The user is notified through a log message if the log level is maintained as WARNING with the
category CERTMGMT. The logs are maintained and displayed if SYSLOG is enabled.
MIB object tables and IDs are created for certificates installed on the phone. You can view the
certificate attributes through an SNMP MIB browser.
To implement DES, the phone has 64 Public CA certificates built in. For a list of the certificates,
see
on page 511.
Related links
on page 511
Identity certificates
Identity certificates are used to establish the identity of a client or server during a TLS session.
Phones support the installation of an identity certificate using one of the following methods:
• Secure Certificate Enrollment Protocol (SCEP) by using the
46xxsettings.txt
file
parameter MYCERTURL.
SET MYCERTURL "http://192.168.0.1/ejbca/publicweb/apply/scep/
pkiclient.exe"
• PKCS12 File by using the
46xxsettings.txt
file parameter PKCS12URL.
SET PKCS12URL http://192.168.0.1/client_$MACADDR_cert.p12
You can view the following attributes of the certificate using an SNMP MIB browser:
•
Serial Number
•
Subject Name
•
Issuer Name
•
Validity Period
:
notBefore
and
notAfter
dates
•
Thumbprint
: Hash of the certificate
•
Basic Contraints
•
Subject Alternative Name
•
Key Usage Extensions
•
Extended Key Usage
To validate the identity of a received certificate, the following process is followed:
• Verification of certificate chain up to the trusted entity.
• Verification of the signature.
• Verification of the revocation status through OCSP.
• Verification of the certification validity (not-before and not-after dates are checked).
• Verification of the certificate usage restrictions.
• Verification of the identity against the certificate.
Security configurations
April 2020
Installing and Administering Avaya J100 series IP Phones in an Open SIP
environment
262