Subject Alternative Field (SAN)
While validating the certificates, the phone verifies whether the presented certificate has a SAN
field or not. The SAN field simplifies the server configuration. With the SAN field, you can specify
additional host names, such as IP addresses or common names, to use a single SSL Certificate.
• If the certificate does not have the SAN field, the phone validates the Common Name (CN)
fields of the certificate. In this case, you need the following CN fields:
-
SIP domain name
-
IP address
• If the certificate has the SAN field, the following attributes for an HTTP-TLS connection are
present:
- Provisioning phone with only an IP address
• In the
SAN
field, IP attribute with IP of HTTPS server is present.
- Provisioning phone with FQDN of HTTPS server
• In the
SAN
field, IP attribute with the IP address of HTTPS server is present.
• DNS attribute with FQDN of HTTPS server.
Note:
While provisioning the phone with the FQDN of HTTPS server, you need two attributes in the
SAN
field:
• DNS attribute with FQDN
• IP attribute IP address
Trusted certificates
Trusted certificates are the root certificates that are used to verify the received certificates. These
certificates are installed on the phone through the http server using settings file and are used to
validate server certificates during a TLS session.
OCSP trust certificates
Online Certificate Status Protocol (OCSP) is used to check the certificate revocation status of an
x509 certificate in use. The phone trusts the OCSP server and installs its CA certificates. These
certificates are called OCSP Trust Certificates.
OCSP Trust Certificates are installed in the same way as those for System Manager. However,
OCSP Trust Certificates use a different parameter name called OCSP_TRUSTCERTS. This
parameter follows the same format as that for TRUSTCERTS.
Certificate management
April 2020
Installing and Administering Avaya J100 series IP Phones in an Open SIP
environment
263