Avaya 1110 Fundamentals page 406

X.509 Certificates
EAP-TLS. If EAP-TLS is enabled, the SCEP client on the phone requests a device certificate
using the following process:
1. The phone sends a GetCACert request to the SCEP server.
2. The SCEP server responds with the CA certificate.
3. If the CA certificate is not already on the phone, the fingerprint computes and
4. The phone creates a certificate request using the CA certificate and a locally
5. The phone sends PKCSReq to the SCEP server which includes the certificate
6. The SCEP server responds with either a failure status or with a properly signed
7. If a device certificate returns, it installs on the phone.
Important:
After the EAP-TLS CA root certificate installs on the phone during the SCEP process,
installable customer files (Security Policy, Certificates, Device Configuration) must be signed
or they reject.
If you use the same CA for EAP-TLS and for the file signing, which Avaya recommends, it is
not necessary to install any other certificates. This means that you are not required to add
[USER_KEYS] to the configuration file. However, if EAP-TLS is not configured, use
[USER_KEYS] to install a CA root certificate rather than SCEP.
If you use different CAs for EAP-TLS and file signing, it is necessary to install the CA root
certificate for file signing on the phone, as well. In this case, the order in which you perform
the configuration is important. If the EAP-TLS CA root certificate is installed first using SCEP,
it is necessary to install the file signing CA root certificate on the phone by signing it with a
certificate from the EAP-TLS certificate chain. Otherwise, it is not possible to install the file
signing root certificate on the phone.
Avaya recommends that you install the file signing certificate first because no additional
requirements are imposed on the installation of the EAP-TLS certificate, provided it is retrieved
using SCEP.
406 IP Deskphones Fundamentals
displays.
a. The user must accept or reject the fingerprint.
b. If the user rejects the fingerprint, the SCEP process terminates.
c. If the user accepts the fingerprint, the CA certificate permanently stores
on the phone.
The EAP-TLS CA root certificate permanently installs on the phone if it is accepted.
If the SCEP process is performed at a later date (for example, the device certificate
request failed the first time), then the user is not prompted to accept the CA root
certificate because it is already on the phone and is trusted.
generated private key.
request.
device certificate.
Comments? infodev@avaya.com
February 2013