Page History
| Add_workflow_for_techpubs | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
| Panel | ||||
|---|---|---|---|---|
In this section:
|
| Multiexcerpt include | ||||
|---|---|---|---|---|
|
Include Page _Max_Nbr_TLS_Certs _Max_Nbr_TLS_Certs
| Info | ||
|---|---|---|
| ||
The DER content of the certificate being installed must be under 6400 Bytes. |
Managing Certificates
To Create a Certificate
Perform the following steps to create a new Certificate.
Click New Certificate tab on the Certificate List panel.
The Create New Certificate window displays.
Complete the fields using the table below for guidance.
Parameter
Description
File Name
<filename>– Enter the filename and set state to "enabled" to install the certificate.File Name format:
- Local-Internal: PKCS#12
- Local: PEM
- Remote: DER, PEM
Name
Specifies the name of the certificate.
Pass Phrase Specifies the Pass-phrase to decrypt RSA private key in PKCS#12 file. State
Enable this flag to enable the use of the certificate once it has been installed. The options are:
- Disabled (default)
- Enabled
Type Use this object to specify the type of certificate:
- Local-internal – Certificate belongs to (has as its subject) the local system itself; the key pair and CSR were generated on this machine.
- Local – Certificate belongs to (has as its subject) the local system itself; the key pair and CSR were generated elsewhere
- Remote – Certificate belongs to (has as its subject) a remote entity such as a CA or a peer device.
- Click Save to save your changes.
To View a Certificate
On the SBC main screen, go to Configuration > Security Configuration >PKI > Certificate.
The Certificate window displays.
To Edit a Certificate
Perform the following steps to edit a Certificate in the list.
Click on the specific Certificate name.
Observe the Edit Selected Certificate window displays.
- Make the necessary changes, and click Save to save your changes.
To Copy a Certificate
Perform the following steps to copy a created Certificate, and to make any minor changes.
Click the radio button next to the specific Certificate to highlight the row.
Click Copy Certificate tab on the Certificate List panel.
The Copy Selected Certificate window displays, along with the editable fields.- Make the required changes to the required fields, and click Save to save the changes.
The copied Certificate displays at the bottom of the original Certificate in the Certificate List panel.
To Delete a Certificate
Perform the following steps to delete a Certificate.
Click the radio button next to the specific Certificate which you want to delete.
Click Delete at the end of the highlighted row.
A delete confirmation message appears seeking your decision.
- Click Yes to remove the specific Certificate from the list.
Certificate Commands
Click the radio button next to the specific Certificate to highlight the row.
The Certificate Command window displays at the bottom of the screen.
Command options:
- Use the Generate CSR keyword to generate the CSR and display it on the screen.
- Use the Import Cert keyword to import signed certificate.
- To view the complete content of the certificate, use the Retrieve Cert Content command.
Generate CSR Command
When you select the certificate command Generate CSR, and click Select, the following dialog displays:
SAN Support
The Subjective Alternative Name (SAN) is an X509 version 3 extension that allows an SSL certificate to specify multiple names that the certificate should match. This allows you to secure a large number of domains with only one certificate. Even when SAN contains eMail addresses, IP Addresses, Regular DNS Host Name, and so on, SBC now supports only DNS Host Name.
The Lync 2013 video call requires a unique FQDN to identify SBC. This FQDN is not the same as the one used by the Mediation server for regular Audio Only calls. Since SBC now requires 2 FQDN to place bothe Audio and Video calls on Lync using static route from Lync FE, SBC local certificate must contain both the FQDNs for CN and SAN. This is required for a successful TLS connection set up between Lync and SBC.
To continue, select "Key Size", enter "Csr Sub" name and click generateCSR. The Certificate Signing Request (CSR) is generated similar to the example below:
Click OK to exit.
Import Cert Command
When you select the certificate command Import Cert, and click Select the following dialog displays:
| Note |
|---|
You can cut-and-paste the returned certificate content from Certificate Authority (CA) in the |
To continue, enter "Cert Content" description and click importCert.
Once the certificate is successfully imported, return to the Certificate screen and change State to "enabled" to enable the certificate.
The following table lists the certificate parameters:
Parameter | Description |
|---|---|
Csr Subscription |
NOTE: You must specify at least one of the following keys in the csr subject name
Where:
Example:
|
Key Size | The size in bits of the key pair to generate the private key.
|
| Subject Alternative Dns Name | Specifies the names of the alternative DNS subjects. Multiple alternative names can be specified using "," (comma) as a separator. (Max: 4096 characters) For example: "nj.example.com, in.example.com, uk.example.com, ca.example.com, tx.example.com" |
Retrieve Cert Content
The Retrieve Cert Content command extracts the complete certificate information including the serial number and the validity period.
On the Certificate Commands window, select
Retrieve Cert Contentcommand.Note You cannot view the Private Key in the retrieved certificate content.
The following window displays:
Click retrieveCertContent to proceed and to view the complete information of the certificate.
The Message window displays, providing all the information of the certificate.Note This certificate content is an ASCII representation of X.509 format.
- Click Ok to exit.
Overview
Content Tools