802.1x Certificates - Revision history

Hans.zeiner: /* Phone-certificate */

2020-02-07T12:25:39Z

‎Phone-certificate

HP: /* 3. Difference between optiPoint und OpenStage */

2010-03-29T06:45:42Z

‎3. Difference between optiPoint und OpenStage

HP: /* 2. Rules for logon names */

2010-03-29T06:45:29Z

‎2. Rules for logon names

HP: /* 2. Rules for logon names */

2010-03-29T06:42:45Z

‎2. Rules for logon names

HP: /* 2. Difference between optiPoint und OpenStage */

2010-03-29T06:42:23Z

‎2. Difference between optiPoint und OpenStage

HP: /* 2. Difference between optiPoint und OpenStage */

2010-03-29T06:12:53Z

‎2. Difference between optiPoint und OpenStage

HP: /* 2. Unterschiede zwischen optiPoint und OpenStage */

2010-03-29T06:11:51Z

‎2. Unterschiede zwischen optiPoint und OpenStage

HP: /* RootCA-Zertifikat */

2010-03-29T06:06:49Z

‎RootCA-Zertifikat

HP: /* 1. Grundsätzliche Eckdaten zu 802.1x Zertifikaten */

2010-03-29T06:05:59Z

‎1. Grundsätzliche Eckdaten zu 802.1x Zertifikaten

Stefan.Beck: Added link to german version

2009-10-14T19:11:17Z

Added link to german version

@@ Line 18: / Line 18: @@
 === Phone-certificate ===
 * X509v3 Extended Key Usage: Client Authentication
-* RSA Public Key: (1024 bit) with optiPoint, (2048 bit) with OpenStage
+* RSA Public Key: (1024 bit) with optiPoint, (2048 bit) with OpenStage, (4096 bit) with CP phones
 === RADIUS-certificate ===

@@ Line 55: / Line 55: @@
 ** User certificates must be installed in the Current User certificate store.
 ** User certificates must contain the user principal name (UPN) of the user account in the Subject Alternative Name property.
 == 3. Difference between optiPoint und OpenStage ==

@@ Line 42: / Line 42: @@
 * The certificate element "CommonName" must meet the requirements of Microsoft's "Rules of Logon Names" (e.g. http://technet.microsoft.com/en-us/library/bb726984.aspx) respectively UPN (User Principal Names)(MS Windows Server 2003, Internet Authentication Service (IAS) Operation Guide)
 * Logon names must follow these rules
-** Phone-certificate(certificate chain + priv. key in PKCS#12 container)
+** Local logon names must be unique on a workstation and global logon names must be unique throughout a domain.
-** RootCA-certificate (= public key = first element of the RADIUS-certificate chain) or
+** Logon names can be up to 104 characters. However, it isn't practical to use logon names that are longer than 64 characters.
-** RADIUS-certificate (= public key des RADIUS-certificates)
+** A Microsoft Windows NT version 4.0 or earlier logon name is given to all accounts, which by default is set to the first 20 characters of the Windows 2000 logon name. The Windows NT version 4.0 or earlier logon name must be unique throughout a domain.
-** Key size: 1024 Bit
+** Users logging on to the domain from Windows 2000 computers can use their Windows 2000 logon name or their Windows NT version 4.0 or earlier logon name, regardless of the domain operations mode.#
-* OpenStage SIP/HFA:
+** Logon names can't contain certain characters. Invalid characters are " / \ [ ] : ; | = , + * ? < >
-** Phone-certificate (certificate chain + priv. key in PKCS#12 container)
+** Logon names can contain all other special characters, including spaces, periods, dashes, and underscores. But it's generally not a good idea to use spaces in account names.
 * Certificates on Wired Client Computers: For the user and computer certificates installed on wired client computers, the following must be true
 ** They must have a corresponding private key.

@@ Line 37: / Line 37: @@
 ** X509v3 basic constraints: critical, CA:TRUE
 ** X509v3 Key usage: critical, digital signature, certificate sign, CRL Sign
 == 2. Rules for logon names==
@@ Line 56: / Line 57: @@
 ** User certificates must be installed in the Current User certificate store.
 ** User certificates must contain the user principal name (UPN) of the user account in the Subject Alternative Name property.
 == 3. Difference between optiPoint und OpenStage ==

@@ Line 38: / Line 38: @@
 ** X509v3 Key usage: critical, digital signature, certificate sign, CRL Sign
-== 2. Difference between optiPoint und OpenStage ==
+== 2. Rules for logon names==
 * optiPoint SIP/HFA:
 ** Phone-certificate(certificate chain + priv. key in PKCS#12 container)

@@ Line 32: / Line 32: @@
 * X509v3 Key Usage: critical, Digital Signature, Certificate Sign, CRL Sign
-== RootCA-Zertifikat ==
+== RootCA-certificate ==
-* RSA Public Key: (2048/4096 bit)
+* RSA public key: (2048/4096 bit)
 * X509v3 extensions:
-** X509v3 Basic Constraints: critical, CA:TRUE
+** X509v3 basic constraints: critical, CA:TRUE
-** X509v3 Key Usage: critical, Digital Signature, Certificate Sign, CRL Sign
+** X509v3 Key usage: critical, digital signature, certificate sign, CRL Sign
 == 2. Unterschiede zwischen optiPoint und OpenStage ==

@@ Line 7: / Line 7: @@
 This page summarizes the requirements for certificates and their properties, as they apply to the 802.1x (EAP-TLS) authentication of OpenStage and optiPoint IP phones.
-== 1. Grundsätzliche Eckdaten zu 802.1x Zertifikaten ==
+== 1. Basic requirements to 802.1x certificates ==
-* Der Verwendungszweck muss "Client Authentication" sein.
+* The intended purpose must be "client authentication".
-* Der Einsatzzweck ist "Signatur und Verschlüsselung".
+* The purpose to use must be "signature and encryption".
-* Typ ist X.509-Zertifikat, Version: 3.
+* The type is X.509-certificate, version: 3.
-* Die Algorithmusklasse für den privaten Schlüssel ist: 0xa000(5) ALG_CLASS_KEY_EXCHANGE
+* The algorithm class for the private dey is: 0xa000(5) ALG_CLASS_KEY_EXCHANGE
-* Standardmäßig wird sha1RSA verwendet, es kann aber auf diverse andere Algorithmen zurückgegriffen werden, sofern diese Algorithmen von OpenSSL und z.B. Win2003 unterstützt werden.
+* Normally is used sha1RSA, however, it can be fallen back on various other algorithms, provided that these algorithms are supported by OpenSSL and e.g. Win2003.
-* Aus DLS-Sicht sind beliebige X.509 V3 Zertifikate möglich. Einzige Einschränkung ist die Größe (max ca. 7kB).
+* From DLS view there are any X.509 V3 certificates possible. The only restriction is the size (max. approx. 7kB).
-=== Phone-Zertifikat ===
+=== Phone-certificate ===
 * X509v3 Extended Key Usage: Client Authentication
-* RSA Public Key: (1024 bit) bei Optipoint, (2048 bit) bei OpenStage
+* RSA Public Key: (1024 bit) with optiPoint, (2048 bit) with OpenStage
-=== RADIUS-Zertifikat ===
+=== RADIUS-certificate ===
 * RSA Public Key: (2048 bit)
 * X509v3 extensions:
-* X509v3 Key Usage: critical, Digital Signature, Key Encipherment, Key Agreement, Certificate Sign
+* X509v3 Key usage: critical, digital signature, key Encipherment, key agreement, certificate Sign
-* X509v3 Extended Key Usage: Server Authentication, Client Authentication
+* X509v3 Extended key usage: server authentication, client authentication
-=== SubCA-Zertifikat ===
+=== SubCA-certificate ===
 * RSA Public Key: (2048/4096 bit)
 * X509v3 extensions:

← Older revision		Revision as of 19:11, 14 October 2009
Line 1:		Line 1:
−	''ToDo: Page to be translated to English - any contribution is welcome!~~<br/>For the German version see [[802.1x_Zertifikate]].~~''	+	<div class="breadcrumb">
		+	{{de}} [[802.1x_Zertifikate]]
		+	</div>
		+
		+	''ToDo: Page to be translated to English - any contribution is welcome!''

	This page summarizes the requirements for certificates and their properties, as they apply to the 802.1x (EAP-TLS) authentication of OpenStage and optiPoint IP phones.		This page summarizes the requirements for certificates and their properties, as they apply to the 802.1x (EAP-TLS) authentication of OpenStage and optiPoint IP phones.