By default, the Primary or Linux Applications Servers' own identity certificate is automatically created and signed by the internal CA. It is also automatically re-generated if the LAN1 IP Address, LAN2 IP Address or hostname is changed. This is controlled by the Web Management setting Platform ViewSettingsGeneralCertificatesIdentity CertificatesRenew automatically.
To manually create an identity certificate for the CA server:
Uncheck the setting Platform ViewSettingsGeneralCertificatesIdentity CertificatesCreate certificate for a different machine.
Enter a unique subject name if the default offered is not acceptable. See Certificate Name Content for more information.
Enter the subject alternative names if the default offered is not acceptable. It is recommended that a full set of subject alternative names are supplied to ensure compatibility with various Avaya clients and endpoints:
DNS:<FQDN of server>, IP:<LAN1 IP address>, IP:<LAN2 IP address>, IP:<Public IP address>, DNS:<SIP domain>, URI:sip:<SIP domain>, URI: <LAN1 IP address>, URI: <LAN2 IP address>
Enter the number of days the certificate will be valid for. The start date/time will be the current UTC time of the server. The end date/time will be start time + number of days. Identity certificates should not be valid for more than three years (1095 days). The longer the period, the greater the risk of certificate compromise.
Enter the Public Key Algorithm. This should be RSA-2048.
Enter the Secure Hash Algorithm. This should be SHA-256.
Check the settings and then click Generate and Apply. This will cause the server to generate and apply the new certificate to all interfaces during which service loss will occur.
