Self-Signed Certificates - AudioCodes Mediant 1000 User Manual

SIP User's Manual
5.9.4.3

Self-Signed Certificates

The gateway is shipped with a operational, self-signed server certificate. The subject name
for this default certificate is 'ACL_nnnnnnn', where nnnnnnn denotes the serial number of
the gateway. However, this subject name may not be appropriate for production and can
be changed while still using self-signed certificates.
To change the subject name and regenerate the self-signed
certificate, take these steps:
1. Before you begin, ensure the following:
•
You have a unique DNS name for the gateway (e.g.,
dns_name.corp.customer.com). This name is used to access the gateway and
should therefore, be listed in the server certificate.
•
No traffic is running on the gateway. The certificate generation process is
disruptive to traffic and should be executed during maintenance time.
2. Open the 'Certificates' screen (Advanced Configuration menu > Security Settings
submenu > Certificates option); the 'Certificates Signing Request' screen is displayed
(refer to 'Server Certificate Replacement' on page 228).
3. In the 'Subject Name' field, enter the fully-qualified DNS name (FQDN) as the
certificate subject, and then click Generate Self-signed; after a few seconds, a
message appears displaying the new subject name.
4. Save configuration (refer to 'Saving Configuration' on page 278), and then restart the
device for the new certificate to take effect.
Alternatively, the self-signed server certificate may be regenerated (e.g., using the subject
name "dns_name.corp.customer.com"), using the CLI command CertificateMgmt (CM) in
the CONFiguration directory:
/> /CONF/CM GENERATE dns_name.corp.customer.com
To export the current server certificate to a file using Microsoft
Internet Explorer, take these 6 steps:
1. Access the gateway's Embedded Web Server.
2. Double-click the yellow padlock icon displayed at the bottom of the Browser's window.
3. Select the 'Details' tab, and then click Copy to file.
4. Click Next, select 'Base64-encoded X.509', and then click Next.
5. Select a file name, and then click Next.
6. Click Finish; the certificate is saved to the selected file name.
To export the current server certificate using CLI, type: /> /CONF/CM GETCERT
The server certificate is displayed in base64-encoded PEM format.
Version 5.2 231
5. Web-based Management
September 2007