Note: An external Certificate Authority cannot issue certificates with name content that cannot be externally verified. This includes any local domain names and private IP addresses. If local domain names or private IP addresses are required, the CA of the Primary or Linux Application Server should be used.
Select a Certificate Authority that can fulfill the trust and certificate requirement of the deployment. Selection criteria are outside of this document but should include for IP Office deployments:
-
Is the Certificate Authority trusted?
-
Can the Certificate Authority provide RSA 2048 bit + SHA-256 identity certificates for web servers? Code signing and other certificate type are not used by IP Office.
-
Does the Certificate Authority support a secure web form based Certificate Signing Request (CSR)? If not, external tools are required to provide the CA with a text-based CSR. See
Certificate Signing Requests for more information about creating such text-based CSRs.
-
Can the Certificate Authority provide identity certificates in PKCS#12 format? If not, external tools are required to convert the identity certificate to the correct format for import into IP Office.
-
If required, can the Certificate Authority provide multi-domain (AKA 'Multi-SAN' or 'Unified Communications') certificates?
-
If required, can the Certificate Authority provide a signing CA certificate? The option would be required for Approach 2: PKI Trust domain based on Primary or Linux Application Server Intermediate CA above.
-
Will the root CA already be in the client browsers and operating systems? Are all client browsers and operating systems covered?
-
Are intermediate signing certificates used? This can increase deployment complexity if intermediates are used.
-
-
What notification/assurance level is required? Providers typically offer a number of levels under various names:
|
Description
|
|
Intermediate
|
Also know as Organization Validation. The domain and company are validated. Browsers should not raise an error/warning, company information is shown.
|
|
Basic
|
Also known as Domain Validation. Only the domain name is validated, not the company itself. Browsers should not raise an error/warning, but no company information is shown. This level is not recommended for IP Office interfaces where verification of company identity is important.
|
|
Enhanced
|
Also know as Extended Validation. The domain and company are validated in detail. Browsers should display a green verified background and company information is displayed. Due to their security concerns, Wildcard certificates are not allowed for 'Extended Validation'.
|
-
How long are the identity and signing certificates valid for? Shorter periods increase the maintenance overhead.
-
Can a free trial certificate be obtained to verify correct operation? IP Office has been tested successfully with a number of providers' certificates but due to quantity of providers, assurance cannot be given that all providers' certificates can be supported successfully.
-
Are test and other support utilities provided?
