Secure Resync; Basic Https Resync - Linksys SPA2102-AU Provisioning Manual

Chapter 3 Provisioning Tutorial
http://192.168.1.200/basic.txt
Step 5
Observe the syslog messages sent by the SPA.
The periodic resyncs should now be obtaining the profile from the HTTP server.
Also, the server should be logging each request if connection logging is enabled in the server
configuration.
Step 6
In the HTTP server logs, observe how information identifying the test SPA appears in the log of user
agents.
This should include the SPA manufacturer, product name, current firmware version, and serial number.

Secure Resync

This section demonstrates the preferred mechanisms available on the SPA for securing the provisioning
process. It includes the following topics:
•
•
•

Basic HTTPS Resync

HTTPS adds SSL to HTTP for remote provisioning so that:
•
•
•
SSL generates and exchanges secret (symmetric) keys for each connection between the SPA and the
server, using public/private key pairs preinstalled in the SPA and the provisioning server.
On the client side, using HTTPS (with the GET method), simply requires changing the definition of the
URL in the Profile_Rule parameter from http to https. On the server side, the service provider must
install and set up the HTTPS server.
In addition, an SSL server certificate signed by Linksys must be installed on the SPA provisioning server.
The SPA devices cannot resync to a server using HTTPS, unless the server supplies a Linksys-signed
server certificate.
Exercise
Step 1
Install an HTTPS server on a host whose IP address is known to the network DNS server, through normal
hostname translation.
The open source Apache server can be configured to operate as an HTTPS server, when installed with
the open source mod_ssl package.
Step 2
Generate a server Certificate Signing Request for the server.
Version 3.0
Basic HTTPS Resync, page 3-7
HTTPS With Client Certificate Authentication, page 3-9
HTTPS Client Filtering and Dynamic Content, page 3-9
The SPA can authenticate the provisioning server
The provisioning server can authenticate the SPA
The confidentiality of information exchanged between the SPA and the provisioning server is
ensured through encryption
Secure Resync
Linksys SPA Provisioning Guide
3-7