Configuring Secure SRST for SCCP and SIP
How to Configure Secure Unified SRST
186
Cisco Unified SCCP and SIP SRST System Administrator Guide
OL-13143-04
Preparing the Cisco Unified SRST Router for Secure Communication
The following tasks prepare the Cisco Unified SRST Router to process secure communications.
•
Configuring a Certificate Authority Server on a Cisco IOS Certificate Server, page 186
(optional)
•
Autoenrolling and Authenticating the Secure Cisco Unified SRST Router to the CA Server,
page 188
(required)
•
Disabling Automatic Certificate Enrollment, page 190
(required)
•
Verifying Certificate Enrollment, page 191
(optional)
•
Enabling Credentials Service on the Secure Cisco Unified SRST Router, page 193
(required)
•
Troubleshooting Credential Settings, page 195
•
Importing Phone Certificate Files in PEM Format to the Secure SRST Router, page 195
Configuring a Certificate Authority Server on a Cisco IOS Certificate Server
For Cisco Unified SRST Routers to provide secure communications, there must be a CA server that
issues the device certificate in the network. The CA server can be a third-party CA or one generated from
a Cisco IOS certificate server.
The Cisco IOS certificate server provides a certificate generation option to users who do not have a
third-party CA in their network. The Cisco IOS certificate server can run on the SRST router or on a
different Cisco IOS router.
If you do not have a third-party CA, full instructions on enabling and configuring a CA server can be
found in the
Cisco IOS Certificate Server
documentation. A sample configuration is provided below.
SUMMARY STEPS
1.
crypto pki server
cs-label
2.
database level
{
minimal
|
names
|
complete
}
3.
database url
root-url
4.
issuer-name
DN-string
5.
grant auto
6.
no shutdown
