Difference between revisions of "802.1x Certificates"
The Wiki of Unify contains information on clients and devices, communications systems and unified communications. - Unify GmbH & Co. KG is a Trademark Licensee of Siemens AG.
(→RootCA-Zertifikat) |
(→2. Unterschiede zwischen optiPoint und OpenStage) |
||
| Line 38: | Line 38: | ||
** X509v3 Key usage: critical, digital signature, certificate sign, CRL Sign | ** X509v3 Key usage: critical, digital signature, certificate sign, CRL Sign | ||
| − | == 2. | + | == 2. Difference between optiPoint und OpenStage == |
| − | * | + | * optiPoint SIP/HFA: |
| − | ** Phone- | + | ** Phone-certificate(certificate chain + priv. key in PKCS#12 container) |
| − | ** RootCA- | + | ** RootCA-certificate (= public key = first element of the RADIUS-certificate chain) or |
| − | ** RADIUS- | + | ** RADIUS-certificate (= public key des RADIUS-certificates) |
| − | ** Key | + | ** Key size: 1024 Bit |
| − | * OpenStage SIP/HFA | + | * OpenStage SIP/HFA |
| − | ** Phone- | + | ** Phone-certificate (certificate chain + priv. key in PKCS#12 container) |
| − | ** RootCA- | + | ** RootCA-certificate (= public key = first element of the RADIUS-certificate chain) |
| − | ** Key | + | ** Key size: max. 2048 Bit, should be limited for reasons of the compatibility to optiPoint to 1024 bits. |
Revision as of 06:11, 29 March 2010
ToDo: Page to be translated to English - any contribution is welcome!
This page summarizes the requirements for certificates and their properties, as they apply to the 802.1x (EAP-TLS) authentication of OpenStage and optiPoint IP phones.
Contents
1. Basic requirements to 802.1x certificates
- The intended purpose must be "client authentication".
- The purpose to use must be "signature and encryption".
- The type is X.509-certificate, version: 3.
- The algorithm class for the private dey is: 0xa000(5) ALG_CLASS_KEY_EXCHANGE
- Normally is used sha1RSA, however, it can be fallen back on various other algorithms, provided that these algorithms are supported by OpenSSL and e.g. Win2003.
- From DLS view there are any X.509 V3 certificates possible. The only restriction is the size (max. approx. 7kB).
Phone-certificate
- X509v3 Extended Key Usage: Client Authentication
- RSA Public Key: (1024 bit) with optiPoint, (2048 bit) with OpenStage
RADIUS-certificate
- RSA Public Key: (2048 bit)
- X509v3 extensions:
- X509v3 Key usage: critical, digital signature, key Encipherment, key agreement, certificate Sign
- X509v3 Extended key usage: server authentication, client authentication
SubCA-certificate
- RSA Public Key: (2048/4096 bit)
- X509v3 extensions:
- X509v3 Basic Constraints: critical, CA:TRUE
- X509v3 Key Usage: critical, Digital Signature, Certificate Sign, CRL Sign
RootCA-certificate
- RSA public key: (2048/4096 bit)
- X509v3 extensions:
- X509v3 basic constraints: critical, CA:TRUE
- X509v3 Key usage: critical, digital signature, certificate sign, CRL Sign
2. Difference between optiPoint und OpenStage
- optiPoint SIP/HFA:
- Phone-certificate(certificate chain + priv. key in PKCS#12 container)
- RootCA-certificate (= public key = first element of the RADIUS-certificate chain) or
- RADIUS-certificate (= public key des RADIUS-certificates)
- Key size: 1024 Bit
- OpenStage SIP/HFA
- Phone-certificate (certificate chain + priv. key in PKCS#12 container)
- RootCA-certificate (= public key = first element of the RADIUS-certificate chain)
- Key size: max. 2048 Bit, should be limited for reasons of the compatibility to optiPoint to 1024 bits.
