Linksys SPA921 Cisco Small Business IP Telephony Devices Provisioning Guide - Page 77

Exercise, STEP 1

Get Linksys SPA921 - Cisco - IP Phone PDF manuals and user guides
UPC - 745883570799
View all Linksys SPA921 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 77 highlights

Provisioning Tutorial Secure Resync 3 Exercise STEP 1 Enable client certificate authentication on the HTTPS server. STEP 2 In Apache (v.2), set the following in the server configuration file: SSLVerifyClient require Also ensure that the spacroot.cert has been stored as shown in the previous exercise. STEP 3 Restart the HTTPS server and observe the syslog trace from the IP Telephony Device. Each resync to the server now performs symmetric authentication, so that both the server certificate and the client certificate are verified before the profile is transferred. STEP 4 Using ssldump, capture a resync connection between the IP Telephony Device and the HTTPS server. If client certificate verification is properly enabled on the server, the ssldump trace shows the symmetric exchange of certificates (first server-to-client, then client-toserver) before the encrypted packets containing the profile. With client authentication enabled, only a IP Telephony Device with a MAC address matching a valid client certificate can request the profile from the provisioning server. A request from an ordinary browser or other unauthorized device is rejected by the server. HTTPS Client Filtering and Dynamic Content If the HTTPS server is configured to require a client certificate, then the information in the certificate identifies the resyncing IP Telephony Device and supplies it with the correct configuration information. The HTTPS server makes the certificate information available to CGI scripts (or compiled CGI programs) invoked as part of the resync request. For the purpose of illustration, this exercise uses the open source Perl scripting language, and assumes that Apache (v.2) is used as the HTTPS server. Cisco Small Business IP Telephony Devices Provisioning Guide 75

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
Provisioning Tutorial
Secure Resync
Cisco Small Business IP Telephony Devices Provisioning Guide
75
3
Exercise
STEP 1
Enable client certificate authentication on the HTTPS server.
STEP 2
In Apache (v.2), set the following in the server configuration file:
SSLVerifyClient
require
Also ensure that the spacroot.cert has been stored as shown in the previous
exercise.
STEP 3
Restart the HTTPS server and observe the syslog trace from the IP Telephony
Device.
Each resync to the server now performs symmetric authentication, so that both the
server certificate and the client certificate are verified before the profile is
transferred.
STEP 4
Using ssldump, capture a resync connection between the IP Telephony Device
and the HTTPS server.
If client certificate verification is properly enabled on the server, the ssldump trace
shows the symmetric exchange of certificates (first server-to-client, then client-to-
server) before the encrypted packets containing the profile.
With client authentication enabled, only a IP Telephony Device with a MAC
address matching a valid client certificate can request the profile from the
provisioning server. A request from an ordinary browser or other unauthorized
device is rejected by the server.
HTTPS Client Filtering and Dynamic Content
If the HTTPS server is configured to require a client certificate, then the
information in the certificate identifies the resyncing IP Telephony Device and
supplies it with the correct configuration information.
The HTTPS server makes the certificate information available to CGI scripts (or
compiled CGI programs) invoked as part of the resync request. For the purpose of
illustration, this exercise uses the open source Perl scripting language, and
assumes that Apache (v.2) is used as the HTTPS server.