Cisco Jabber: Huge Improvements

• Collaboration Edge, which is basically a repurposed VCS Express that allows external users of jabber to use jabber without having to VPN in first. This is an absolute boon: Although Anyconnect for PC’s and mobile devices tried doing some fancy tricks like seeing what local domain name you had and launching VPN’s based on this, it would often not work that well. Collaboration edge is a far superior method and we will be covering it later in this 5 part series.
• Jabber SDK, which allows you to integrate Jabber into your webpages, think of things like live chats on your website that could go straight to your corporate IM platform (perhaps to people who run your cold-call campaigns etc.)
• A universal directory service, which we will go into in more detail but essentially means there’s no need to configure a complicated LDAP setup in order to get good directory support: Directory information can be pulled from outlook and other locations as well as CUCM itself
• Instant Message logging for compliance purposes, so you can log instant messaging just like you would email which could be important for your organisation.
• Finally, Jabber integration amongst organisations via XMPP allowing you to federate with other organisations, this is also possible with SIP.

Method 1: Users simply click Accept to all certificate popups. This might be the most ideal solution for smaller environments. If you click Accept, certificates are placed into the Enterprise Trust store on the device. After certificates are placed in the Enterprise Trust store, users are no longer prompted when they log into the Jabber Client on that local device.

Method 2: The required certificates (Table 2) are downloaded from the individual servers (by default, these are self-signed certificates) and installed into the Enterprise Trust store of the user device. This might be the ideal solution if your environment does not have access to a Private or Public CA for certificate signing.

Method 3: A Public or Private CA (Table 2) signs all of the required certificates. This is the Cisco recommended method. This method requires that a Certificate Signing Request (CSR) is generated for each of the certificates, is signed, re-uploaded to the server, and then imported to the Trusted Root Certificate Authorities Store on user devices. See the Generate a CSR and the How do I get certificates to user devices certificate stores? sections of this document for more information.

The first method is the least desirable but sometimes the Windows Administrator will not have setup his Certificate Authority correctly or he may not have set one up at all! If he is worth his salt, he will have installed and correctly configured a CA enviroment as they are critically important in most major windows applications these days.Assuming this is the case, when the user goes to sign into jabber they will be prompted to accept the cert:

If the cert is accepted, it will be added to the enterprise trust store as shown in the screenshot below:

Incidentally, this is where you need to go if you need to delete a certificate from the trust store for some reason for Cisco Jabber.

Method 2 is a bit better as basically you use group policy to automatically install the certificate into the users enterprise trust store so that they do not have to accept the cert, and they will not ever receive the popup box. But this will only work for Windows devices or devices that can accept a group policy update.The best method is method 3, using a proper CA to present the certificate. You could do this with a private or public CA, Private CA is a good option if you mostly have windows and mac clients as you can get them to trust your root CA, if you have a lot of iphones and Ipad’s it can be a bit more troublesome as you will need a method to get the root CA’s generated by your private CA onto the devices which can be labour-intensive unless you have good mobile device management. So for those kind of deployments you might consider using a public CA, but be warned this can cost money.I am going to assume that your going with Method 3, Private CA for the rest of this tutorial.So, if you decide to go with the Private CA method, you need to login to Jabber and go to OS administration, from here you should go to Security -> Certificate ManagementFrom here you want to click on the generate CSR button:

Enter 2048 for the encryption but continue to use tomcat as the CSR method

Once this is done, click “Download CSR” on the previous page.

This is the Certificate Signing request that (hopefully) your Windows System admin will know how to enroll into his CA and with any luck he should send you back a shiney certificate, ask him to export it as BASE64 if possible. Ask him to also export the trusted root CA cert so we can import this into jabber too.

Once this is done, you need to import the certificate, click on “Upload/Download” Certificate.

The first thing you need to do is import the trusted root CA, select tomcat-trust from the dropdown:

Once this is done, you should be able to test if your certificate has installed correctly and is trusted correctly by simply logging into your CUCM IM & P webpage and ensuring a valid certificate is presented. you will need to ensure you are visting the page via it’s DOMAIN NAME as the certificate will be signed against the domain name: Remember: it’s important to get used to using DNS from now on, Jabber and IM really relies on it, and once IPv6 is more widely deployed all us network engineers are going to be relying on DNS a lot more!Once this is done, you should be able to login to Jabber without any error messages or any extra configuration required for users, just login and start enjoying!

It’s important to note that if your integrating with CUCM or Webex or Unity Connection, all of these applications will ALSO present certificates to your jabber client, thus you will have to perform the exact same actions with these applications.