Exporting IP Office Root Certificate 1

[b4btec]

I've recently upgraded to 10.1 and we have two B179 phones that stopped registering due to SSL/TLS errors. I can switch SIP back to TCP and it works. I have read Avaya's Technical Bulletin 175 that says you have to manually upload the IPOffice certificate to the B179s via the web interface. What it doesn't say is how to get the root certificate out of the IPOffice to upload to the B179. Can someone point me in the right direction here?

 

[derfloh]

Is IPO running with a self signed certificate?

 

[b4btec]

Yes, we are running a self signed certificate.

 

[Westi]

You should be able to download it in the security settings

Joe W.

FHandw, ACSS (SME)


"This is the end of the world, make sure to buy your T-shirt before it is too late"
Original expression of my daughter

 

[b4btec]

I tried that but I think I'm still missing something. I went to Security Settings -> System -> Certificates. Only way I could see to export the Identity Certificate was to view it then export to file. I chose the default DER encoded binary x.509 cer file and saved it as "avaya.cer". The certificate was issued to "ipoffice-<hex code>.avaya.com" Where <hex code> is an actual hex value. There is also a little yellow exclamation mark next to Offer ID Cert Chain that stated The Intermediate Certificates Must be placed In The Trusted Cert Store. Now, on the B179 I have inserted the avaya.cer in both the Provisioning and SIP settings pages as a root certificate. I get an error on the B179 that says "Jan 19 13:15:08: ERR: Error creating SIP TLS listener: Error loading SSL certificate chain file (PJSIP_TLS_ECERTFILE) [status=171163]." It seems that I'm missing an intermediate certificate or something or I have the avaya.cer in the wrong place. I only see the one certificate in the IPO manager.

 

[Pepp77]

Do it through the :7071 webpage.

| ACSS SME |

 

[b4btec]

I finally got it to register by TLS by turning Verify Server off on the B179 SIP settings. Why is the B179 not recognizing the certificate as valid?

 

[derfloh]

I guess it will work with 'real' certificates issued by a CA. It is recommended to create a certificate from an enterprise CA or with the CA inbuilt in Application Server. Then you are able to import the root certificate as trusted.