Checklist for establishing end-to-end TLS communications

Last Updated : Nov 05, 2019 |

Prerequisites

To establish end-to-end TLS communication, it is assumed that:

  • Avaya SBC must have an existing, working end-to-end TLS remote user setup using the default Avaya certificates and profiles.

    Note:

    If you want to use Avaya default certificates and profiles, skip Steps 1 through 5, and go directly to step 6.

  • The remote phones must already have the third-party CA root certificate installed.

  • The Session Manager and Communication Manager systems must be configured for TLS and already have the third-party CA root certificate installed.

  • The same CA root certificate must have directly signed all relevant certificates.

No.

Task

Description

1

Install the trusted third-party CA root certificate.

This procedure ensures that Avaya SBC can identify and communicate with all external entities.

2

Generate a certificate signing request.

A CSR must be generated for Avaya SBC for signing by the CA. The signed certificate is used to identify the Avaya SBC. For more information, see Creating a CSR.

3

Install the third-party certificate.

After the CA signs the CSR, upload the signed CSR to Avaya SBC. For more information, see Installing certificates.

4

Create a TLS server profile.

After installing certificates, create a TLS profile to define the TLS settings for incoming connections. After all of the certificates are installed, a TLS profile must be created to define the TLS settings for incoming connections. For this case, the Avaya SBC will require mutual authentication from all incoming connections and verification that the certificate was signed directly by the CA root certificate. To achieve this, create a TLS server profile with the following settings:

  • Profile Name: ThirdPartyServer

  • Certificate: certificate.crt

  • Peer Verification: Required

  • Peer Certificate Authorities: root-ca.crt

  • Peer Certificate Revocation List: None

  • Verification Depth: 1

  • Renegotiation Time: 0

  • Renegotiation Byte Count: 0

  • Ciphers: All

  • Options: None Checked

  • Value: N/A

For more information, see Creating a server profile.

5

Create a TLS client profile.

Next, create a TLS client profile to define how outgoing TLS connections should be handled. For this case, the Avaya SBC verifies that the remote server identity certificate was signed by the CA root certificate and provides the configured certificate for mutual authentication. To achieve this, create a TLS client profile with the following settings:

  • Profile Name: ThirdPartyClient

  • Certificate: certificate.crt

  • Peer Verification: Required

  • Peer Certificate Authorities: root-ca.crt

  • Peer Certificate Revocation List: None

  • Verification Depth: 1

  • Renegotiation Time: 0

  • Renegotiation Byte Count: 0

  • Ciphers: All

  • Options: None Checked

  • Value: N/A

For more information, see Creating a client profile.

6

Update the signaling interface.

After the TLS profiles are set up, you must associate the profiles to the correct components. The Signaling Interface is the entry point for any incoming signaling traffic from the endpoints or feature servers to the Avaya SBC.

Note:

A TLS server profile cannot be configured unless a TLS port has been configured for a signaling interface.

For more information, see Editing an existing signaling interface.

7

Update the subscriber flow.

To enable the Avaya SBC in establishing a TLS connection back towards the phone, you must update the subscriber flow to use the TLS client profile.

For more information, see Editing an existing subscriber flow.

8

Update the server configuration for the call server.

Finally, update the server configuration profiles for the relevant SIP servers. As these define how the Avaya SBC connects to each respective SIP server, they will require a TLS client profile in order to be able to connect via TLS.

Note:

A TLS server profile cannot be configured unless a TLS port has been configured for a server configuration.

For more information, see Editing a SIP Server profile.