Scep Setup; Configure The Scep Product Specific Configuration Parameters; Simple Certificate Enrollment Protocol Server Support - Cisco 8821 Administration Manual

Configuration on the Phone
Procedure
Step 1 From the phone administration web page, select Certificates.
Step 2 Locate the certificate on the Certificates page.
Step 3 Click Delete.
Step 4 Restart the phone after the deletion process completes.

SCEP Setup

Simple Certificate Enrollment Protocol (SCEP) is the standard for automatically provisioning and renewing
certificates. It avoids manual installation of certificates on your phones.

Configure the SCEP Product Specific Configuration Parameters

You must configure the following SCEP parameters on your phone web page
• RA IP address
• SHA-1 or SHA-256 fingerprint of the root CA certificate for the SCEP server
The Cisco IOS Registration Authority (RA) serves as a proxy to the SCEP server. The SCEP client on the
phone use the parameters that are downloaded from Cisco Unified Communication Manager. After you
configure the parameters, the phone sends a SCEP getcs request to the RA and the root CA certificate is
validated using the defined fingerprint.
Procedure
Step 1 From the Cisco Unified Communications Manager Administration, select Device > Phone.
Step 2 Locate the phone.
Step 3 Scroll to the Product Specific Configuration Layout area.
Step 4 Check the WLAN SCEP Server check box to activate the SCEP parameter.
Step 5 Check the WLAN Root CA Fingerprint (SHA256 or SHA1) check box to activate the SCEP QED parameter.

Simple Certificate Enrollment Protocol Server Support

If you are using a Simple Certificate Enrollment Protocol (SCEP) server, the server can automatically maintain
your user and server certificates. On the SCEP server, configure the SCEP Registration Agent (RA) to:
• Act as a PKI trust point
• Act as a PKI RA
• Perform device authentication using a RADIUS server
Cisco Wireless IP Phone 8821 and 8821-EX Administration Guide for Cisco Unified Communications Manager
SCEP Setup
75