Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations Mike Lewis on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
SIP Product Certificate Authority
- Thread starter underwoj
- Start date
Preferably, don't. You should go through the process of creating a CSR on the SBC, signing it via SMGR, and using that.
At that point, you'd just need to push the SMGR authority to your endpoints.
Or, if you're working for company.com and you guys have a Windows CA and your PCs all trust that authority, then go through the exercise with that issuing authority and you wouldn't even have to load anything on the company laptops.
There's a few problems with the default certs, namely - they don't generate at install time, they're in the box, so they're never issued to the FQDN of anything. Security best practices are to do things like that and I'm not trying to make your life complicated, but it's more of a pain to jump through hoops to do security wrong than it is to do it right. Then you'll try your iPhone and you might realize Apple's a little more stringent about it and doesn't cater to security shenanigans.
I don't know off hand where the authority cert is for the SBC, but if you really wanted to, you could wireshark yourself failing and you'll see the cert presented to you that you rejected. Because the cert's in the packet capture, you can extract it. You just right click and 'extract raw packet bytes' in the right place.
At that point, you'd just need to push the SMGR authority to your endpoints.
Or, if you're working for company.com and you guys have a Windows CA and your PCs all trust that authority, then go through the exercise with that issuing authority and you wouldn't even have to load anything on the company laptops.
There's a few problems with the default certs, namely - they don't generate at install time, they're in the box, so they're never issued to the FQDN of anything. Security best practices are to do things like that and I'm not trying to make your life complicated, but it's more of a pain to jump through hoops to do security wrong than it is to do it right. Then you'll try your iPhone and you might realize Apple's a little more stringent about it and doesn't cater to security shenanigans.
I don't know off hand where the authority cert is for the SBC, but if you really wanted to, you could wireshark yourself failing and you'll see the cert presented to you that you rejected. Because the cert's in the packet capture, you can extract it. You just right click and 'extract raw packet bytes' in the right place.
- Thread starter
- #3
- Status
Similar threads
