Certificate Management; Manual Installation - Cisco 8821 Manual

• Prior to selecting Import, browse to the template to be applied and enter the Encryption Key that was specified during
the template export process previously.
• The Cisco Wireless IP Phone 8821 and 8821-EX will need to be restarted after the template is uploaded.

Certificate Management

As of the 11.0(2) release for the Cisco Wireless IP Phone 8821 and 8821-EX, X.509 digital certificates can be utilized for EAP-
TLS or to enable Server Validation when using PEAP-GTC or PEAP-MSCHAPV2.
A User Certificate can be installed either automatically via Simple Certificate Enrollment Protocol (SCEP) or manually via the
phone's admin webpage interface (https://x.x.x.x:8443).
A Server Certificate can be installed either automatically via Simple Certificate Enrollment Protocol (SCEP), manually via the
phone's admin webpage interface (https://x.x.x.x:8443), or via TFTP download.
The TFTP download method can help when the RADIUS servers are issued certificates from a different CA chain than the CA
chain used for issuing client certificates or if wanting to quickly enable Server Validation for PEAP.
To install a Server Certificate via the TFTP download method, rename the Root CA certificate to WLANRootCA.cer then
copy it to the CUCM TFTP servers and restart the TFTP service for those CUCM servers.
Only 1 certificate per type is allowed; 1 user certificate and 1 server certificate.
Once a certificate is installed, Server Validation is automatically enabled if configured for EAP-TLS, PEAP-GTC, or PEAP-
MSCHAPV2.
Microsoft® Certificate Authority (CA) servers are recommended. Other CA server types may not be completely interoperable
with the Cisco Wireless IP Phone 8821 and 8821-EX.
Both DER and Base-64 (PEM) encoding are acceptable for the client and server certificates.
Certificates with a key size of 1024, 2048, and 4096 are supported.
Ensure the client and server certificates are signed using either the SHA-1 or SHA-256 algorithm, as the SHA-3 signature
algorithms are not supported.
Ensure Client Authentication is listed in the Enhanced Key Usage section of the user certificate details.

Manual Installation

For out of box (factory reset) manual installation, the admin webpage interface is Enabled, the username is fixed to admin, and
the password is temporarily set to Cisco.
The temporary password will no longer be available once the phone registers to Cisco Unified Communications Manager.
The admin webpage interface will be Disabled on the phone once it registers to Cisco Unified Communications Manager
regardless if it contains support for the Web Admin and Admin Password options.
Cisco Wireless IP Phone 8821 and 8821-EX Wireless LAN Deployment Guide
150