Devices & Servers · PBX, unified communications & SBC
Get every node in your voice platform trusted on one certificate
A voice platform is five or six hostnames pretending to be one system, and every one of them presents a certificate. One multi-domain certificate silences the lot, on one renewal date.
- Handsets stop registering and nobody knows whyPhone firmware validates the certificate before it registers. A self-signed or expired one surfaces as a provisioning failure rather than a certificate error, which is why these take days to diagnose.
- One expiry can take the whole cluster downCertificates on separate nodes expire on separate dates. Consolidating them means one date in the calendar instead of six chances to be caught out.
- Every node is a separate nameA three-node UCM cluster with presence and voicemail is six names before you have touched the SBC. They all go on one certificate as subject alternative names.
- Trusted by phone firmware out of the boxCisco, Avaya, Mitel and Polycom firmware ship with the public roots already loaded — no trust store surgery on every handset in the building.
- $196.94from, for the shortest term
- 25% offits list price of $262.58
- 250 nameson a single certificate
- One datefor the whole cluster
Start with the platform you run
Voice systems are the clearest case for a multi-name certificate, because almost none of them are a single host. Pick yours to jump to the option that matches.
- Cisco Unified CM (CUCM) cucm01 · cucm02 · cups A UCM cluster, or a full UC estate →
- Cisco Expressway and VCS expe.acme.com A UCM cluster, or a full UC estate →
- Cisco Unity Connection cuc.acme.com A UCM cluster, or a full UC estate →
- Avaya Aura and Session Manager sm.acme.com A UCM cluster, or a full UC estate →
- Mitel MiVoice mivoice.acme.com A UCM cluster, or a full UC estate →
- 3CX Phone System pbx.acme.com One PBX on one hostname →
- FreePBX, Asterisk, Issabel pbx.acme.com One PBX on one hostname →
- Grandstream UCM ucm.acme.com One PBX on one hostname →
- Yeastar S-Series and P-Series pbx.acme.com One PBX on one hostname →
- Ribbon and Sonus SBC sbc.acme.com Voice plus everything else under one domain →
- AudioCodes Mediant sbc.acme.com Voice plus everything else under one domain →
- Polycom and Yealink provisioning prov.acme.com Voice plus everything else under one domain →
How many hostnames does your voice estate present?
Count the names, not the boxes. A three-node UCM cluster with presence and voicemail is six names before you have touched the SBC.
A UCM cluster, or a full UC estate
This is what unified communications certificates exist for. Every node, presence server, voicemail box and Expressway edge goes on one certificate as a separate subject alternative name, and you upload the same file per service.
Typically: Cisco UCM publisher and subscribers, IM&P, Unity Connection, Expressway, Avaya, Mitel.
Comodo Unified Communications Certificate UCC
The UCC certificate, organisation validated. Built for exactly this job: several names included from the start, room for hundreds, and the company vetting most voice deployments are asked for.
- Organisation validated · issued in 1-3 days
- 5 hostnames included, up to 245 in total
- $250,000 warranty
- Free unlimited reissues for the whole term
Comodo UCC Multi-Domain SSL Certificate
The same multi-name coverage with no company paperwork, so it issues in minutes instead of days. Take this when the deadline is today.
- Domain validated · issued in minutes
- 3 hostnames included, up to 247 in total
- $25,000 warranty
- Free unlimited reissues for the whole term
One PBX on one hostname
A single 3CX, FreePBX, Grandstream or Yeastar box answering on one name needs nothing clever. One domain-validated certificate, issued in minutes, and the web UI plus the provisioning URL stop warning.
Typically: A single-site PBX with one public hostname.
Comodo PositiveSSL Certificate
One hostname, publicly trusted, issued in minutes. Everything a single PBX needs and nothing it does not.
- Domain validated · issued in minutes
- $10,000 warranty
- Free unlimited reissues for the whole term
RapidSSL Certificate
The same coverage on the RapidSSL root, if that is what your provisioning template already expects.
- Domain validated · issued in minutes
- $10,000 warranty
- Free unlimited reissues for the whole term
Voice plus everything else under one domain
If the PBX, the SBC, the provisioning server and your other systems all sit under one domain, a wildcard covers all of them and every host you add later. Read the SIP caveat below before you commit to this route.
Typically: pbx, sbc, prov, and the rest of acme.com on a single file.
Comodo PositiveSSL Wildcard Certificate
Unlimited subdomains of one domain, issued in minutes. One file for the whole voice stack and everything around it.
- Domain validated · issued in minutes
- Covers unlimited subdomains of the domain
- $10,000 warranty
- Free unlimited reissues for the whole term
Comodo EssentialSSL Wildcard Certificate
The same wildcard coverage under a different brand, worth comparing on term price.
- Domain validated · issued immediately
- Covers unlimited subdomains of the domain
- $10,000 warranty
Several sites, several domains, each with subdomains
Multi-site deployments and service providers usually need both at once: distinct domains and unlimited subdomains under each. A multi-domain wildcard is the only shape that does both on one certificate.
Typically: acme.com plus acme.co.uk plus a customer domain, subdomains under each.
Comodo UCC Wildcard Certificate (Unified Communications)
UCC wildcard, organisation validated. Several domains, unlimited subdomains under each, one renewal date for the whole estate.
- Organisation validated · issued in 1-3 days
- Covers unlimited subdomains of the domain
- 3 hostnames included, up to 247 in total
- $250,000 warranty
- Free unlimited reissues for the whole term
PositiveSSL Multi-Domain Wildcard SSL Certificate
The same multi-domain wildcard shape without company vetting, so it costs considerably less and issues far faster.
- Domain validated · issued in minutes
- Covers unlimited subdomains of the domain
- 3 hostnames included, up to 247 in total
- $10,000 warranty
- Free unlimited reissues for the whole term
Voice-specific things that catch people out
Cisco UCM needs the signing request generated on the node
Generate the CSR inside Cisco Unified OS Administration for the service you are certifying — tomcat, callmanager, cup-xmpp — and upload the signed certificate back to that same service. A certificate generated elsewhere will not match the key the node is holding. One certificate can serve several services, provided its subject alternative names cover every hostname involved.
Not every SIP endpoint accepts a wildcard
Browsers and web UIs handle wildcards perfectly. Some phone firmware and some SBC SIP-TLS stacks do not, and will refuse a certificate whose common name is *.acme.com. If your SIP interface is on older firmware, keep an explicit name for it on a multi-domain certificate rather than relying on a wildcard.
Internal cluster names cannot be certified
A great many UCM clusters were built on cucm01.acme.local. No public certificate authority may sign a .local name, and none has been able to since 2015. The nodes need publicly registered names before any certificate on this site will help — they still do not have to be reachable from the internet.
Questions we get asked about this
How many names do I actually need for a Cisco cluster?
One per node that presents a certificate, plus presence, voicemail and any Expressway edge. A three-node cluster with IM&P and Unity is typically six. Count them before you order — adding names later means a reissue, which is free but takes time you may not have.
Can one certificate cover tomcat and callmanager?
Yes, provided the subject alternative names cover every hostname both services answer on. You upload the same signed certificate to each service separately.
Will desk phones trust it?
That is the whole point of using a public certificate authority. The roots behind these products are already in the trust store of current Cisco, Polycom, Yealink and Grandstream firmware, so there is nothing to distribute.
Domain validated or organisation validated for voice?
Either works technically. Organisation validation is what most enterprise voice deployments are asked for because the company name ends up inside the certificate. Domain validation issues in minutes, which matters when a cluster is already warning.
Something else on the network?
The same certificates cover the rest of the estate. These pages start from the hardware rather than from the certificate.
- Firewalls, VPN & routers FortiGate, SonicWall, Palo Alto, pfSense, Cisco ASA
- Voice: PBX, UCM & SBC Cisco UCM, 3CX, FreePBX, session border controllers
- Mail servers & webmail Exchange, autodiscover, Zimbra, smtp, imap
- Intranet & internal apps Staff portals, Jira, GitLab, dashboards, RDS
- NAS, hypervisor & consoles Synology, QNAP, VMware, Proxmox, iLO, iDRAC
- Web & app servers IIS, Apache, Nginx, Tomcat, load balancers
Send us the hostname list and we will price it up
Tell us what each box is and which names it answers on. We come back with the cheapest combination that genuinely covers the estate — and say so if that is fewer certificates than you were about to buy.