Navigate Client EKU Sunset with Expressway x15.5

Publisher

Cisco Systems

URL

https://www.cisco.com/c/en/us/support/docs/unified-communications/telepresence-video-communication-server-expressway/225693-navigate-client-eku-sunset-with.html

Published

2026-04-15

Updated

unknown

Accessed

2026-09-24

HTTP status

200

License

Cisco copyright; all rights reserved; no-redistribution; short excerpts and locators only

Source notes citing this source

• In the X15.5 tech note's tests, the Unified Communications traversal zone and the port 2222 SSH tunnels failed or stayed inactive when Expressway-C's client certificate lacked the client EKU. in context
• Expressway X15.5 has separate server and client certificate stores. On upgrade from X15.4, existing server certificates are copied into the client store. in context
• X15.5 adds the CLI setting xconfiguration SIP TLS Certificate ExtendedKeyUsage Checking Mode, which is ON by default. When OFF, inbound SIP TLS stops checking for the client EKU but still checks for the server EKU. in context
• The X15.5 tech note's recommended option pairs an internal-CA Expressway-C client certificate carrying both EKUs with public-CA server certificates carrying the server EKU only on Expressway-C and Expressway-E. in context
• In X15.5 the X15.4 CLI setting xConfiguration XCP TLS Certificate CVS EnableServerEkuUpload is no longer used. in context
• From X15.5 Maintenance > Security has separate client certificate and server certificate sections and a server certificate can be uploaded as the client certificate. in context
• X15.5 adds the CLI xconfiguration SIP TLS Certificate ExtendedKeyUsage Checking Mode which defaults to ON and checks that the TLS initiator's certificate has a client EKU. in context
• For the UC zone on X15.5 Cisco TAC recommends an Expressway-C client certificate carrying both client and server EKU ideally from an internal CA while its server certificate may be a public server-only-EKU certificate. in context

Cite this source record

APA

WarmTransfer. (2026, April 15). Navigate Client EKU Sunset with Expressway x15.5. WarmTransfer. https://warmtransfer.net/knowledge/sources/cisco-technote-225693-client-eku-x155

BibTeX

@misc{warmtransfer-cisco-technote-225693-client-eku-x155,
  title  = {Navigate Client EKU Sunset with Expressway x15.5},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/sources/cisco-technote-225693-client-eku-x155},
  note   = {Cisco Systems, accessed 2026-09-24}
}