Yealink SIP-T38G, Administrator'S Manual

Page: 197 / 402

Administrator’s Guide for SIP-T3xG IP Phones
184
The IP phone can encrypt SIP with TLS, which is called SIPS. When TLS is enabled for an
account, the SIP message of this account will be encrypted, and a lock icon appears on
the phone LCD screen after the successful TLS negotiation. You can specify the IP phone
to encrypt the SIP signal using the RC4 encryption algorithm.
In order to use the TLS on the IP phone, you need to perform the following steps:

Uploading certificates to the IP phone

Configuring the IP phone to use the TLS
Certificates
The IP phone can serve as a TLS client or a TLS server. The TLS requires the following
security certificates to perform the TLS handshake:

Trusted Certificate: When the IP phone requests a TLS connection with a server, the
IP phone should verify the certificate sent by the server to decide whether the
server is trusted based on the trusted certificates list. You can upload up to 10
trusted certificates to the IP phone.

Server Certificate: When the other clients request a TLS connection with the IP
phone, the IP phone sends the server certificate to the clients for authentication.
You can only upload one server certificate to the IP phone. The old server
certificate will be overwritten by the new one.
You can configure the ―Only Accepted Trusted Certificates‖ feature on the IP phone. If
enabled, the IP phone will check the certificate sent by the server and only accept the
certificates listed in the Trusted Certificates list. You can configure the TLS on a
per-account basis.
Procedure
Configuration changes can be performed using the configuration files or locally.
Configuration File <MAC>.cfg
Configure the IP phone to use
TLS and authenticate the
connected server.
For more information, refer to
TLS on page 305 .
Specify the IP phone to encrypt
the SIP signal using RC4
encryption algorithm.
For more information, refer to
TLS on page 305 .