Selected Answer: AE I meant to put A & E. Sorry.

Jabber works fine with a private CA, and the ExpC can use a private CA. Those look like the right answers.

answer should be A and D. For C, I think the key word is "can" or "must"

Answer is A and D. Expressway C can use a public/private. Expressway E must use a private

Not really, you can upload the certificate and private key generated by a CA without needing to use a CSR

Selected Answer: AD I agree with the answers below. You can load a cert without a CSR as long as you also load the private key (you do this a lot in clustering), and you can use a private CA on the E as long as you're not going to have physical phones running through it.

I think C & D are right. https://www.cisco.com/c/en/us/support/docs/unified-communications/expressway/213872-configure-and-troubleshoot-collaboration.html

Selected Answer: CD The only server that is really required to be signed by a public CA is the Expressway-E. This is the only server clients will see the certificate from when singing in via MRA, so using a public CA will make sure users do not have to manually accept the certificate. Certificate Generation Overview X.509 certificates may be supplied from a third party, or may be generated by a certificate generator such as OpenSSL or a tool available in applications such as Microsoft Certification Authority. Third-party certificates supplied by recognized certificate authorities are recommended, although Expressway deployments in controlled or test environments can use internally generated certificates. Certificate generation is usually a 3-stage process: ■ Stage 1: generate a private key ■ Stage 2: create a certificate request ■ Stage 3: authorize and create the certificate

Hi Collabinski, your answers are wrong.

Selected Answer: AD A and D.

Whether the cert is public or private, it looks like you have to generate a CSR in Expressway before uploading the file.

https://www.cisco.com/c/dam/en/us/td/docs/voice_ip_comm/expressway/config_guide/X8-9/Cisco-Expressway-Certificate-Creation-and-Use-Deployment-Guide-X8-9.pdf

Selected Answer: AE Which two statements about Mobile and Remote Access certificates are true? (Choose two.) A. Expressway Core can use private CA signed certificate. B. You must upload the root certificates in the phone trust store. C. Expressway must generate certificate signing request. D. Expressway Edge must use public CA signed certificate. E. The Jabber client can work with public or private CA signed certificate.

I think Collabinski is right. C and D are the answers I'd prefer A. Expressway Core can use private CA signed certificate – While technically possible, this is not recommended for MRA, since clients connecting through the Edge would not trust a private CA. E. The Jabber client can work with public or private CA signed certificate – This is only partly true. The Jabber client can trust a private CA signed certificate if the root CA certificate is manually installed on the device, but for MRA via the Edge, a public CA is needed for seamless operation.

i think, you're right.

Selected Answer: AE A. Expressway Core can use a private CA signed certificate. > Yes, it can use a private CA signed cert. But the Exp-E needs to trust it. Is it best practice? I guess not. Bin there, done that. B. You must upload the root certificates in the phone trust store. > Nope C. Expressway must generate certificate signing request. > No, it doesn't have to (must not). I believe you can use a private key generated and provided by a CA, and upload it manually via SCP. D. Expressway Edge must use public CA signed certificate. > No, it must not. It can work with a private CA signed cert. E. The Jabber client can work with public or private CA signed certificate. > Yes, it can. It will prompt the user to trust the certificate presented if the root or intermidiate CA cert is not in the device's trust store. End of story. So A&E correct answers.

Selected Answer: AD it is talking about MRA so you must use Public CA for expressway E and Private CA for Expressway C