Signing A Resource File - Avaya 1230 Administration

Certificate-based authentication
CUST_CERT_ACCEPT, the user can either be prompted to accept this fingerprint, or
prompted to enter the fingerprint for verification.
- If there is one or more customer root certificate on the IP Deskphone, the certificate file must
be digitally signed with a signing certificate. In this case, there is no interaction with the user.
The signature is internally verified and the signing certificate is verified to be issued by a
customer root certificate that is already installed on the IP Deskphone.
• If the authentication of the file is successful, the customer root certificate is installed on the IP
Deskphone in the trusted certificate store.
Important:
Although the certificate file usually contains a single customer root certificate, it is possible that
the certificate file may contain more than one certificate and CRL. This occurs where the PEM
encoding for each certificate or CRL is appended in the file with a blank line between each file. If
the authenticity of the file is successfully verified, all entities in the file are installed on the IP
Deskphone.
When the IP Deskphone tries to establish a secure connection (for example, HTTPS, SIP TLS) with
a server, the server provides its certificate which then must be verified by the IP Deskphone.
The following are the possible configurations (depending on the server configuration):
1. Server can provide only its Server certificate.
2. Server can provide the entire certificate chain (up to the Root CA certificate).
In the first scenario, the IP Deskphone only needs the CA certificate which was used to sign the
Server certificate. The certificate file must be PEM encoded.
In the second scenario, every certificate in the chain must be verified. Root and Intermediate CA
certificates of the chain must be installed in the IP Deskphone Trusted Certificates store. Certificates
must be PEM encoded and combined into one file.

Signing a resource file

The following is the command to sign a resource file using openssl .
openssl smime –sign –in unsigned_file –signer sign_cert_file –outform PEM
–binary –inkey sign_cert_pk_file –out tmp_signature_file
The first customer root certificate must either be signed by a Avaya Trusted Certificate or Fingerprint
accepted. To control further signing of a customer root certificate, and prevent security risks, the
following Security Policy parameter must be configured.
CUST_CERT_ACCEPT — VAL_NO_CHECK
SIP Software for Avaya 1200 Series IP Deskphones-Administration
246
Comments? infodev@avaya.com
March 2015