Definitions

•CAPF:  Certificate Authority Proxy Function

•CA: Certificate Authority

•CuCM Mixed mode: this mode allows the CuCM to handle secure and no-secure communication

•Manufacturer Installed Certificate (MIC): Manufacturer Installed Certificates (MICs) are client certificates and included on all 7941, 7961 and newer model Cisco IP phones. MICs are 2048-bit key certificates that are signed by the Cisco CA. When a MIC is present it is not necessary to install a Locally Significant Certificate (LSC). In order for the Cisco Unified Communications Manager to trust the MIC certificate, it utilizes the pre-installed CA certificates CAP-RTP-001, CAP-RTP-002, and Cisco Manufacturing_CA in its certificate trust store.

•A Locally Significant Certificate (LSC) is a client certificate and must be installed on the Cisco IP phone utilizing USB tokens and the certificate trust list (CTL) client (illustrated above). The LSC possesses the public key for the Cisco IP phone, which is signed by the Cisco Unified Communications Manager Certificate Authority Proxy Function (CAPF) private key (illustrated above). This is the preferred method (as opposed to using MICs) because only Cisco IP phones that are manually provisioned by an administrator will be allowed to download and verify the CTL file (illustrated below). Older Cisco IP phones, such as the 7940 and 7960, do not contain MICs. Cisco IP phones require an LSC to operate in secure mode

•TPO Alpha node: TPO  with the lowest order which manage all certificate operations