Untrusted SIP TLS connections
For untrusted SIP TLS connections such as SIP endpoints, Session Manager validation depends on the version and its configuration:
-
For Session Manager 7.0.0 and earlier, the Enable TLS Endpoint Certificate Validation setting on the Session Manager Administration page controls the validation:
-
If the Enable TLS Endpoint Certificate Validation check box is selected, Session Manager requests a client certificate through the TLS Certificate Request message:
-
If the client provides an identity certificate, its certificate chain must be traced to a trusted CA certificate to establish the connection to
-
If the client does not provide a certificate, the connection is allowed.
-
If the Enable TLS Endpoint Certificate Validation check box is cleared, no TLS client authentication is performed.
-
For Session Manager 7.0.1 and later, the TLS Endpoint Certificate Validation setting on the Session Manager Administration page controls the validation performed on the client certificate. Session Manager requests a client certificate through the TLS Certificate Request message, and its validation depends on the configuration value:
-
If TLS Endpoint Certificate Validation is set to Required.
-
If the client provides a certificate, its certificate chain must be traced to a trusted CA certificate in order to connect.
-
If the client does not provide a certificate, the connection is refused.
-
If the TLS Endpoint Certificate Validation field is set to Optional:
-
If the client provides a certificate, its certificate chain must be traced to a trusted CA certificate in order to connect.
-
If the client does not provide a certificate, the connection is allowed.
-
If the TLS Endpoint Certificate Validation field is set to None:
-
If the client provides a certificate, its certificate is saved for reporting but not validated. The connection is allowed.
-
If the client does not provide a certificate, the connection is allowed.
