Self-Signed Certificates; Tls Server Certificate Expiry Check - AudioCodes MP-11x User Manual

User's Manual
10.4

Self-Signed Certificates

The device is shipped with an operational, self-signed server certificate. The subject name
for this default certificate is 'ACL_nnnnnnn', where nnnnnnn denotes the serial number of
the device. However, this subject name may not be appropriate for production and can be
changed while still using self-signed certificates.

To change the subject name and regenerate the self-signed certificate:
1. Before you begin, ensure the following:
•
You have a unique DNS name for the device (e.g.,
dns_name.corp.customer.com). This name is used to access the device and
should therefore, be listed in the server certificate.
•
No traffic is running on the device. The certificate generation process is disruptive
to traffic and should be executed during maintenance time.
2. Open the Certificates page (see 'Replacing the Device's Certificate' on page 111).
3. In the 'Subject Name [CN]' field, enter the fully-qualified DNS name (FQDN) as the
certificate subject, select the desired private key size (in bits), and then click Generate
self-signed; after a few seconds, a message appears displaying the new subject
name.
4. Save the configuration with a device reset (see 'Saving Configuration' on page 366)
for the new certificate to take effect.
10.5

TLS Server Certificate Expiry Check

The device can periodically check the validation date of the installed TLS server certificate.
This periodic check interval is user-defined. In addition, within a user-defined number of
days before the installed TLS server certificate expires, the device can be configured to
send the SNMP trap, acCertificateExpiryNotifiaction to notify of the impending certificate
expiration.

To configure TLS certificate expiry checks and notification:
1. Open the Certificates page (see 'Replacing the Device's Certificate' on page 111).
2. In the 'TLS Expiry Check Start' field, enter the number of days before the installed TLS
server certificate is to expire at which the device must send a trap to notify of this.
3. In the 'TLS Expiry Check Period' field, enter the periodical interval (in days) for
checking the TLS server certificate expiry date. By default, the device checks the
certificate every 7 days.
4. Click the Submit TLS Expiry Settings button.
Version 6.6
Figure 10-4: TLS Expiry Settings Group
115
10. Configuring Certificates
MP-11x & MP-124