By default the IP Office root certificate is used. For an IP500 V2 this is its own self-signed security certificate and no further changes are required. For Linux based servers, it is necessary to download the server's own self-signed certificate and then load that certificate into the IP Office service's trusted certificate store.
To use a third-party certificate, that certificate needs to be uploaded to the IP Office's trusted certificate store.
The telephone is informed about which certificate to use by setting in the 46xxsettings.txt file it receives. The following settings are used:
SET TLSSRVRVERIFYID 1: This setting instructs the telephone to verify the TLS certificate.
SET TRUSTCERTS Root-CA-xxxxxxxx.pem: This setting indicate the name of the security certificate that the telephone should request and load when starting.
When the IP Office receives a request for a certificate, it searches its trusted certificate store. If bytes 13-16 of the Public key of the root CA match the xxxxxxxx of the filename in the request, then IP Office provides the root CA as an auto-generated file named Root-CA-xxxxxxxx.pem.
For systems using auto-generated files, the settings are added automatically. For other installation, the settings must be manually added to the section of the 46xxsettings file intended for 9608, 9611, 9621 and 9641 telephones.
