RADVision Scopia TIP Gateway Deployment Manual page 56

Figure 37: Signature of Scopia Management Certificate from Unknown CA
When CA3 is untrusted by the gateway
from Unknown CA
–
–
–
–
On the gateway side, the certificates to be uploaded are
Management Certificate from Unknown CA
–
–
–
• Mutually unknown CAs
In the final scenario, both components use certificates signed by CA's which are not recognized by
each other. In this case, there needs to be two intermediate certificates, one for each of the
untrusted CAs, to vouch for their authenticity.
For example, in
the certificate identifying the gateway is signed by CA4, an unknown CA, while Scopia
Management's certificate is signed by CA3, also untrusted. This would require five certificates to be
uploaded to Scopia Management and three for the gateway
Certificates are from Untrusted CAs
Deployment Guide for Scopia TIP Gateway Version 8.2
on page 56), the certificates to upload to the Scopia Management are:
A certificate identifying Scopia Management, signed by CA3, a CA unknown to the gateway.
This is sent to the gateway as part of the TLS negotiation.
An intermediate certificate vouching for the trustworthiness of CA3, signed by trusted CA1.
This is used to trust Scopia Management's identity certificate, which is signed by CA3.
A root certificate from CA1 verifying CA1's identity, self-signed by trusted CA1. This is used
by Scopia Management to authenticate the intermediate certificate, which was signed by
CA1.
A root certificate from CA2 verifying CA2's identity, self-signed by trusted CA2. This is used
by Scopia Management to authenticate the gateway's certificate, which is signed by CA2.
A certificate identifying the gateway, signed by trusted CA2. This certificate is sent to Scopia
Management as part of the TLS negotiation.
An intermediate certificate vouching for the trustworthiness of CA3, signed by trusted CA1.
This is used to trust Scopia Management's identity certificate, which is signed by CA3.
A root certificate from CA1 verifying CA1's identity, self-signed by trusted CA1. This is used
by the gateway to verify the intermediate certificate, which is signed by CA1.
Figure 38: Signature of Both Certificates are from Untrusted CAs
(Figure 37: Signature of Scopia Management Certificate
(Figure 37: Signature of Scopia
on page 56):
(Figure 38: Signature of Both
on page 57).
Securing Your Video Network Using TLS | 56
on page 57,