![](/images/new-backgrounds/1256928/256928169x1.webp)
Deployment Tool with TLS
Use of TLS by an IP Phone
An IP Phone contains both a TLS server and a TLS client. The TLS server is used with the phone's webserver and the phone's XML management in- terface. The TLS client is used with the phone's telephony client. (The PC's telephony server contains a TLS server, while the PC's web client and XML management client are TLS clients). As discussed above, a TLS server re- quires its own key material (private key and public key certificate chain). A TLS client does not require certificates, if server authentication is not re- quired.
Key material is
By default, the phone's TLS client is configured not to perform server au- thentication, and has no default trusted certificate.
For improved security, the user can transfer their own server key material and client trusted certificates to the phone, using the XML management interface. The phone will use the new key material and trusted certificates, in preference to the defaults. If the user supplies client trusted certificates, the phone's TLS client will perform server authentication, which must be successful to establish a TLS connection.
The key material is transferred in a single file, containing a private key and matching public key certificate chain. The trusted certificates are trans- ferred in a separate, single file, as an aggregate, not a chain. The phone supports only one server key material file and one client trusted certifi- cates file. The XML management interface allows the user to read back the files, and delete them from the phone. The files are transferred over XML in unencrypted PKCS#12 format.
Instructions for using the Deployment Tool with TLS
The Deployment Tool is a PC application for configuring batches of IP Phones using the XML management interface.
Operating the XML Management Interface over TLS
The Deployment Tool is a TLS client, and authenticates the identity of the TLS servers on the phones it configures. For this, it requires a subject DN and a trusted CA certificate to validate the certificate chains received from the phones during the TLS handshake. Once this is specified, no further action is required to configure either TLS or
85