Automated SSL certificate renewal for Cisco CUBE

CUBE won't move SIP TLS to a renewed certificate on its own. CertKit will.

Cisco Unified Border Element runs on IOS XE routers like the Catalyst 8000 and ISR 4000, connecting your calls to Microsoft Teams Direct Routing, Webex Calling, and SIP trunk providers. It presents its SIP TLS certificate from a trustpoint, and a voice class tls-profile or sip-ua crypto signaling line names that trustpoint. A renewed certificate does nothing until someone imports it on the router and points CUBE at it. Every 47 days.

CertKit issues and renews the certificate centrally, then the CertKit Agent imports it on the router over SSH and switches CUBE to the new trustpoint.

Start free trial Watch demo

Built for Cisco CUBE

A pre-built CUBE SIP TLS template ships in your CertKit account. No scripting required.

On every renewal, the agent signs in to the router over SSH, imports the certificate and its chain into a new trustpoint, and switches the one CUBE setting you picked: a voice class tls-profile, the sip-ua default, or a remote-addr entry. It checks that the router reports the new certificate's fingerprint, saves the configuration with write memory, and removes the trustpoints and key pairs from earlier renewals once nothing uses them.

New SIP TLS connections use the new certificate right away. Existing connections keep the previous certificate until they reconnect.

How to install a SIP TLS certificate on Cisco CUBE

The manual process, if you want to do it yourself:

Set the clock. Point the router at NTP before anything else. IOS XE rejects a certificate whose start date is still in the future by its own clock, and a freshly issued certificate fails with "%CRYPTO_PKI: Cert not yet valid or is expired" on a router that has drifted.
Get the certificate. Create a trustpoint with crypto pki trustpoint and enrollment terminal, then generate a certificate signing request with crypto pki enroll. Or bring a PKCS#12 with the private key and the CA certificate from somewhere else.
Import it into the trustpoint. Paste a PKCS#12 with crypto pki import <trustpoint> pkcs12 terminal password <password>. For a CSR, run crypto pki authenticate for the CA first, or the router answers "You must authenticate the Certificate Authority before you can import the router's certificate."
Point CUBE at the trustpoint. Change trustpoint under the voice class tls-profile, or the crypto signaling default trustpoint or remote-addr line under sip-ua, to the new trustpoint name.
Trust the far end and save. For Webex Calling, import Cisco's root bundle with crypto pki trustpool import clean url https://www.cisco.com/security/pki/trs/ios_core.p7b. Then write memory, and remove the old trustpoint and its RSA key pair by hand.

Every one of these steps is manual, and IOS XE won't repeat any of them when the certificate renews. With lifetimes shrinking to 47 days, that's twelve times a year, on every CUBE. Miss one and Teams marks the SBC Inactive, Webex Control Hub reports "TLS Connection to Local Gateway failed as the gateway's certificate has expired", and calls to and from the phone network stop.

At 47 days, automation is the only sustainable way to run Cisco CUBE certificates. Here's how CertKit does it.

From an operational perspective, CertKit is easy to deploy and manage. The ability to configure unique and specialized certificates is key to replacing our manual certificate processes.

Laura Thomas, Senior Central Systems Administrator, University of St. Thomas

How it works

 Your network            CertKit                 ACME CA
┌───────────────────┐     ┌──────────────────┐    ┌─────────────┐
│  ┌─────────────┐  │     │                  │    │             │
│  │CertKit Agent├──┼────►│  Issue & Renew   │◄──►│             │
│  └──────┬──────┘  │     │   Certificates   │    │             │
│         │ SSH     │     │                ┌───┐  └─────────────┘
│         │ :22     │     └────────────────│DNS│
│         ▼         │                      └───┘
│ ┌──────────────┐  │
│ │ CUBE router  │  │
│ │ [x] Imported │  │
│ │ [x] Switched │  │
│ │ [x] Saved    │  │
│ └──────────────┘  │
└───────────────────┘

CertKit issues and renews certificates centrally using delegated DNS validation. You create a one-time CNAME record, and CertKit handles every ACME challenge after that.

The CertKit Agent runs on a Windows server inside your network. It pulls each renewal from CertKit over outbound HTTPS, then signs in to the router over SSH. CertKit never connects into your network. The router never talks to CertKit, never runs ACME, and never holds DNS credentials.

Which CAs Teams and Webex accept

Microsoft Teams Direct Routing takes an SBC certificate from any CA in the Microsoft Trusted Root Program, with the SBC's FQDN in the common name or a SAN. Let's Encrypt and Google Trust Services are both in the program. Government tenants are stricter. GCCH and DoD support only DigiCert Global Root CA, DigiCert High Assurance EV Root CA, and DigiCert Global Root G2, so those routers need a DigiCert certificate, which CertKit issues over ACME with your DigiCert credentials.

Webex Calling Local Gateway takes a certificate from the CAs on Cisco's Webex root list, which includes Let's Encrypt and Google Trust Services. It doesn't accept wildcard certificates, so issue one for the gateway's own name.

What CertKit handles

Issue and renew centrally. The one-time CNAME covers every renewal challenge. The router has no ACME configuration and no DNS credentials.
Import into a fresh trustpoint. The PKCS#12 is pasted at the CLI, or copied to flash with tclsh when it's too large to paste, like a 4096-bit key. IOS XE adds trustpoints for the intermediates, so CUBE sends the whole chain.
Switch CUBE to it. Only the setting you picked changes, and the agent reads the running configuration back to confirm it did.
Check before changing anything. The agent stops on routers managed by SD-WAN, on a CUBE setting restricted to ECDSA ciphers, and on an account that lands at the user EXEC prompt. It warns when the router's clock isn't synchronized.
Save and clean up. The configuration is saved with write memory. Trustpoints from earlier CertKit renewals are removed with their key pairs once nothing references them, and trustpoints CertKit didn't create are left alone.
Alert on failure. A failed deployment emails the agent's alert list with the router's output, so you see the exact command IOS XE rejected.
Audit every change. Every issuance, renewal, and deployment is logged. With certificate lifetimes heading to 47 days, that log is your compliance record.

Setup takes about ten minutes

Connect your domain. Add a one-time CNAME record to delegate DNS validation to CertKit.
Create an SSH account. A local account with privilege 15 on a router in autonomous mode, allowed to run tclsh. Make sure the router's clock is set by NTP.
Install the CertKit Agent. One command on a Windows host that can reach the router over SSH, plus the Posh-SSH PowerShell module for all users.
Add the Cisco CUBE deployment script. Choose the CUBE SIP TLS template, then enter the router, the credentials, and the CUBE setting that holds the certificate: tls-profile 100, default, or a remote-addr.

See the full architecture →

Why each renewal gets its own trustpoint

Swapping certificates inside the trustpoint CUBE is using leaves no fallback if the import goes wrong. CertKit imports each renewal into a new trustpoint named for the certificate's thumbprint and confirms the router reports the right fingerprint. Only then does CUBE switch. If anything fails before that point, CUBE keeps presenting the previous certificate.

Cleanup has its own trap. IOS XE's HTTPS server picks a trustpoint on its own when ip http secure-trustpoint isn't set, and nothing in the running configuration shows which one. Before deleting an old trustpoint, the agent checks show ip http server secure status as well as the configuration, so a trustpoint something still uses stays until a later run.

Cisco CUBE is just one part of your network edge

Most networks have more than one place where TLS certificates live: firewalls like Cisco Firepower, Juniper SRX, and Fortinet, the Cisco ISE cluster handling network access control, and load balancers like F5 BIG-IP. CertKit automates all of it from one account.

See all integrations

Start automating Cisco CUBE certificates today

Free 90-day trial. No credit card required. Direct access to our engineering team to get you set up.

Start free trial See pricing