To create or modify a TLS Profile:
In the left navigation pane, go to Security > TLS Profiles.
Click the CreateTLS Profile ( ) icon at the top of the TLS Profile page.
Specifies the TLS version. The Client Cipher List is automatically updated to display only the ciphers supported for the selected TLS version.
Enables the Mutual authentication request and verifications of the SIP peer client certificate.
This setting is part of the standard level of Mutual TLS security. Mutual Authentication includes a check on the certificate dates for certificate validity and whether the certificate is signed by a local trusted root CA.
Specifies whether or not to verify the identity of a peer server. Available when Mutual Authentication is disabled.
This setting is part of the standard level of Mutual TLS security. Verify Peer Server Certificate implies that Mutual Authentication is enabled first. Verify Peer Server Certificate includes a check on the certificate dates for certificate validity and whether the certificate is signed by a local trusted root CA.
Specifies the SIP TLS client and server handshake inactivity timeout interval.
The Inactivity Timeout terminates the TLS session if there have been no handshakes in the specified period of time.
The handshake inactivity timeout should be adjusted to 30 seconds if there are network delays and/or timeouts.
Specifies the cipher suite parameter exchanged and negotiated in the SIP TLS client handshake message. The list is automatically populated with the ciphers supported for the selected TLS Protocol.
The SBC Edge supports the following TLS cipher suites:
The TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA is incompatible with Lync servers.
The Validate Server FQDN is an enhanced security feature of the SBC Edge, which is disabled if the common name in the certificate is an IP address ( a practice observed by some ITSP's). This field is only visible when Validate Peer Server Certificate is enabled and Mutual Authentication is disabled.
Validate Server FQDN (enabled) option allows the SBC Edge to perform an FQDN match of an incoming peer certificate common name (CN) or Subject Alternate Name (SAN) against the host that is configured in the SIP Server table of SBC Edge (protocol must be TLS and the Host must be in the form of FQDN).
Specifies the reverse DNS lookup of a peer's FQDN. Used to verify the identity of the SIP peer client certificate.
This action takes place when both, MTLS and "Validate Client FQDN" are enabled. If MTLS is disabled, the "Validate Client FQDN" is also disabled. "Validate Client FQDN" is an enhanced security feature of SBC Edge, which could be disabled if the common name in the certificate is an IP address (some ITSP's do that). "Validate Client FQDN" Enabled option allows SBC Edge to perform an FQDN match of an incoming peer certificate common name (CN) or Subject Alternate Name (SAN) against a reverse DNS lookup of the IP address to an FQDN.
SBC Edge does not validate IP addresses to identify a peer server, but only Fully Qualified Domain Names (FQDN).