AudioCodes Mediant 500 MSBR, Руководство пользователя

Страница: 129 / 1248

Version 7.2 129 Mediant 500 MSBR
User's Manual 13. Configuring SSL/TLS Certificates
You can also do the following with certificates that are in the Trusted Certificates store:

Delete certificates: Select the required certificate, click Remove , and then in the
Remove Certificate dialog box, click Remove .

Save certificates to a folder on your PC: Select the required certificate, click Export ,
and then in the Export Certificate dialog box, browse to the folder on your PC where
you want to save the file and click
Export .
13.8 Configuring Mutual TLS Authentication
This section describes how to configure mutual (two-way) TLS authentication.
13.8.1 TLS for SIP Clients
When Secure SIP (SIPS) is implemented using TLS, it is sometimes required to use two-
way (mutual) authentication between the device and a SIP user agent (client). When the
device acts as the TLS server in a specific connection, the device demands the
authentication of the SIP client’s certificate. Both the device and the client use certificates
from a CA to authenticate each other, sending their X.509 certificates to one another during
the TLS handshake. Once the sender is verified, the receiver sends its' certificate to the
sender for verification. SIP signaling starts when authentication of both sides completes
successfully.
TLS mutual authentication can be configured for calls by enabling mutual authentication on
the SIP Interface associated with the calls. The TLS Context associated with the SIP
Interface or Proxy Set belonging to these calls are used.
Note: SIP mutual authentication can also be configured globally for all calls, using the
'TLS Mutual Authentication' (SIPSRequireClientCertificate) parameter (see
Configuring TLS for SIP on page 155).

To configure mutual TLS authentication for SIP messaging:
1. Enable two-way authentication on the specific SIP Interface:
a. In the SIP Interfaces table (see Configuring SIP Interfaces on page 325),
configure the 'TLS Mutual Authentication' parameter to
Enable for the specific
SIP Interface.
b. Reset the device with a save-to-flash for your settings to take effect.
2. Configure a TLS Context with the following certificates:
•
Import the certificate of the CA that signed the certificate of the SIP client into the
Trusted Certificates table (certificate root store) so that the device can
authenticate the client (see Importing Certificates into Trusted Root Certificate
Store on page 127).
•
Make sure that the TLS certificate is signed by a CA that the SIP client trusts so
that the client can authenticate the device.
13.8.2 TLS for Remote Device Management
By default, servers using TLS provide one-way authentication. The client is certain that the
identity of the server is authentic. When an organizational PKI is used, two-way
authentication may be desired - both client and server should be authenticated using X.509
certificates. This is achieved by installing a client certificate on the management PC and