Content
Situation
Secure endpoint provisioning requires an encrypted HTTP connection (HTTPS) between endpoint and server. For this, our phones come equipped with several well known, and commonly used pre-installed certificates issued by trusted authorities such as DigiCert, VeriSign, Thawte, and others.Â
If a customer prefers to use his own self-signed certificate, he can do so by uploading the certificate to the phone. This is typically done in a so called staging step , prior to the auto-provisioning of the phone.
1. Configuration File
Prepare a small configuration file with either a download link to where the self-signed certificate is stored, or with the base-64 encoded certificate already pasted in.
Link with download path
<?xml version="1.0" encoding="utf-8" ?> <certificates> <certificate url="http://192.168.1.101/trusted_cert1.DER" /> <certificate url="http://192.168.1.101/trusted_cert2.DER" /> </certificates>
Certificate within the same file
<?xml version="1.0" encoding="utf-8" ?> <settings> <phone-settings e="2"> [...] </phone-settings> <certificate type="base64"> -----BEGIN CERTIFICATE----- MIICgjCCAiygAwIBAgIJAP3LcHE/YXO0MA0GCSqGSIb3DQEBBQUAMGExCzAJBgNV BAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBX aWRnaXRzIFB0eSBMdGQxGjAYBgNVBAMTEWxhYi5zbm9tb25lLmxvY2FsMB4XDTEw MDYyODEzMTUzNFoXDTExMDYyODEzMTUzNFowYTELMAkGA1UEBhMCQVUxEzARBgNV BAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0 ZDEaMBgGA1UEAxMRbGFiLnNub21vbmUubG9jYWwwXDANBgkqhkiG9w0BAQEFAANL ADBIAkEAxz7NB5Pc8zIfSklWAbMNOndX8guj73Q9vGz/ESoVXh/N1b5iVTYMTcN7 7dllq8hE3i/7tF7gqoXJjANmjTs2XwIDAQABo4HGMIHDMB0GA1UdDgQWBBT+HGLO WZoa2iqc4v44Mu6hcqxWxzCBkwYDVR0jBIGLMIGIgBT+HGLOWZoa2iqc4v44Mu6h cqxWx6FlpGMwYTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAf BgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEaMBgGA1UEAxMRbGFiLnNu b21vbmUubG9jYWyCCQD9y3BxP2FztDAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEB BQUAA0EAJSyG8d3VI9fR14M0VN7+8C/YtI09Lf/X7UHo3FcFpOgISbmM5UH01an9 9wKxhzrIqlM52TAvWrl+mfOJf/MNyQ== -----END CERTIFICATE----- -----BEGIN RSA PRIVATE KEY----- MIIBOwIBAAJBAMc+zQeT3PMyH0pJVgGzDTp3V/ILo+90Pbxs/xEqFV4fzdW+YlU2 DE3De+3ZZavIRN4v+7Re4KqFyYwDZo07Nl8CAwEAAQJASqh4kSdRunsEiIR0Ssy5 3zeK57J+6iHnZCx/YwIe4ZZlu2qBHvqQYxawNSaUU9grzLNgEv6FVovkARX5eHDv OQIhAO6PbFz/rOG7Qg8AIWsR8HIgaph9wMsi9OUHnOGY9WVrAiEA1c+cj/0F0kSf JK/ZoqdOfdf6G5TJzUvBx2QIK3bJO90CICSptiW0xYULmmNjyb8Cysk/YiJ9cRvH C4wHV3z0XQJxAiEA0oM89Q/8gVCLGEYDlAACaikR2cIfBwDF5Bl7ab/k1gkCIQDZ urS1O2EogcYakaU0Y5baGNtQZz2WFvh72XgtoCYRAw== -----END RSA PRIVATE KEY----- </certificate>
2. Redirect the phone to the certificate file
- Make sure you have local redirection set up in a secure environment.
- When the phone boots up, it will fetch the file, download and store the self-signed certificate.
- On the next boot up, it will use the self-signed certificate to authenticate the provisioning server redirected to.
Further Information
Related articles
Overview
Content Tools
Tasks
