Yealink CPE80, Administrator'S Manual

Page: 271 / 321

Configuring Security Features
255
The following figure illustrates the TLS messages exchanged between the endpoint and TLS
server to establish an encrypted communication channel:
Step1:
The endpoint sends “Client Hello” message proposing SSL options.
Step2:
Server responds with “Server Hello” message selecting the SSL options, sends its public
key information in “Server Key Exchange” message and concludes its part of the negotiation
with “Server Hello Done” message.
Step3:
The endpoint sends key session information (encrypted by server’s public key) in the
“Client Key Exchange” message.
Step4:
Server sends “Change Cipher Spec” message to activate the negotiated options for all
future messages it will send.
The endpoint can encrypt SIP with TLS, which is called SIPS. When TLS is enabled for the SIP
account, the message of the SIP account will be encrypted after the successful TLS negotiation.
Certificates
The endpoint can serve as a TLS client or a TLS server. The TLS requires the following security
certificates to perform the TLS handshake:

Trusted Certificate
: When the endpoint requests a TLS connection with a server, the
endpoint should verify the certificate sent by the server to decide whether it is trusted
based on the trusted certificates list. The endpoint has 36 built-in trusted certificates. You
can upload up to 10 custom certificates to the endpoint. The format of the certificates
must be *.pem, *.cer, *.crt and *.der. For more information on 36 trusted certificates, refer
to
Appendix B: Trusted Certificates on page 300 .

Server Certificate
: When clients request a TLS connection with the endpoint, the endpoint
sends the server certificate to the clients for authentication. The endpoint has two types of
built-in server certificates: a unique server certificate and a generic server certificate. You
can only upload one server certificate to the endpoint. The old server certificate will be
overridden by the new one. The format of the server certificate files must be *.pem and
*.cer.
-
A unique server certificate
: It is installed by default and is unique to a endpoint
(based on the MAC address) and issued by the Yealink Certificate Authority (CA).
-
A generic server certificate
: It is installed by default and is issued by the Yealink
Certificate Authority (CA). Only if no unique certificate exists, the endpoint may send
a generic certificate for authentication.