VCS' certificates for transversal zone / unable to to connect to server TLS negotiation failure

Question

Hi,
I am trying to connect two traversal zones VCSE as a server and VCSC as a client but i am having the next error:
VCSE:
tvcs: Event="Inbound TLS Negotiation Error" Service="SIP" Src-ip="10.1.1.1" Src-port="25234" Dst-ip="10.1.1.10" Dst-port="7001" Detail="tlsv1 alert unknown ca" Protocol="TLS" Level="1" UTCTime="2015-01-28 18:51:09,080"
VCSC:
2015-01-28T14:32:09-04:30tvcs: Event="Outbound TLS Negotiation Error" Service="SIP" Src-ip="192.168.1.2" Src-port="25267" Dst-ip="10.1.1.10" Dst-port="7001" Detail="unable to get local issuer certificate" Protocol="TLS" Common-name="name-vcse.myname.com" Level="1" UTCTime="2015-01-28 19:02:09,081"
I follow the steps in this document: "http://www.cisco.com/c/dam/en/us/td/docs/telepresence/infrastructure/vcs/config_guide/X8-2/Cisco-VCS-Certificate-Creation-and-Use-Deployment-Guide-X8-2.pdf" and trying with Windows Server Authentication and Client Authentication and with OpenSSL but have the same results.
In my firewall i can telnet the 10.1.1.10 port 7001 and also from a device from the network 192.168.1.0 to 10.1.1.10 port 7001 (not firewall issues i think)
Also i tested the certificate in my VCSC and get the following error:
Invalid: The client certificate is not signed by a CA in the trusted CA list. 
Any ideas?
Regards,

Answer 1

Anthony,
You're missing the Certificate Authority certificate who signed one of the servers certs. Presumably what is missing is the CA (root) certificate that signed the Expressway-E's cert. Here is a general rule of thumb.
The certificate of the signer of the VCS-C/Expressway-C certificate should be present on the VCS-E/Expressway-E under the Trusted CA section.
The certificate of the signer of the VCS-E/Expressway-E certificate should be present on the VCS-CExpressway-C under the Trusted CA section.
it's not uncommon that you could be dealing with a condition where one of the servers certs was signed by an intermediate. If this is the case you simply just need to follow the chain of the certificates and make sure they are all included within the Trusted CA list on the respective server. The main thing to look at with the certificates are the Common Names of the Subject and Issuer. Below is an example of a fake certificate.
VCS-E/Expressway-E Cert
Issuer: CN=RootCAIntermediate – G5     <-- Signer
Subject: CN=Expressway-E.domain.com
RootCAIntermediate –G5 Certificate
Issuer: CN=RootCAIntermediate Trust    <-- Signer
Subject: CN=RootCAIntermediate – G5
RootCAIntermediate Trust
Issuer: CN=RootCA   <-- Signer
Subject: CN=RootCAIntermediate Trust
RootCA Certificate
Issuer: CN=RootCA   <-- Signer
Subject: CN=RootCA
If you are missing anyone of these, you will get the unknown CA error. When the RootCA (The real root) is uploaded to the VCS/Expressway server it’s Issuer will be RootCA and the Subject will be “Matches Issuer”.
I hope this can help you.
-P