Certificates usage
The H.323-based phones use certificates to verify the authenticity of the following:
• HTTPS file server for downloaded configuration files, and user backup and restore files.
• H.323 signaling over TLS.
• VPN, when certificate authentication method is used.
• SLAMon server.
• SSO applications.
• 802.1x EAP-TLS.
Related links
Initialization process overview
on page 50
on page 51
Certificate revocation
The certificates are published by the certificate authority with information about the revocation
status. The deskphones use Online Certificate Status Protocol (OCSP) to verify the revocation
status of all the certificates in the chain between the server certificate and the root certificate. The
root certificate is not verified. The revocation check of the certificates is done by sending HTTP or
HTTPS requests to the OCSP server.
The certificates may or may not include the authority information access (AIA) extension.
The OCSP responder follows RFC 2560. The deskphones accept only signed responses. The
validation of the signed response is done by using one of the three options mentioned in section
4.2.2.2 in the RFC:
1. The OCSP response is signed using CA which is trusted certificate is administered using
OCSP_TRUSTCERTS.
2. The OCSP response is signed using CA which is also used to sign the certificate in
question.
3. The OCSP response is signed using CA which includes a value of id-kp-OCSPSigning in
an ExtendedKeyUsage extension and is issued by the CA that issued the certificate in
question.
The following
46xxsettings
parameters are used by OCSP for certificate revocation.
• OCSP_ENABLED
• OCSP_URI
• OCSP_URI_PREF
• OCSP_ACCEPT_UNK
• OCSP_NONCE
• SERVER_CERT_RECHECK_HOURS
Administrative requirements
May 2018
Installing and Administering Avaya J169/J179 IP Phone H.323
51