Server Edition Primary/Application Server Initial Certificate Settings

Last Updated : Jul 24, 2024 |

During the ignition process of a Linux-based IP Office server as a primary or application server, you can chose to let the server generate self-signed certificates or import a set of certificates from a third-party CA.

If you chose to use the IP Office self-signed certificates, the IP Office generates the following root and indenity certificates.

Default IP Office CA Root Certificate

Certificate Field

Contents

Notes

Version

V3

X.509 V3 format.

Serial Number

Large random number

A unique serial number of up to 20 bytes.

Signature Algorithm

sha256RSA

–

Issuer

 
E = support@avaya.com
CN = ipoffice-root-<HostName>.avaya.com
OU = GCS
O = Avaya Inc
L = Basking Ridge
S = New Jersey
C = US

Where <HostName> is the hostname configured during ignition.

  • If Hostname not used, use a DNS resolution of LAN1, if not then LAN2.

  • If Hostname not used and no successful DNS resolution, use the default name of 'Eth0 mac' for example, 'ipoffice-root-00e007057307.avaya.com'.

The correct hostname was not set during ignition, use the following and then regenerate the certificate.

  • Platform View > Settings > System Settings > Network > Host Name

Subject

See above.

The same as the Issuer.

Issued By

ipoffice-root-<HostName>.avaya.com

Where <HostName> is the same as used in CN.

Issued To

ipoffice-root-<HostName>.avaya.com

Where <HostName> is the same as used in CN.

Valid From

DD/MM/YY HH:MM:SS

Matches the server ignition UTC date and time minus 24- hours.

  • Note: If the servers real-time clock was corrupt/not set, the time is fixed as 00:00:00 1st January of the year the software release.

Valid To

Approximately 10-years from the Valid From date and time.

–

Subject Alternative Name(s)

URL:ipoffice-root-<HostName>.avaya.com

Where <HostName> is the same as the value used for Subject above.

Enhanced Key Usage

 
Server Authentication
Client Authentication

–

Basic Constraints

 
Subject Type=CA
Path Length Constraint = None

Marked as critical. Indicate that you can use the certificate to sign identity or intermediate CA certificates.

Key Usage

 
Digital Signature
Key CertSign
Key Usage = 97

Marked as non-critical. Indicates the functions for which you can use the IP Office CA certificate.

Subject Key Identifier

Key Identifier

This value is placed in the Authority Key Identifier certificates signed using this certificate.

Subject Key Identifier

Signature data

–

Public Key Algorithm

RSA

–

Public Key

2048 bits

–

Identity Certificate

If you chose to have the IP Office create its own root CA certificate during ignition, the IP Office also creates an identity certificate for itself.

Certificate Field

Contents

Notes

Version

V3

X.509 V3 format.

Serial Number

Large random number

Same as the root certificate Serial Number above plus 1.

Signature Algorithm

sha256RSA

–

Issuer

 
E = support@avaya.com
CN = ipoffice-root-<HostName>.avaya.com
OU = GCS
O = Avaya Inc
L = Basking Ridge
S = New Jersey
C = US

Where <HostName> is the hostname configured during ignition.

  • If Hostname not used, use a DNS resolution of LAN1, if not then LAN2.

  • If Hostname is not used and there is no successful DNS resolution, use the default name of 'Eth0 mac' for example, 'ipoffice-root-00e007057307.avaya.com'.

The correct hostname was not set during ignition, use the following and then regenerate the certificate.

  • Platform View > Settings > System Settings > Network > Host Name

Subject

See above.

The same as the Issuer.

Issued By

ipoffice-root-<HostName>.avaya.com

Where <HostName> is the same as used in CN.

Issued To

<HostName>

Where <HostName> is the same as used in CN.

Valid From

DD/MM/YY HH:MM:SS

Typically two or three minutes after the Valid Fromtime of the root certificate above.

Valid To

Approximately 2-years from the Valid From date and time.

–

Subject Alternative Name(s)

DNS:<HostName>,IP:<IP Address>

Where <HostName> is the same as the value used for Subject above.

Multiple IP address are included based on the addresses of the server ports configured during ignition and whether you also configured IPv6 addresses.

Key Usage

 
Digital Encipherment
Digital Signature
Key Agreement
Key Enchiperment
Non Repudiation
Key Usage = 31

Marked non-critical. Indicates the functions for which you can use the IP Office CA certificate.

Basic Constraints

 
Subject Type=End Entity
Path Length Constraint = None

Marked critical. Indicate that you can use the certificate to sign identity or intermediate CA certificates.

Enhanced Key Usage

 
Server Authentication
Client Authentication

–

Subject Key Identifier

Key Identifier

This value is placed in the Authority Key Identifier certificates signed using this certificate.

Subject Key Identifier

Signature data

–

Public Key Algorithm

RSA

–

Public Key

2048-bits

–

Note 1:

  • Identity certificate regeneration is done automatically if the IP Office Web Manager setting Platform View > Settings > General > Certificates > Renew automatically is active (default).

  • The correct LAN 1 and LAN 2 address should be set during ignition. If not, the identity certificate must be regenerated.

Related information
Initial Certificate Settings