SIP User's Manual
72
Document #: LTRT-12804
Mediant 800 MSBG
3.
In the 'Certificates Files' group, click the
Browse
button corresponding to 'Send
"Trusted Root Certificate Store" file ...', navigate to the file, and then click
Send File
.
4.
When the operation is complete, set the HTTPSRequireClientCertificate
ini
file
parameter to 1.
5.
Save the configuration (see ''Saving Configuration'' on page
), and then restart the
device.
When a user connects to the secured Web server:
If the user has a client certificate from a CA that is listed in the Trusted Root Certificate
file, the connection is accepted and the user is prompted for the system password.
If both the CA certificate and the client certificate appear in the Trusted Root
Certificate file, the user is not prompted for a password (thus, providing a single-sign-
on experience - the authentication is performed using the X.509 digital signature).
If the user doesn’t have a client certificate from a listed CA, or doesn’t have a client
certificate at all, the connection is rejected.
Notes:
•
The process of installing a client certificate on your PC is beyond the
scope of this document. For more information, refer to your Web browser
or operating system documentation, and/or consult your security
administrator.
•
The root certificate can also be loaded via
ini
file using the parameter
HTTPSRootFileName.
•
You can enable Online Certificate Status Protocol (OCSP) on the device
to check whether a peer's certificate has been revoked by an OCSP
server. For further information, refer to the
Product Reference Manual
.
3.3.1.5.3 Self-Signed Certificates
The device is shipped with an operational, self-signed server certificate. The subject name
for this default certificate is 'ACL_nnnnnnn', where
nnnnnnn
denotes the serial number of
the device. However, this subject name may not be appropriate for production and can be
changed while still using self-signed certificates.
¾
To change the subject name and regenerate the self-signed certificate:
1.
Before you begin, ensure the following:
•
You have a unique DNS name for the device (e.g.,
dns_name.corp.customer.com). This name is used to access the device and
should therefore, be listed in the server certificate.
•
No traffic is running on the device. The certificate generation process is disruptive
to traffic and should be executed during maintenance time.
2.
Open the ‘Certificates’ page (see ''Server Certificate Replacement'' on page
3.
In the 'Subject Name' field, enter the fully-qualified DNS name (FQDN) as the
certificate subject, and then click
Generate Self-signed
; after a few seconds, a
message appears displaying the new subject name.
4.
Save configuration (see ''Saving Configuration'' on page
), and then restart the
device for the new certificate to take effect.
Summary of Contents for Mediant 800 MSBG
Page 2: ......
Page 366: ...SIP User s Manual 366 Document LTRT 12804 Mediant 800 MSBG Reader s Notes ...
Page 372: ...SIP User s Manual 372 Document LTRT 12804 Mediant 800 MSBG Reader s Notes ...
Page 390: ...SIP User s Manual 390 Document LTRT 12804 Mediant 800 MSBG Reader s Notes ...
Page 404: ...SIP User s Manual 404 Document LTRT 12804 Mediant 800 MSBG Reader s Notes ...
Page 616: ...SIP User s Manual 616 Document LTRT 12804 Mediant 800 MSBG Reader s Notes ...
Page 636: ...SIP User s Manual 636 Document LTRT 12804 Mediant 800 MSBG Reader s Notes ...
Page 652: ...SIP User s Manual 652 Document LTRT 12804 Mediant 800 MSBG Reader s Notes ...
Page 886: ...SIP User s Manual 886 Document LTRT 12804 Mediant 800 MSBG Reader s Notes ...