Scep Support - Konftel 800 Installation & Administration

SECURITY AND PROTECTION
The conference phone supports the same mandatory crypto
AES_256_CM_HMAC_SHA1_80 when
are disabled.
When the administrator disables
, Konftel 800 supports AES_CM_128_HMAC_SHA1_80 for media
Encryption
encryption with SRTP.

SCEP SUPPORT

Konftel 800 supports Simple Certificate Enrollment Protocol (SCEP) required for
managing digital certificate obtainment. SCEP is used to contact a SCEP server to
get an Identity certificate. The device uses this certificate for all TLS connections
if they do not have manually configured certificates (SIP TLS, 802.1x EAP-TLS,
Provisioning via TLS, LDAP). You can also obtain a CA certificate if the SCEP
server has corresponding configurations.
SCEP enrollment
You can configure SCEP through the web interface and importing the
configuration file with the specific SCEP settings. After Konftel 800 reboots, it
attempts to connect the specified SCEP server. If the server is reachable, it
provides the certificates with the settings matching the server configuration. If
the received certificate is valid and the SCEP enrollment is successful, the phone
saves the configuration and reboots.
When the device requests an SCEP server to get or renew a certificate, the
request must be approved. The following types of request approval are available:
• Manual approval. The SCEP server receives your request, and then the SCEP
server administrator must approve it. The next request of the device results in
the certificate provision.
• Automatic approval. The SCEP server checks your request for validity, then
if the parameters are accurate, approves the request and sends you the
certificate.
The enrollment fails if the settings configuration on the phone and the server do
not match. Here, Konftel 800 triggers the next enrollment in 24 hours.
If you upload a certificate to the phone through the web interface or using
automatic provisioning only for one connection, for example, for the LDAP
connection, that connection continues to use the configured certificate. Other
connections use the SCEP Identity certificate received from the SCEP server.
and
FIPS Mode
and enables
FIPS Mode
156
Allow Legacy Encryption
Allow Legacy