Installing Enhanced Validation Certificates for Session Manager

Last Updated : Jul 07, 2026 |
By default, Avaya endpoints perform enhanced validation of certificates. To make use of these certificates, you must populate the Common Name and Subject Alternate Name fields of the certificate. You must perform this procedure for all Session Manager servers and Branch Session Manager servers.
Important:
The endpoints need to trust the System Manager Root Certificate before you replace an SIP or HTTP certificates. Failure to do so results in the loss of communication with the phones.
  1. On the System Manager web console, click ServicesInventory Manage Elements.
  2. Select the appropriate Session Manager instance from the list and click More Actions Manage Identity Certificates.
  3. On the Identity Certificates page, select Security Module SIP.
  4. Click Replace.
  5. On the Replace Identity Certificate page, click Replace this Certificate with Internal CA Signed Certificate.
  6. Select the Common Name (CN) check box and enter the host name of the Security Module.
    ADDITIONAL INFORMATION:
    The host name is the same as the SIP Entity address.
  7. Select RSA as the Key Algorithm.
  8. Select 2048 or 4096 as the Key Size.
  9. Select the DNS Name check box and enter the host name of the Security Module address.
  10. Select the IP Address check box and enter the IP address of the Security Module.
    ADDITIONAL INFORMATION:
    Entries for IPv4 and IPv6 can be entered with a comma separating the addresses (no spaces).
  11. Select the URI check box and enter the SIP domain.
    ADDITIONAL INFORMATION:
    You can enter multiple SIP domains using commas (no spaces), such as sip:avaya.com, sip:company.com, sip:xyz.com.
  12. Click Commit.
  13. On the Identity Certificates page, select Security Module HTTP.
    ADDITIONAL INFORMATION:
    You must mention IPv6 and IPv4 address in SAN field in HTTP and SIP security certificate when TLSSRVRID is set to 1 on 96X1 phones.
  14. Click Replace.
  15. On the Replace Identity Certificate page, select Replace this Certificate with Internal CA Signed Certificate.
  16. Select the Common Name (CN) check box and enter the host name of the Security Module.
    ADDITIONAL INFORMATION:
    The host name is the same as the SIP Entity address.
  17. Select RSA as the Key Algorithm.
  18. Select 2048 or 4096 as the Key Size.
  19. Select the DNS Name check box and enter the host name of the Security Module address.
  20. Select the IP Address check box and enter the IP address of the Security Module.
    ADDITIONAL INFORMATION:
    Entries for IPv4 and IPv6 can be entered with a comma separating the addresses (no spaces).
  21. Click Commit.
  22. Restart all phones.
    STEP RESULT:
    After rebooting, the phones download the System Manager Root CA and can communicate with the Session Manager.