Server Certificates; Client Certificates; Obtaining A Server Certificate - Cisco SPA303 Administration Manual

Provisioning Basics
Using HTTPS
STEP 1
STEP 2
Cisco Small Business SPA300 Series, SPA500 Series, and WIP310 IP Phone Administration Guide

Server Certificates

Each secure provisioning server is issued an secure sockets layer (SSL) server
certificate, directly signed by Cisco. The firmware running on the Cisco IP phone
clients recognizes only these certificates as valid. The clients try to authenticate
the server certificate when connecting via HTTPS, and reject any server
certificate not signed by Cisco.
This mechanism protects the service provider from unauthorized access to the
Cisco IP phone endpoint, or any attempt to spoof the provisioning server. This
might allow the attacker to reprovision the Cisco IP phone to gain configuration
information, or to use a different VoIP service. Without the private key
corresponding to a valid server certificate, the attacker is unable to establish
communication with a Cisco IP phone.

Client Certificates

In addition to a direct attack on the Cisco IP phone, an attacker might attempt to
contact a provisioning server using a standard web browser, or other HTTPS
client, to obtain the Cisco IP phone configuration profile from the provisioning
server. To prevent this kind of attack, each Cisco IP phone also carries a unique
client certificate, also signed by Cisco, including identifying information about
each individual endpoint. A certificate authority root certificate capable of
authenticating the device client certificate is given to each service provider. This
authentication path allows the provisioning server to reject unauthorized requests
for configuration profiles.

Obtaining a Server Certificate

To obtain a server certificate:
Contact a Cisco support person who will work with you on the certificate process.
If you are not working with a specific support person, you can email your request
to linksys-certadmin@cisco.com.)
Generate a private key that will be used in a CSR (Certificate Signing Request).
This key is private and you do not need to provide this key to Cisco support. Use
open source "openssl" to generate the key. For example:
openssl genrsa -out <file.key> 1024
6
173