For trusted (e.g. SIP Entities) SIP TLS connections, Avaya Breeze® platform applies the following validations:
Mutual TLS authentication: During the TLS handshake, the SIP entity and Avaya Breeze® platform validate the certificate of each other and perform mutual TLS authentication.
Additional validation of the SIP entity identity certificate: If the mutual TLS authentication is successful, further validation is performed using the credential name or the far end IP address of the SIP entity identity certificate. Use the Credential name field of the SIP Entity page to assign it.
If the credential name string is empty, the connection is accepted.
If the credential name string is not empty, the credential name and the IP address of the SIP entity is searched in the identity certificate provided by the SIP entity.
CN value from the Subject
subjectAltName.dNSName
subjectAltName.uniformResourceIdentifier
For IP address comparison, the IP address string is converted to SIP:W.X.Y.Z before comparison. W.X.Y.Z is the remote socket IPV4 address. Also case insensitive search is performed in this case.
For untrusted (e.g. SIP Endpoints) SIP TLS connections, Avaya Breeze® platform behavior depends on the version and its configuration:
For Avaya Breeze® platform 3.0.0 and earlier, the Enable TLS Endpoint Certificate Validation setting on the Avaya Breeze® platform Administration page controls the validation:
If Enable TLS Endpoint Certificate Validation is checked, Avaya Breeze® platform requests a client certificate (via TLS Certificate Request message):
If the client provides an identity certificate, its certificate chain must be traced to a trusted CA certificate in order for the connection to get established.
If the client does not provide a certificate, the connection is allowed.
If Enable TLS Endpoint Certificate Validation is unchecked, no TLS client authentication is performed.
For Avaya Breeze® platform 3.0.1 and later, the TLS Endpoint Certificate Validation setting on the Avaya Breeze® platform Administration page controls the validation performed on the client certificate. Avaya Breeze® platform always requests a client certificate (via TLS Certificate Request message), and its validation depend on the configuration value:
If TLS Endpoint Certificate Validation is set to Required:
If the client provides a certificate, its certificate chain must be traced to a trusted CA certificate in order to connect.
If the client does not provide a certificate, the connection is refused.
If TLS Endpoint Certificate Validation is set to Optional:
If the client provides a certificate, its certificate chain must be traced to a trusted CA certificate in order to connect.
If the client does not provide a certificate, the connection is allowed
If TLS Endpoint Certificate Validation is set to None
If the client provides a certificate, its certificate will be saved for reporting but not validated. The connection is allowed
If the client does not provide a certificate, the connection is allowed
