Avaya 1110 Fundamentals page 404

X.509 Certificates
phone. Avaya recommends that you place the [USER_KEYS] section before all sections so
that subsequent downloads do not fail.
Avaya supplied files are always signed. You can specify TFTP, HTTP, or FTP protocol. You
can specify more than one FILENAME although be careful when you use this feature with
certificates as only the first certificate file can download unsigned. The asterisk (*) in the Device
Configuration filename indicates that when the phone attempts to download the file, it
substitutes the "*" with the MAC address of the phone. This allows phone-specific configuration
files but if a customer root certificate is installed, all phone-specific files must be signed, as
well. For the special case of certificate download ([USER_KEYS]), the VERSION is required
but it is not actually used. The certificate(s) always downloads, however, if the certificate
already exists in the phone, it does not save. The VERSION is ignored because the certificate
completely identifies itself and its version internally. This allows the same configuration file to
be used even after the customer root certificate is installed.
Security Policy
The Security Policy defines some optional elements of certificate management and defines
the authentication procedure for some (but not all) unsigned installable customer files.
You can download a Security Policy to the phone using the [SEC_POLICY] section in the
configuration file. An example Security Policy is shown in
page 404. If a customer certificate does not exist, accept the security policy file by confirming
a displayed fingerprint. If a customer certificate exists, the Security Policy file must be signed
and authenticated before it can update.
Table 88: Security policy
default values.
Table 88: Security policy
SEC_POLICY_ACCEPT
CUST_CERT_ACCEPT
CERT_EXPIRE
Table 89: Security Policy parameters
parameters.
Table 89: Security Policy parameters
Security parameter
SEC_POLICY_ACCEPT
404 IP Deskphones Fundamentals
on page 404 provides an example of the security policy and the
VAL_MANUAL_A
VAL_MANUAL_A
LOG_EXPIRE
on page 404 provides a description of the Security Policy
This parameter defines how an unsigned Security Policy
(SEC_POLICY) authenticates when downloaded to a phone
with no customer certificate installed. If a customer certificate
is installed on the phone, the Security Policy file must be
signed and this parameter has no effect.
Comments? infodev@avaya.com
Table 88: Security policy
Description
on
February 2013