Use of TLS by an IP Phone

Deployment Tool with TLS

An IP Phone contains both a TLS server and a TLS client. The TLS server is used with the phone's webserver and the phone's XML management in- terface. The TLS client is used with the phone's telephony client. (The PC's telephony server contains a TLS server, while the PC's web client and XML management client are TLS clients). As discussed above, a TLS server re- quires its own key material (private key and public key certificate chain). A TLS client does not require certificates, if server authentication is not re- quired.

Key material is hard-coded into the phone software to allow the phone's TLS server to work by default. The default key material has a two certificate chain consisting of the end-entity certificate and a self-signed CA certifi- cate. Since the certificate chain is transported to the client during the TLS handshake, the client can decide to trust the self-signed certificate, and store it locally for subsequent authentication of other phones, if the client software permits. Key material does not normally include the trusted cer- tificate: the phone's default key material does, as a means of distributing it.

By default, the phone's TLS client is configured not to perform server au- thentication, and has no default trusted certificate.

For improved security, the user can transfer their own server key material and client trusted certificates to the phone, using the XML management interface. The phone will use the new key material and trusted certificates, in preference to the defaults. If the user supplies client trusted certificates, the phone's TLS client will perform server authentication, which must be successful to establish a TLS connection.

The key material is transferred in a single file, containing a private key and matching public key certificate chain. The trusted certificates are trans- ferred in a separate, single file, as an aggregate, not a chain. The phone supports only one server key material file and one client trusted certifi- cates file. The XML management interface allows the user to read back the files, and delete them from the phone. The files are transferred over XML in unencrypted PKCS#12 format.

Instructions for using the Deployment Tool with TLS

The Deployment Tool is a PC application for configuring batches of IP Phones using the XML management interface.

Operating the XML Management Interface over TLS

The Deployment Tool is a TLS client, and authenticates the identity of the TLS servers on the phones it configures. For this, it requires a subject DN and a trusted CA certificate to validate the certificate chains received from the phones during the TLS handshake. Once this is specified, no further action is required to configure either TLS or non-TLS phones. The Tool it- self determines whether or not to use TLS from the type of phone being configured.