There are several types of TLS connections:
•
Standard TLS, where all certificates are signed by the same CA.
•
Unique CAs, where each certificate is signed by a different CA.
•
Unknown gateway CA, where the gateway’s certificate is signed by an unknown
(untrusted) CA.
•
Unknown SCOPIA Management CA, where SCOPIA Management’s certificate is signed by an
unknown (untrusted) CA.
•
Mutually unknown CAs, where both components carry certificates signed by CAs that are
unknown to each other.
Each situation requires a different set of certificates to be uploaded to each of the
components. Typically, the certificates are all signed by the same CA. Some unique
deployments, such as service provider deployments, may use multiple CAs.
A CA’s signature is always verified by its root certificate, which identifies the CA and is self-
signed by that CA. When a device receives a certificate as part of TLS negotiations, it must
verify that the CA signing the certificate is trusted, so it must have the CA’s root certificate
uploaded.
•
Standard TLS
These connections use the same CA for signing all certificates on both sides. In this case,
you need to upload two certificates to SCOPIA Management and two for the gateway
(
).
Figure 6-1
Standard TLS: Component Certificates and a CA Root Certificate
Upload the following certificates to the SCOPIA Management:
–
A certificate identifying SCOPIA Management, signed by the CA. This is sent to the
gateway as part of the TLS negotiation.
–
A root certificate verifying the CA’s identity, self-signed by that CA. This is used by
SCOPIA Management to verify the certificate sent by the gateway.
RADVISION | Deployment Guide for SCOPIA TIP Gateway Version 8.0
Securing Your Video Network Using TLS | 45
