332
•
UC-P100-S/UC-P110-S Phones for Skype for Business
Supplemental Guide – DOC. 8412A
The following figure illustrates the TLS messages exchanged between the Skype for
Business phone and TLS server to establish an encrypted communication channel:
TLS Messages
Skype for Business phone sends a “Client Hello” message proposing SSL options.
Server responds with a “Server Hello” message selecting the SSL options, sends
its public key information in a “Server Key Exchange” message and concludes its
part of the negotiation with a “Server Hello Done” message.
Skype for Business phone sends session key information (encrypted by the
server’s public key) in the “Client Key Exchange” message.
Server sends a “Change Cipher Spec” message to activate the negotiated
options for all future messages it will send.
Skype for Business phones can encrypt SIP with TLS, which is called SIPS. When TLS is
enabled for an account, the SIP message of this account will be encrypted, and a lock
icon appears on the LCD screen after the successful TLS negotiation.
Certificates
The Skype for Business phone can serve as a TLS client or a TLS server. The TLS requires
the following security certificates to perform the TLS handshake:
•
Trusted Certificate: When the Skype for Business phone requests a TLS
connection with a server, the Skype for Business phone should verify the
certificate sent by the server to decide whether it is trusted based on the trusted
certificates list. The Skype for Business phone has 51 built-in trusted certificates.
Up to 51 custom certificates can be uploaded. The format of the trusted
certificate files must be *.pem,*.cer,*.crt and *.der and the maximum file size is
5MB. For more information on 51 trusted certificates, refer to “Appendix C:
Trusted Certificates” on page 385.