Which CA to use for Server Edition Certificate

[PhonesTech]

Hi Everyone, We're implementing Avaya IP office Server Edition with Avaya Workplace applications. We've used self signed certificates for a long time.
I'm new to CA certificates, but from the online reading it seems we can't get a certficate with IP addresses. Just wanted to see is there any CA that meets Avaya's requirement or do we have to use self signed certificates? We wanted one with Multiple SAN Entries:
DNS Name: voip2.domain.com
DNS Name: voip1.domain.com
DNS Name: Domain.com
IP: x.x.x.x
IP: y.y.y.y
URI:SIP: domain.com

 

[derfloh]

If you want those you can use the primary server as CA but the devices have to learn to trust that CA.

If Yugoslavia setup DNS correctly you can also use DigiCert, GoDaddy or any other public CA. And just use FQDNs.

IP Office remote service
IP Office certificate check
CLI based call blocking
SCN fallback over PSTN

 

[sizbut]

The IP Office self-signed certs are fine if all your servers and clients are internal.

Avoid Entrust - they are in deep doo-doo with Google at the moment (under threat of being blocked).

Pretty well any external CA will work. If you intending to support VoIP softphones, certs from big players like DigiCert are best as they are already have pre-installed certs in the Android, Apple, Windows OS's that make them trusted.

But yes, most certificate providers shun the use of IP addresses, and that means full FQDN/DNS routing to your IP Office is a must.

Stuck in a never ending cycle of file copying.

 

[Richard10d]

Since you are using Avaya Workplace you have 2 choices:
1. Buy a cert from a public CA
2. Add your root CA from your SE install to the devices.

If you can easily manage the CAs on your devices, use the private CA on your SE, IMHO.

I did a certificate from GoGetSSL.com, and they let me add an IP for the SAN (I use FQDN, but I like having both as it helps with deskphones). It works for Avaya Workplace on our IOS devices.

I'm guessing you already know you can NOT use a wildcard cert.

 

[derfloh]

You can use wildcart certificates as long as the match the FQDN AND SIP domain. Even though for security reasons they are not recommended.

IP Office remote service
IP Office certificate check
CLI based call blocking
SCN fallback over PSTN

 

[Richard10d]

Oh, Avaya said they don't support wildcard on SIP endpoints including Avaya Workplace:

https://documentation.avaya.com/bundle/IPOfficeSecurity/page/Certificate_Name_Content.html

When I tried it didn't work but it's been a few years.

 

[derfloh]

Probably it is only supported auth ASBCE. But not recommended though.

IP Office remote service
IP Office certificate check
CLI based call blocking
SCN fallback over PSTN

 

[sizbut]

It is possible to get wildcard certs to work. But it won't be supported. If you do a search on SIP RFCs and wildcard certificates, you'll find that its not just the IP Office team that don't like them. And recent domain security enhancements are increasing that dislike.

Stuck in a never ending cycle of file copying.