The Primary Server CA should be used for Server Edition deployments. The Linux Application Server for non-Server Edition deployments. The same CA must be used for all systems in a deployment.
Enable the setting Platform ViewSettingsGeneralCertificatesRenew automatically on the Primary/Linux Application Server.
Select an appropriate Certificate Authority that can fulfill the trust and certificate requirement of the deployment. For more information on external public authorities, see Certificate from External Certificate Authorities.
Request an Intermediate CA certificate/private key pair from a trusted Certificate Authority in PCKS#12 format. An intermediate CA certificate differs in content to a root CA or a device identity certificate.
Download the root CA certificate (and any further intermediate CA certificates) from the Certificate Authority in PEM and DER format to a local directory.
Install Intermediate CA certificate the on the Primary or Linux Application Server. This can either be done during ignition, or post ignition via the IP Office Web Manager setting Platform ViewSettingsGeneralCertificatesCA CertificateImport.
For every device (server, IP500 V2 and so on) use the CA to create a unique ID certificate for each with the correct name content and save to a local directory. The name fields of the certificate are important for correct interoperation with clients; see Certificate Name Content for more information. See Using the IP Office Certificate Authority.
Save the intermediate CA certificate in both PEM and DER formats to a local directory using the IP Office Web Manager setting Platform ViewSettingsGeneralCertificatesCA CertificateDownload (PEM-Encoded) and Download (DER-Encoded)..
Use IP Office Web Manager or IP Office Manager to:
ADDITIONAL INFORMATION:
Save both the root and intermediate CA certificate in the TCS, then
Activate the certificate chaining feature Offer ID Certificate Chain.
Use IP Office Web Manager or IP Office Manager to save the ID certificate on the relevant IP Office server. See Update Certificates.
Distribution of the root CA certificate to phones, clients and browsers is as per PKI Trust Domain based on Primary or Linux Application Server root CA section above.
Verification and enabling steps are as per PKI Trust Domain based on Primary or Linux Application Server root CA section above, with the note that many external CAs provide online verification tools.
Once all checks have been carried out, a configuration backup should be taken.
