Spectralink 84-Series Series Wireless Telephones Administration Guide
1725-86984-000_P.docx
September 2016
195
○
Self-signed
is displayed if other certificates have been installed and the Signed by
field could be a MAC address.
○
Device Certificate: Not Installed
is displayed if the certificate is not available in
flash memory (or the flash memory location where the device certificate is to be
stored is blank).
○
Device Certificate: Invalid
is displayed if the certificate is not valid.
Note: Device Certificate Shown as Self-Signed
Some Spectralink handsets manufactured after December, 2011 report the device
certificate as ‘self-signed’ and not as ‘Factory Installed’. The difference indicates
that different issuing CAs were used to generate the certificates. As long as the
authenticating server trusts the Spectralink Root CA that issued these certificates,
the handsets will operate correctly.
About Digital Certificates
Certificates enable handsets and servers to authenticate each other before permitting any
exchange of data. Certificates are utilized by the Transport Layer Security (
TLS
) protocol which
ensures that no third party may eavesdrop or tamper with any message. Certificates also allow
for securely encrypted data to be passed between a SIP client and the PBX, (including Skype
for Business), for secure provisioning under the FTPS, HTTPS protocols, for secure browser
communications and for secure syslogging.
A number of commonly-used certificates are loaded in the phone at the factory. These are
called “built-in” certificates. See
Appendix E: Trusted Certificate Authority List
authorities.
Types of certificates
CA certificate used for 802.1x Authentication
A CA certificate can be used for 802.1x Authentication. EAP-TLS and EAP-FAST.
The client (the handset) uses the CA certificate to verify the CA signature of the Authentication
server (the RADIUS server) certificate before establishing a secure connection. This way the
handset knows it’s talking to the correct far side. It is provided by a Certificate Authority (hence
CA) or an IT administrator and must be loaded on the handset during configuration. This type of
certificate is also called a server certificate as it certifies the server. The certificate is usually the
same for every device and is therefore also known as a “public” certificate.
CA certificate used for Secure Syslog
A CA certificate can be used for Secure Syslog. Syslog can be configured to use a secure TLS
Tunnel using the CA certificate.