Versions Compared

Old Version 1

changes.mady.by.user Ribbon Communications

Saved on

compared with

New Version Current

changes.mady.by.user Ribbon Communications

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Add_workflow_for_techpubs
AUTH1UserResourceIdentifier{userKey=8a00a0c85b2726c2015b58aa779d0003, userName='null'}
JIRAIDAUTHSYM-27731
REV5UserResourceIdentifier{userKey=8a00a0c85b2726c2015b58aa779d0003, userName='null'}
REV6UserResourceIdentifier{userKey=8a00a0c85b2726c2015b58aa779d0003, userName='null'}
REV3UserResourceIdentifier{userKey=8a00a02355cd1c2f0155cd26c9d6032b, userName='null'}
REV4UserResourceIdentifier{userKey=8a00a02355cd1c2f0155cd26c91d01f9, userName='null'}
REV1UserResourceIdentifier{userKey=8a00a02355cd1c2f0155cd26c8e901a1, userName='null'}

You can change the certificate installed on the Sonus SBC 1000/2000 the 

Spacevars
0product
system by obtaining the signed certificate from a Trusted CA or from a local Stand-Alone Windows Certificate Authority, and importing it as outlined in the instructions on this page.

Importing a Server Certificate

Warning
titleWarning: Common Encryption Certificate Issues Arise from Missing Root Certificates
  • Did you only install the CA-signed SBC certificate, along with the intermediate certificate(s) sent by your issuing CA?
  • Did you get the following error message from the SBC?


Image Added

If so, the likely reason is a missing CA Root Certificate. The SBC does not have any pre-installed CA root X.509 certificates, unlike typical browsers found on your PC. Ensure the entire certificate chain of trust is installed on the SBC, including the root certificate. Acquire the CA root certificate as follows:

  1. Contact your system administrator or certificate vendor to acquire the root, and any further missing intermediate certificate(s) to provision the entire certificate chain of trust within the SBC;
  2. Load the root certificate, along with the intermediate and SBC certificates, according to Importing Trusted Root CA Certificates.

NOTE: Root certificates are easily acquired from the certificate authorities. For example, the root certificate for the GoDaddy Class 2 Certification Authority may be found at https://ssl-ccp.godaddy.com/repository?origin=CALLISTO . For more information about root certificates, intermediate certificates, and the SBC server (“leaf”) certificates, refer to this tutorial.

For other certificate-related errors, refer to Common Troubleshooting Issues with Certificates in SBC Edge.

Note
titleBefore you begin

Before importing a new Signed Server Certificate, you must first import a valid Trusted CA Certificate.

Note
If your node has a SHA-2 256 signed server certificate, the SBC will not interoperate with Lync 2010 or earlier OCS/Lync versions. The signature algorithm ( sha256WithRSAEncryption ) is shown in the Certificate panel of the Sonus
Spacevars
0company
SBC Certificate page in the UI.
Note

SHA2-256 Certificate Compatibility

SHA2-256 CA Certificates may be used for the SBA, SBC, and Lync 2013 Servers. Lync 2010 requires that all devices employ ALL SHA1 Certificates. For more information see the Microsoft SHA1 Deprecation Policy.

...

Anchor
import
import

  1. In the WebUI, click the Settings tab.

  2. In the left navigation pane, go to Security > SBC Certificates > Sonus SBC Edge Certificate.

    Panel
    borderStylenone

    Caption
    0Figure
    1SBC Edge Certificate

    Image Modified

Key Usage Field Descriptions

Enhanced Key Usage

Panel
bgColor#FAFAFA
borderStylenone

This field displays the enhanced key usage regarding the purposes for which the subject's public key may be used.
TLS Web Server Authentication usage purpose is required in order to be compatible with some browsers.

Key Usage

Panel
bgColor#FAFAFA
borderStylenone

Displays the key usage for defining the purposes of the key contained in the certificate.
Non-repudiation service purpose is disallowed in order to be compatible with some browsers.

...

To import an X.509 signed certificate:

Image Removed

  1. Select X.509 Signed Certificate from the Import menu at the top of the page.

    Panel
    borderStylenone

    Caption
    0Figure
    1Import X.509 Signed Certificate

    Image Added

  2. Chose the import mode (Copy and Paste or File Upload) from the Mode pull-down menu.

    Panel
    borderStylenone

    Caption
    0Figure
    1Import Mode

    Image Modified

  3. If you chose File Upload:
    1. Use the Browse button to find the file
    2. Click OK.
  4. If you choose Copy and Paste:
    1. Open the file in a text editor.
    2. Paste the contents into the Paste Base64 Certificate text field.
  5. Click OK.

To import a PKCS12 Certificate and Key:

...

Note
titleImporting PKCS12 Certificate Guidelines
  • The PKCS12 certificate must not be a chain, but only as the SBC certificate pair.
  • When importing a PKCS12 certificate, the Trusted CA certificates must be imported as a chain if there are both intermediate CA and root CA certificates.

  1. Select PKCS12 Certificate and Key from the Import menu at the top of the page.

    Image Removed

    Panel
    borderStylenone

    Caption
    0Figure
    1Import PKCS12 Certificate and Key

    Image Added

  2. Enter the password used to export the certificate in the Password field.

    Panel
    borderStylenone

    Caption
    0Figure
    1Import PKCS12 Server Certificate

    Image Added 

  3. Browse for the PKCS certificate and key file.

    Info
    iconfalse

    You must use the same password as was used when exporting the certificate and key.

  4. Click OK

Verifying the Signed Server Certificate

Once you have imported the Signed Server Certificate:

  1. In the Issuer panel, ensure the Common Name field has changed from Self-Signed to the issuer's Common Name.
  2. In the Certificate panel,
    1. Ensure that the Enhanced Key Usage field indicates TLS Web Server Authentication.

    2. Ensure that the Verify Status field indicates OK.
      If the Verify Status field does not indicate OK, repeat the steps aboveto obtain a valid certificate.

      Info
      iconfalse

      According to RFC3280, the Netscape CertType field is obsolete and has been replaced by the X509v3 Key Usage field.
      Most modern browsers require the Enhanced Key Usage field for certificate acceptance based on use purpose.

      Panel
      borderStylenone

      Caption
      0Figure
      1Verify Signed Server Certificate

      Image Modified 

Info
iconfalse
  • Server (Sonus
    Spacevars
    0company
    SBC 1000/2000) certificates with a 4096 RSA Key are not supported due to the amount of time required to generate a key and process calls.
  • Trusted Root CA certificates with a 4096 RSA Key are supported, but have not been thoroughly tested.