Changing an IP Office Root CA Certificate

Last Updated : Apr 20, 2022 |

Prolog information

Metadata

Keywords:

Caution:

Changing the root CA that signed the IP Office identity certificate can lock out installed phones that have previously been provisioned to trust only the old root CA. Avoid doing this unnecessarily. If an identity certificate signed by an external CA is going to be installed in the IP Office, this should be done before installing the phones.

If it is necessary to change the root CA after installing the phones, this has to be done with caution and will require some administrative effort

From Release 11.1, the following process can be used:

Ensure phones are registered to IP Office.
Enable the manager admin setting Automatic Phone Provisioning
Administer the new Root CA certificate on IP Office using Manager
IP Office will attempt to reboot the phones. Any phones busy on a call will be rebooted as soon as they are idle.
IP Office will wait for all phones to re-register, then activate the new Root CA

Obtain the current root CA and the new root CA file in the PEM format.
Perform a preparation step before changing the IP Office identity certificate; place a manually-edited settings file on the IP Office with TRUSTCERTS specifying both the current root CA and the new root CA file
Place both CA files on the SD card/disk in the system/primary directory. For IP Office Linux this will be the opt/ipoffice/system/primary directory
Reset all the phones which can be done remotely via SSA.
The phones will successfully connect to the IP Office, will get the new settings file and will get and install the new trusted root CA.
Change the IP Office identity certificate and remove the manually-edited settings file.
Next time the phones connect they will trust the new identity certificate.

Send Feedback