AudioCodes Mediant 500 MSBR, Руководство пользователя

Страница: 130 / 1248

User's Manual 130 Document #: LTRT-10375
Mediant 500 MSBR
loading the root CA's certificate to the device's Trusted Certificates table (certificate root
store). The Trusted Root Certificate file may contain more than one CA certificate
combined, using a text editor.

To enable mutual TLS authentication for HTTPS:
1. On the Web Settings page (see Configuring Secured (HTTPS) Web on page 79),
configure the 'Secured Web Connection (HTTPS)' parameter to
HTTPS Only . The
setting ensures that you have a method for accessing the device in case the client
certificate doesn't work. Restore the previous setting after testing the configuration.
2. In the TLS Contexts table (see Configuring TLS Certificate Contexts on page 117),
select the required TLS Context row, and then click the
Trusted Root Certificates
link located below the table; the Trusted Certificates table appears.
3. Click the Import button, and then select the certificate file.
4. Wait until the import operation finishes successfully.
5. On the Web Settings page, configure the 'Require Client Certificates for HTTPS
connection' parameter to
Enable .
6. Reset the device with a save-to-flash for your settings to take effect.
When a user connects to the secured Web interface of the device:

If the user has a client certificate from a CA that is listed in the Trusted Root Certificate
file, the connection is accepted and the user is prompted for the system password.

If both the CA certificate and the client certificate appear in the Trusted Root
Certificate file, the user is not prompted for a password (thus, providing a single-sign-
on experience - the authentication is performed using the X.509 digital signature).

If the user does not have a client certificate from a listed CA or does not have a client
certificate, the connection is rejected.
Note:
•
The process of installing a client certificate on your PC is beyond the scope of this
document. For more information, refer to your operating system documentation
and/or consult with your security administrator.
•
The root certificate can also be loaded through the device's Automatic
Provisioning mechanism, using the HTTPSRootFileName
ini file parameter.
•
You can enable the device to check whether a peer's certificate has been revoked
by an OCSP server per TLS Context (see Configuring TLS Certificate Contexts on
page 117).
13.9 Configuring TLS Server Certificate Expiry Check
You can configure the TLS Server Certificate Expiry Check feature per TLS Context,
whereby the device periodically checks the validation date of installed TLS server
certificates. You can also configure the device to send a notification SNMP trap event
(acCertificateExpiryNotification) at a user-defined number of days before the installed TLS
server certificate is to expire. The trap indicates the TLS Context to which the certificate
belongs.

To configure TLS certificate expiry checks and notification:
1. Open the TLS Contexts table (see Configuring TLS Certificate Contexts on page 117).
2. Select the required TLS Context index row, and then click the Change Certificate link
located below the table; the Change Certificates page appears.