Server Edition Primary/Application Server Initial Certificate Settings

Last Updated : Jul 24, 2024 |
Prolog information
Metadata
Keywords:
During the ignition process of a Linux-based IP Office server as a primary or application server, you can chose to let the server generate self-signed certificates or import a set of certificates from a third-party CA.
If you chose to use the IP Office self-signed certificates, the IP Office generates the following root and indenity certificates.

Default IP Office CA Root Certificate

Certificate Field
Contents
Notes
Version
V3
X.509 V3 format.
Serial Number
Large random number
A unique serial number of up to 20 bytes.
Signature Algorithm
sha256RSA
–
Issuer
E = support@avaya.com
CN = ipoffice-root-<HostName>.avaya.com
OU = GCS
O = Avaya Inc
L = Basking Ridge
S = New Jersey
C = US
Where <HostName> is the hostname configured during ignition.
  • If Hostname not used, use a DNS resolution of LAN1, if not then LAN2.
  • If Hostname not used and no successful DNS resolution, use the default name of 'Eth0 mac' for example, 'ipoffice-root-00e007057307.avaya.com'.
The correct hostname was not set during ignition, use the following and then regenerate the certificate.
  • Platform ViewSettingsSystem SettingsNetworkHost Name
Subject
See above.
The same as the Issuer.
Issued By
ipoffice-root-<HostName>.avaya.com
Where <HostName> is the same as used in CN.
Issued To
ipoffice-root-<HostName>.avaya.com
Where <HostName> is the same as used in CN.
Valid From
DD/MM/YY HH:MM:SS
Matches the server ignition UTC date and time minus 24- hours.
  • Note: If the servers real-time clock was corrupt/not set, the time is fixed as 00:00:00 1st January of the year the software release.
Valid To
Approximately 10-years from the Valid From date and time.
–
Subject Alternative Name(s)
URL:ipoffice-root-<HostName>.avaya.com
Where <HostName> is the same as the value used for Subject above.
Enhanced Key Usage
Server Authentication
Client Authentication
–
Basic Constraints
Subject Type=CA
Path Length Constraint = None
Marked as critical. Indicate that you can use the certificate to sign identity or intermediate CA certificates.
Key Usage
Digital Signature
Key CertSign
Key Usage = 97
Marked as non-critical. Indicates the functions for which you can use the IP Office CA certificate.
Subject Key Identifier
Key Identifier
This value is placed in the Authority Key Identifier certificates signed using this certificate.
Subject Key Identifier
Signature data
–
Public Key Algorithm
RSA
–
Public Key
2048 bits
–

Identity Certificate

If you chose to have the IP Office create its own root CA certificate during ignition, the IP Office also creates an identity certificate for itself.
Certificate Field
Contents
Notes
Version
V3
X.509 V3 format.
Serial Number
Large random number
Same as the root certificate Serial Number above plus 1.
Signature Algorithm
sha256RSA
–
Issuer
E = support@avaya.com
CN = ipoffice-root-<HostName>.avaya.com
OU = GCS
O = Avaya Inc
L = Basking Ridge
S = New Jersey
C = US
Where <HostName> is the hostname configured during ignition.
  • If Hostname not used, use a DNS resolution of LAN1, if not then LAN2.
  • If Hostname is not used and there is no successful DNS resolution, use the default name of 'Eth0 mac' for example, 'ipoffice-root-00e007057307.avaya.com'.
The correct hostname was not set during ignition, use the following and then regenerate the certificate.
  • Platform ViewSettingsSystem SettingsNetworkHost Name
Subject
See above.
The same as the Issuer.
Issued By
ipoffice-root-<HostName>.avaya.com
Where <HostName> is the same as used in CN.
Issued To
<HostName>
Where <HostName> is the same as used in CN.
Valid From
DD/MM/YY HH:MM:SS
Typically two or three minutes after the Valid Fromtime of the root certificate above.
Valid To
Approximately 2-years from the Valid From date and time.
–
Subject Alternative Name(s)
DNS:<HostName>,IP:<IP Address>
Where <HostName> is the same as the value used for Subject above.
Multiple IP address are included based on the addresses of the server ports configured during ignition and whether you also configured IPv6 addresses.
Key Usage
Digital Encipherment
Digital Signature
Key Agreement
Key Enchiperment
Non Repudiation
Key Usage = 31
Marked non-critical. Indicates the functions for which you can use the IP Office CA certificate.
Basic Constraints
Subject Type=End Entity
Path Length Constraint = None
Marked critical. Indicate that you can use the certificate to sign identity or intermediate CA certificates.
Enhanced Key Usage
Server Authentication
Client Authentication
–
Subject Key Identifier
Key Identifier
This value is placed in the Authority Key Identifier certificates signed using this certificate.
Subject Key Identifier
Signature data
–
Public Key Algorithm
RSA
–
Public Key
2048-bits
–
Note 1:
  • Identity certificate regeneration is done automatically if the IP Office Web Manager setting Platform ViewSettingsGeneralCertificatesRenew automatically is active (default).
  • The correct LAN 1 and LAN 2 address should be set during ignition. If not, the identity certificate must be regenerated.
Related links
Initial Certificate Settings