL file uploaded on Unified CM 12.0(1) or later; only after that download can the cluster switch to tokenless with utils ctl update CTLFile.

    Security Guide for Cisco Unified Communications Manager, Release 12.5(1)SU2 - Cisco CTL Client Setup · Cisco CTL Client Setup > note on tokenless CTL migration · Checked 2026-09-30
46. 46
    Tokenless CTL, available from Unified CM 10.0(1), enables encryption of IP phone signaling and media without hardware USB eTokens.

    Migrate CUCM Mixed Mode with Tokenless CTL · Introduction · Checked 2026-09-30
47. 47
    When mixed mode is set from the CLI, the CTL file is signed with the publisher's CCM+TFTP (server) certificate and contains no eToken certificates.disputed

    Migrate CUCM Mixed Mode with Tokenless CTL · Background Information / Configure section on tokenless CTL · Checked 2026-09-30
48. 48
    As of Unified CM 14SU3 the Cisco CTL Provider service no longer supports CTL (USB) tokens, and tokenless is the default supported method.

    Regenerate Certificates In Unified Communications Manager · Background / note on CTL tokens · Checked 2026-09-30
49. 49
    For a CA-signed SIP TLS trunk, the CA root certificate is uploaded as CallManager-trust and the CA-signed CallManager certificate is installed through OS Administration > Security > Certificate Management, on both clusters.

    Configure SIP TLS Trunk on the Communications Manager with a CA Signed Certificate · Configure > certificate upload steps · Checked 2026-09-30
50. 50
    A SIP trunk security profile's Device Security Mode is Non Secure (TCP or UDP), Authenticated (TLS with NULL/SHA) or Encrypted (TLS with AES128/SHA).

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · SIP Trunk Security Profile settings > Device Security Mode · Checked 2026-09-30
51. 51
    The default incoming port for TLS in a SIP trunk security profile is 5061.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · SIP Trunk Security Profile settings > Incoming Port · Checked 2026-09-30
52. 52
    SIP trunk security is set in a SIP Trunk Security Profile under the System menu's security profile settings and applied to the trunk in the Device > Trunk SIP Trunk Configuration window.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · Trunk and Gateway SIP Security > Set Up SIP Trunk Security Profile · Checked 2026-09-30
53. 53
    After a SIP trunk security profile is applied to a trunk, the trunk must be reset (Apply Config) for the change to take effect.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · Trunk and Gateway SIP Security > Apply SIP Trunk Security Profile · Checked 2026-09-30
54. 54
    Media encryption on a SIP trunk requires the SRTP Allowed check box on the trunk, and because SRTP keys travel in the SIP message body the signaling must be protected by TLS.

    Configure SIP TLS Trunk on the Communications Manager with a CA Signed Certificate · Configure > SIP Trunk configuration · Checked 2026-09-30
55. 55
    Cisco recommends that a trunk with SRTP Allowed checked use an encrypted TLS profile so that keys and other security information are not exposed during call negotiation.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · Trunk and Gateway SIP Security > SRTP Allowed note · Checked 2026-09-30
56. 56
    Authenticated and Encrypted SIP trunk security profiles use TLS as both the incoming and outgoing transport type.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · SIP Trunk Security Profile settings > Incoming/Outgoing Transport Type · Checked 2026-09-30
57. 57
    A packet capture of a working SIP TLS trunk shows the TCP handshake, Client Hello, server and client certificate exchange, then encrypted Application Data carrying the SIP signaling.

    Configure SIP TLS Trunk on the Communications Manager with a CA Signed Certificate · Verify · Checked 2026-09-30
58. 58
    In the intercluster SIP TLS example, each side's X.509 Subject Name is set to the Common Name of the peer cluster's certificate.

    Configure SIP TLS Trunk on the Communications Manager with a CA Signed Certificate · Configure > SIP Trunk Security Profile · Checked 2026-09-30
59. 59
    The SIP trunk security profile's X.509 Subject Name field holds the peer certificate subject used to authenticate the device, and accepts multiple names separated by space, comma, semicolon or colon up to 4096 characters.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Trunk and Gateway SIP Security · SIP Trunk Security Profile settings > X.509 Subject Name · Checked 2026-09-30
60. 60
    The utils ctl commands are not allowed while an upgrade is in progress.

    Command Line Interface Reference Guide for Cisco Unified Communications Solutions, Release 15 and SUs - Utils Commands · utils ctl > Requirements · Checked 2026-09-30
61. 61
    The utils ctl command must be run on the publisher; it is disabled on all other nodes.

    Command Line Interface Reference Guide for Cisco Unified Communications Solutions, Release 15 and SUs - Utils Commands · utils ctl > Usage Guidelines · Checked 2026-09-30
62. 62
    After any utils ctl CTL update, all Encrypted and Authenticated phones must be reset for the CTL file update to take effect.

    Command Line Interface Reference Guide for Cisco Unified Communications Solutions, Release 15 and SUs - Utils Commands · utils ctl > Usage Guidelines · Checked 2026-09-30
63. 63
    Mixed mode is confirmed when the Cluster Security Mode field in the Security Parameters pane of System > Enterprise Parameters shows the value 1.

    Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Security Modes · Security Modes > Mixed Mode > verification · Checked 2026-09-30
64. 64
    utils ctl commands (set-cluster mixed-mode, set-cluster non-secure-mode, update CTLFile) run only on the publisher, and encrypted and authenticated phones must be reset for CTL updates to take effect.

    Command Line Interface Reference Guide for Cisco Unified Communications Solutions, Release 15 and SUs - Utils Commands · utils ctl command entry (requirements and usage guidelines) · Checked 2026-10-01
65. 65
    CAPF listens on TCP 3804 to issue Locally Significant Certificates to IP phones.

    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Cisco Unified Communications Manager TCP and UDP Port Usage · Table: Signaling, Media, and Other Communication Between Phones and Cisco Unified Communications Manager, row TCP 3804 · Checked 2026-10-01
66. 66
    On a mixed-mode cluster, run utils ctl update CTLFile on the publisher after regenerating CAPF, CallManager or ITLRecovery and before restarting services.

    Regenerate Certificates In Unified Communications Manager · Mixed-mode requirement note · Checked 2026-10-01
67. 67
    utils ctl reset localkey, run on the publisher, regenerates the CTL file signed with the CallManager key (secondary SAST) for when the ITLRecovery certificate has changed and endpoints are locked out. Run utils ctl update CTLFile again afterwards.

    Command Line Interface Reference Guide for Cisco Unified Communications Solutions, Release 15 and SUs - Utils Commands · utils ctl reset localkey command entry · Checked 2026-10-01

Documents

Cite this page

WarmTransfer. (2026, October 1). Enabling mixed mode and encrypted calling in Unified CM. WarmTransfer. https://warmtransfer.net/guides/cucm-secure-calling-setup

@misc{warmtransfer-cucm-secure-calling-setup,
  title  = {Enabling mixed mode and encrypted calling in Unified CM},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/guides/cucm-secure-calling-setup},
  note   = {Verified 2026-10-01}
}