Snom Service Hub

Content

Page tree

Situation

Secure endpoint provisioning requires an encrypted HTTP connection (HTTPS) between endpoint and server. For this, our phones come equipped with several well known, and commonly used pre-installed certificates issued by trusted authorities such as DigiCert, VeriSign, Thawte, and others. 

If a customer prefers to use his own self-signed certificate, he can do so by uploading the certificate to the phone. This is typically done in a so called staging step , prior to the auto-provisioning of the phone.


1. Configuration File

Prepare a small configuration file with either a download link to where the self-signed certificate is stored, or with the base-64 encoded certificate already pasted in.

Link with download path
<?xml version="1.0" encoding="utf-8" ?>
<certificates>
 <certificate url="http://192.168.1.101/trusted_cert1.DER" />
 <certificate url="http://192.168.1.101/trusted_cert2.DER" />
</certificates>
Certificate within the same file
<?xml version="1.0" encoding="utf-8" ?>
<settings>
<phone-settings e="2">
  [...]
</phone-settings>
<certificate type="base64">
-----BEGIN CERTIFICATE-----
MIICgjCCAiygAwIBAgIJAP3LcHE/YXO0MA0GCSqGSIb3DQEBBQUAMGExCzAJBgNV
BAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBX
aWRnaXRzIFB0eSBMdGQxGjAYBgNVBAMTEWxhYi5zbm9tb25lLmxvY2FsMB4XDTEw
MDYyODEzMTUzNFoXDTExMDYyODEzMTUzNFowYTELMAkGA1UEBhMCQVUxEzARBgNV
BAgTClNvbWUtU3RhdGUxITAfBgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0
ZDEaMBgGA1UEAxMRbGFiLnNub21vbmUubG9jYWwwXDANBgkqhkiG9w0BAQEFAANL
ADBIAkEAxz7NB5Pc8zIfSklWAbMNOndX8guj73Q9vGz/ESoVXh/N1b5iVTYMTcN7
7dllq8hE3i/7tF7gqoXJjANmjTs2XwIDAQABo4HGMIHDMB0GA1UdDgQWBBT+HGLO
WZoa2iqc4v44Mu6hcqxWxzCBkwYDVR0jBIGLMIGIgBT+HGLOWZoa2iqc4v44Mu6h
cqxWx6FlpGMwYTELMAkGA1UEBhMCQVUxEzARBgNVBAgTClNvbWUtU3RhdGUxITAf
BgNVBAoTGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEaMBgGA1UEAxMRbGFiLnNu
b21vbmUubG9jYWyCCQD9y3BxP2FztDAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEB
BQUAA0EAJSyG8d3VI9fR14M0VN7+8C/YtI09Lf/X7UHo3FcFpOgISbmM5UH01an9
9wKxhzrIqlM52TAvWrl+mfOJf/MNyQ==
-----END CERTIFICATE-----
-----BEGIN RSA PRIVATE KEY-----
MIIBOwIBAAJBAMc+zQeT3PMyH0pJVgGzDTp3V/ILo+90Pbxs/xEqFV4fzdW+YlU2
DE3De+3ZZavIRN4v+7Re4KqFyYwDZo07Nl8CAwEAAQJASqh4kSdRunsEiIR0Ssy5
3zeK57J+6iHnZCx/YwIe4ZZlu2qBHvqQYxawNSaUU9grzLNgEv6FVovkARX5eHDv
OQIhAO6PbFz/rOG7Qg8AIWsR8HIgaph9wMsi9OUHnOGY9WVrAiEA1c+cj/0F0kSf
JK/ZoqdOfdf6G5TJzUvBx2QIK3bJO90CICSptiW0xYULmmNjyb8Cysk/YiJ9cRvH
C4wHV3z0XQJxAiEA0oM89Q/8gVCLGEYDlAACaikR2cIfBwDF5Bl7ab/k1gkCIQDZ
urS1O2EogcYakaU0Y5baGNtQZz2WFvh72XgtoCYRAw==
-----END RSA PRIVATE KEY-----
</certificate>


2. Redirect the phone to the certificate file

  • Make sure you have local redirection set up in a secure environment.
  • When the phone boots up, it will fetch the file, download and store the self-signed certificate.
  • On the next boot up, it will use the self-signed certificate to authenticate the provisioning server redirected to.

Further Information


Related articles