Yealink SIP-T2XP, Administration Manual

Page: 88 / 246

Administrator’s Guide for SIP-T2xP IP Phones
76
cannot be captured, a lock icon appears on the LCD screen when the IP phone is in the
connecting state or in the calling state.
TLS uses a program layer located between the internet's HTTP and TCP layers. TLS is
designed to make use of TCP as a communication layer to provide a reliable end-to-end
secure and authenticated connection between two points over a network. TLS provides
mechanisms to secure your phone traffic. The IP phone initiates a TLS connection when
the IP phone connects to the HTTPS URL for provisioning.
In order to use the TLS on the IP phone, you need to do the following steps:

Uploading certificates to the IP phone

Configuring the IP phone to use the TLS
Certificates
The IP phone can serve as a TLS client or a TLS server. The TLS requires the use of the
following security certificates to perform the TLS handshake:

Trusted Certificate: when the IP phone requests the TLS connection with a server,
the IP phone should verify that whether the server can be trusted. The IP phone has
no inbuilt trusted certificate. You can upload up to 10 trusted certificates to the IP
phone.

Server Certificate: when the other clients request the TLS connection with the IP
phone, the IP phone sends the server certificate to the clients for authenticating.
The IP phone has no inbuilt server certificate by default. You can only upload one
server certificate to the IP phone. The old server certificate will be overwritten by
the new uploading one.
In order to authenticate the connected server, you need to enable the ―Only Accepted
Trusted Certificates‖ feature on the IP phone. The IP phone will only accept the same
certificates as listed in the Trusted Certificates list. The IP phone will check the certificate
sent by the server based on the existing certificates in the Trusted Certificates list. You
can configure the TLS on a per-account basis.
Procedure
Configure the TLS and upload certificates using the configuration files or locally.
Configuration File <y0000000000xx>.cfg
Configure the IP phone to use
TLS and authenticate the
connected server.
For more information, refer to
TLS on page 159 .
Upload certificates to the IP
phone.
For more information, refer to
Uploading Certificates on page