Cisco SPA1112 Provisioning Manual page 54

Provisioning Examples
Secure HTTPS Resync
STEP 1
STEP 2
STEP 3
STEP 4
Provisioning Guide for Cisco SPA100 and SPA200 Series Analog Telephone Adapters
On the client side, the ATA does not require any special configuration setting on
the server to be able to resync using HTTPS. The Profile_Rule parameter syntax
for using HTTPS with the GET method is similar to the syntax used for HTTP or
TFTP. If a standard web browser can retrieve a profile from a your HTTPS server,
the ATA should be able to do so as well.
In addition to installing a HTTPS server, a SSL server certificate signed by Cisco
must be installed on the provisioning server. The devices cannot resync to a
server using HTTPS unless the server supplies a Cisco-signed server certificate.
Instructions for creating signed SSL Certificates for SPA Voice products can be
found at https://supportforums.cisco.com/docs/DOC-9852.
Exercise
Install an HTTPS server on a host whose IP address is known to the network DNS
server through normal hostname translation.
The open source Apache server can be configured to operate as an HTTPS
server when installed with the open source mod_ssl package.
Generate a server Certificate Signing Request for the server. For this step, you
might need to install the open source OpenSSL package or equivalent software. If
using OpenSSL, the command to generate the basic CSR file is as follows:
openssl req –new –out provserver.csr
This command generates a public/private key pair, which is saved in the
privkey.pem file.
Submit the CSR file (provserver.csr) to Cisco for signing. (See https://
supportforums.cisco.com/docs/DOC-9852 for more information.) A signed server
certificate is returned (provserver.cert) along with a Sipura CA Client Root
Certificate, spacroot.cert.
Store the signed server certificate, the private key pair file, and the client root
certificate in the appropriate locations on the server.
In the case of an Apache installation on Linux, these locations are typically as
follows:
# Server Certificate:
SSLCertificateFile /etc/httpd/conf/provserver.cert
# Server Private Key:
SSLCertificateKeyFile /etc/httpd/conf/pivkey.pem
# Certificate Authority:
SSLCACertificateFile /etc/httpd/conf/spacroot.cert
4
54