Replacing Default Staging certificates

Last Updated : Dec 02, 2024 |
Prolog information
Metadata
Keywords:
When you install Avaya Aura® MS, the system dynamically creates the self-signed certificates for the media server for each-installation. These dynamically created certificates contain a key certificate for the media server and the certificate of a private Certificate Authority (CA) that signs the key certificate.
If the media server generated certificate is in use, Avaya Aura® MS will generate an alarm.
Important:
The media server generated certificates are not considered secure. It is mandatory to replace the media server generated certificates soon after installation.
Before you begin
Ensure you have access to an organization-approved CA for the required certificate generation.
  1. Generate a unique key certificate for the media server using one of the following options for the signing CA:
    Avaya Aura® System Manager
    See Creating a new certificate signed by System Manager as the root certificate authority in the key store or
    Creating a new certificate signed by System Manager as the intermediate certificate authority in the key store to create a System Manager-signed key certificate.
    Another CA (internal or external)
    See Creating a new certificate to be signed by other Certificate Authorities in the key store and
    Processing a Certificate Signing Request Response in the key store for details to use another CA to create a key certificate.
    ADDITIONAL INFORMATION:
    Important:
    Ensure to use the same CA to sign the key certificates for the servers in the same cluster. If the signing CA is not System Manager, you also need to import the CA certificate into the trust store of each server. For more information on importing a CA certificate, see Importing a trust certificate to the trust store.
  2. Assign the generated key certificate to all MS service profiles, see Assigning a certificate to a service profile.
  3. Delete the default staging key certificate from the key store, see Deleting a key certificate from the key store.
  4. Delete the default staging CA certificate from the trust store, see Deleting Certificate Authorities from the trust store.
  5. Reboot the media server for the certificate configuration changes to take effect.
Related links
Creating a new certificate signed by System Manager as the root certificate authority in the key store
Creating a new certificate signed by System Manager as the intermediate certificate authority in the key store
Creating a new certificate to be signed by other Certificate Authorities in the key store
Processing a Certificate Signing Request Response in the key store
Importing a trust certificate to the trust store
Assigning a certificate to a service profile
Deleting a key certificate from the key store
Deleting Certificate Authorities from the trust store