Configuring Secure SRST for SCCP and SIP
Information About Configuring Secure SRST
184
Cisco Unified SCCP and SIP SRST System Administrator Guide
OL-13143-04
Secure SRST Authentication and Encryption
Figure 2
illustrates the process of secure SRST authentication and encryption, and
Table 3
describes the
process.
Figure 2
Secure Cisco Unified SRST Authentication and Encryption
Table 3
Overview of the Process of Secure SRST Authentication and Encryption
Process Steps
Description or Detail
1.
The CA server, whether it is a Cisco IOS router CA or a third-party CA, issues a
device certificate to the SRST gateway, enabling credentials service. Optionally, the
certificate can be self-generated by the SRST router using a Cisco IOS CA server.
The CA router is the ultimate trustpoint for the Certificate Authority Proxy Function
(CAPF). For more information on CAPF, see
Cisco Communications Manager
Security Guide
.
2.
The CAPF is a process where supported devices can request a locally significant
certificate (LSC). The CAPF utility generates a key pair and certificate that is specific
for CAPF, copies this certificate to all Cisco Unified Communications Manager
servers in the cluster, and provides the LSC to the Cisco Unified IP Phone.
An LSC is required for Cisco Unified IP Phones that do not have a manufacturing
installed certificate (MIC). The Cisco 7970 is equipped with a MIC and therefore does
not need to go through the CAPF process.
3.
Cisco Unified Communications Manager requests the SRST certificate from
credentials server, and the credentials server responds with the certificate.
4.
For each device, Cisco Unified CM uses the TFTP process and inserts the certificate
into the SEPMACxxxx.cnf.xml configuration file of the Cisco Unified IP Phone.
155101
Cisco Unified
SRST
LSC
7940/7960
MIC
7970
IP phone
TLS handshake
CAPF
TFTP
Cisco Unified
Communications Manager
Cisco IOS router CA
or third-party CA
SEPMACxxxx.cnf.xml
LSC/MIC
Cisco Unified
SRST cert
Cisco Unified
SRST cert
Cisco Unified
SRST cert
Credentials
service
V
IP
2
4
4
6
6b
6a
5
3
1
