Avaya Aura® Device Services can use TLS to communicate with the following deployment components securely:

• LDAP server

• System Manager

• Session Manager

• iView

• Avaya Spaces

To establish a secure TLS connection, Avaya Aura® Device Services uses digital identity certificates issued by a trusted Certificate Authority (CA). Before establishing a secure connection, Avaya Aura® Device Services verifies that the respective digital certificate is valid and not expired.

Sometimes, CA might revoke a certificate before it expires. For example, if the certificate public key is compromised. If you continue to use a revoked certificate, your TLS connection might be not secure and can be exploited by a malicious actor. To indicate that a certificate was revoked and should no longer be used, CA places this certificate in a Certificate Revocation List (CRL). This list is publicly available through a CRL distribution point URL. CRLs contain various information about revoked certificates, such as the certificate serial number and revocation date and time. Avaya Aura® Device Services automatically downloads CRLs for all CAs that issued certificates used in your deployment to establish secure connections.

Avaya Aura® Device Services uses this data to determine whether a certificate can be used to establish a secure connection with a deployment component. Avaya Aura® Device Services fetches CRLs from CAs once every 24 hours.

Avaya Aura® Device Services writes events related to certificate revocation checks to the AADS_audit.log file.

Revocation status

You can review the revocation status for each deployment component on the Security Settings > Certificate Revocation page in the Certificate Revocation Status table.

• OK. The Certificate is valid.

• REVOKED. The certificate is found in the CRL. An alarm is raised.

• NETWORK_ERROR. The CRL distribution point URL is not reachable. An alarm is raised.

• FAILED_TO_VERIFY. Not able to verify the CRL due to server-related issues.

If a certificate for a component is revoked, Avaya Aura® Device Services needs a new valid certificate from the Administrator of this component to replace the revoked certificate. As Administrator, you do need to perform any actions in Avaya Aura® Device Services. However, Avaya Aura® Device Services cannot establish connection with that particular component till the component certificate is replaced with a valid certificate.

Revocation validation

You can choose whether Avaya Aura® Device Services validates certificates.

NONE: Avaya Aura® Device Services does not check the certificate status before establishing the secure connection.

BEST_EFFORT: Avaya Aura® Device Services checks the certificate revocation status. Avaya Aura® Device Services considers a certificate valid if:

• The certificate is not in the CRL of the respective CA.

• The certificate revocation check returns a valid status, such as good, verified, or unrevoked, for the certificate.

• The CRL distribution point is not reachable due to network issues.

MANDATORY: Avaya Aura® Device Services checks the certificate status. Avaya Aura® Device Services considers a certificate valid only if the CRL of the respective CA does not contain this certificate. If Avaya Aura® Device Services cannot check the certificate status, the certificate is considered invalid.