You are troubleshooting a TLS link down message between Avaya Aura® Session Manager (SM) and Avaya Session Border Controller for Enterprise (SBCE)…

The trace message "Fatal Error Unknown CA" sent by the Avaya Session Border Controller for Enterprise (SBCE) indicates that the SBCE does not trust the Certificate Authority (CA) that signed the identity certificate presented by the Avaya Aura® Session Manager (SM). To resolve this, a two-step process is required on the SBCE. First, the root CA certificate that signed the SM's identity certificate must be installed into the SBCE's certificate trust store. Second, this newly installed CA certificate must be explicitly added to the Peer Verification List within the specific TLS Profile that the SBCE uses for the connection to the SM. Both actions are necessary to establish the trust chain.

A. Install the Certificate Authority certificate that signed SBCE identity certificate into SM.

This action would be required if SM were sending the "Unknown CA" error, but the scenario states the error originates from SBCE.

B. Export the SBCE identity certificate, and import it into SM.

Trust is established by importing the signing CA's certificate, not the peer's identity certificate. This action does not resolve a CA trust issue.

1. Avaya Aura® Communication Manager Documentation Library, "Administering Avaya Session Border Controller for Enterprise," Release 8.1, November 2019.

Section: Certificates, Page 331: This section details the process of managing certificates, including installing Trusted CA certificates. It states, "Use the Certificates page to manage digital certificates, which are used to authenticate network entities. You can install trusted CA certificates..." This supports option C.

Section: Global Profiles > TLS Profiles, Page 178: This section describes the configuration of TLS Profiles. The "Peer Certificate Authorities" parameter is defined as the list of CAs that the SBCE uses to verify the peer's certificate. This supports option D, as the installed CA must be selected here.

2. Avaya Professional Services, "Avaya Aura® 8.0 Feature Pack 1 SMGR/SM/CM/AAM/EMC/ADS/SBCE/WFO on VMware," Deployment Guide, Issue 1.0, December 2018.

Section: Installing ASBCE Certificates, Page 225: The guide explicitly states the procedure: "Install the CA certificate that signed the Session Manager security module certificate on the ASBCE." and subsequently, "Add the CA certificate to the server-interworking TLS profile." This document confirms that both installing the CA certificate (Option C) and adding it to the relevant TLS profile's peer verification list (Option D) are required steps.