Session Manager provides validation of the endpoint Transport Layer Security (TLS) certificate. This authentication is applicable to SIP and HTTP traffic.
Session Manager provides the ability for administrators, while authenticating SIP devices, to choose the following:
No Mutual Authentication
Optional Mutual Authentication
Mandatory Mutual Authentication
The TLS Endpoint Certificate Validation field has three options:
None: No mutual authentication occurs. There is no certificate validation and SIP endpoint can establish the connection.
Optional: Communication occurs if the endpoint presents a valid certificate or otherwise.
Required: Communication occurs only if the endpoint presents a valid certificate trusted by Session Manager.
The default setting for the upgrades, as well as new installations, is optional mutual authentication. You can decide to change the setting to no or mandatory mutual authentication. If you select mandatory mutual authentication for the TLS Endpoint Certificate Validation field, Session Manager rejects the connection request if:
a client does not provide a certificate or,
the client certificate is invalid or not trusted by Session Manager.
Note:
If you select the Required option for Session Manager 7.0 or earlier, it results in the Optional option to support backward compatibility.
Implementation of the new TLS validation policy supports network configuration of Session Manager 7.0 and later with the earlier versions of Session Manager or Branch Session Manager.
