Cisco 521SG Administration Guide - Page 159

Provisioning Using HTTPS 6 Client Certificates In addition to a direct attack on the Cisco IP phone, an attacker might attempt to contact a provisioning server using a standard web browser, or other HTTPS client, to obtain the Cisco IP phone configuration profile from the provisioning server. To prevent this kind of attack, each Cisco IP phone also carries a unique client certificate, also signed by Cisco, including identifying information about each individual endpoint. A certificate authority root certificate capable of authenticating the device client certificate is given to each service provider. This authentication path allows the provisioning server to reject unauthorized requests for configuration profiles. Obtaining a Server Certificate To obtain a server certificate: STEP 1 Contact a Cisco support person who will work with you on the certificate process. If you are not working with a specific support person, you can email your request to [email protected].) STEP 2 Generate a private key that will be used in a CSR (Certificate Signing Request). This key is private and you do not need to provide this key to Cisco support. Use open source "openssl" to generate the key. For example: openssl genrsa -out 1024 STEP 3 Generate CSR a that contains fields that identify your organization, and location. For example: openssl req -new -key -out You must have the following information: • Subject field-Enter the Common Name (CN) that must be a FQDN (Fully Qualified Domain Name) syntax. During SSL authentication handshake, the SPA 9000 verifies that the certificate it receives is from the machine that presented it. • Server's hostname-For example, provserv.domain.com. • Email address-Enter an email address so that customer support can contact you if needed. This email address is visible in the CSR. Cisco Small Business SPA300 Series, SPA500 Series, and WIP310 IP Phone Administration Guide 158