Administrator’s Guide for W60P/W53P/W41P DECT Phones
192
l
EXP-DES-CBC-SHA
l
EXP-RC2-CBC-MD5
l
EXP-RC4-MD5
l
ECDHE
Supported Trusted and Server Certificates
The IP phone can serve as a TLS client or a TLS server. In TLS feature, we use the terms trusted and server certificate.
These are also known as CA and device certificates.
The TLS requires the following security certificates to perform the TLS handshake:
l
Trusted Certificate
: When the IP phone requests a TLS connection with a server, the IP phone should verify the cer-
tificate sent by the server to decide whether it is trusted based on the trusted certificates list. The IP phone has 76
built-in trusted certificates. You can upload 10 custom certificates at most. The format of the trusted certificate files
must be *.pem,*.cer,*.crt and *.der and the maximum file size is 5MB.
l
Server Certificate
: When clients request a TLS connection with the IP phone, the IP phone sends the server cer-
tificate to the clients for authentication. The IP phone has two types of built-in server certificates: a unique server
certificate and a generic server certificate. You can only upload one server certificate to the IP phone. The old server
certificate will be overridden by the new one. The format of the server certificate files must be *.pem and *.cer and
the maximum file size is 5MB.
A unique server certificate
: It is unique to an IP phone (based on the MAC address) and issued by the Yealink Cer-
tificate Authority (CA).
A generic server certificate
: It is issued by the Yealink Certificate Authority (CA). Only if no unique certificate exists,
the IP phone may send a generic certificate for authentication.
The IP phone can authenticate the server certificate based on the trusted certificates list. The trusted certificates list and
the server certificates list contain the default and custom certificates. You can specify the type of certificates the IP
phone accepts: default certificates, custom certificates or all certificates.
Common Name Validation feature enables the IP phone to mandatorily validate the common name of the certificate
sent by the connecting server. The Security verification rules are compliant with RFC 2818.
Note
Resetting the IP phone to factory defaults will delete custom certificates by default. However, this feature is configurable by
the parameter “static.phone_setting.reserve_certs_enable” using the configuration file.
Topic
Supported Trusted Certificates
Supported Trusted Certificates
Yealink IP phones trust the following CAs by default:
l
DigiCert High Assurance EV Root CA
l
Deutsche Telekom Root CA 2
l
Equifax Secure Certificate Authority
l
Equifax Secure eBusiness CA-1
l
Equifax Secure Global eBusiness CA-1
l
GeoTrust Global CA
l
GeoTrust Global CA2
l
GeoTrust Primary Certification Authority
l
GeoTrust Primary Certification Authority G2
Summary of Contents for W60P Telesystem
Page 1: ......
Page 18: ...Table of Contents 11 Appendix 255 RFC and Internet Draft Support 255...
Page 19: ...Administrator s Guide for W60P W53P W41P DECT Phones 12...
Page 47: ...40 Administrator s Guide for W60P W53P W41P DECT Phones...
Page 73: ...66 Administrator s Guide for W60P W53P W41P DECT Phones...
Page 123: ...116 Administrator s Guide for W60P W53P W41P DECT Phones...
Page 125: ...118 Administrator s Guide for W60P W53P W41P DECT Phones...
Page 139: ...132 Administrator s Guide for W60P W53P W41P DECT Phones...
Page 171: ...164 Administrator s Guide for W60P W53P W41P DECT Phones...
Page 193: ...186 Administrator s Guide for W60P W53P W41P DECT Phones...
Page 227: ...220 Administrator s Guide for W60P W53P W41P DECT Phones...
Page 253: ...246 Administrator s Guide for W60P W53P W41P DECT Phones...
Page 261: ...254 Administrator s Guide for W60P W53P W41P DECT Phones...
