Enabling Certificate Support; Activating Eap-Tls For Authentication - Avaya 9608 Administrator's Manual

Administering Deskphone Options

Enabling certificate support

You can use Simple Certificate Enrollment Protocol (SCEP) to provide an identity certificate for use
with certificate-based VPN authentication methods. The 802.1x EAP-TLS method also uses the
identity certificate for authentication. When you use TLS with HTTPS, you can use the identity
certificate to authenticate the phone and save the agent greetings or perform a backup or restore.
The phone stores the identity certificate and the phone uses the identity certificate during the TLS
handshake as required when the phone is acting as a server. When the phone is acting as a client,
the phone transmits the identity certificate on request. The 9600 Series IP Deskphones support
Media Encryption (SRTP) and use built-in Avaya certificates for trust management. Trust
management includes downloading certificates and managing policies for additional trusted
Certificate Authorities (CA). Simple Certificate Enrollment Protocol (SCEP) handles identity
management with phone certificates and private keys. You can apply SCEP to your VPN operation
or to standard enterprise network operation.
Before you begin
For SCEP servers that are outside the corporate firewall, configure the phones that use a VPN
connection to establish an SCEP connection through an HTTP proxy server to reach the SCEP
server. In this instance, use the WMLPROXY system parameter to configure the HTTP proxy server.
When the phone initiates SCEP, the phone attempts to contact an SCEP server through HTTP,
using the value of the configuration parameter MYCERTURL as the URI. SCEP supports an HTTP
proxy server. The phone creates a private/public key pair, where the length of each key is equal to
the value of the configuration parameter MYCERTKEYLEN. The certificate request uses the public
key and the values of the configuration parameters MYCERTCAID, MYCERTCN, MYCERTDN, and
SCEPPASSWORD.
About this task
You must configure the 46xxsettings.txt file on the file server with the specified parameters to use an
identity certificate to authenticate the phones.
Procedure
Configure the following parameters in the 46xxsettings.txt file:
• SET MYCERTURL < URL for enrolling with a SCEP fronted Certificate Authority> for
example, http://149.49.44.53/certsrv/mscep/mscep.dll.
• SET MYCERTCN $MACADDR.
• SET MYCERTWAIT 1.
• SET TRUSTCERTS &"root_ certificate".

Activating EAP-TLS for authentication

Before you begin
To activate the 802.1x EAP-TLS mode, you must "SET DOT1XEAPS TLS on the 46xxsettings.txt
file of the file server.
Administering 9608/9608G/9611G/9621G/9641G IP Deskphones H.323
94
Comments? infodev@avaya.com
June 2014