Views

Difference between revisions of "802.1x Certificates"

The Wiki of Unify contains information on clients and devices, communications systems and unified communications. - Unify GmbH & Co. KG is a Trademark Licensee of Siemens AG.

Jump to: navigation, search
(RootCA-Zertifikat)
(2. Unterschiede zwischen optiPoint und OpenStage)
Line 38: Line 38:
 
** X509v3 Key usage: critical, digital signature, certificate sign, CRL Sign
 
** X509v3 Key usage: critical, digital signature, certificate sign, CRL Sign
  
== 2. Unterschiede zwischen optiPoint und OpenStage ==
+
== 2. Difference between optiPoint und OpenStage ==
* OptiPoint SIP/HFA:  
+
* optiPoint SIP/HFA:  
** Phone-Zertifikat (Zertifikatskette + priv. Key in PKCS#12 Container)
+
** Phone-certificate(certificate chain + priv. key in PKCS#12 container)
** RootCA-Zertifikat (= public Key = erstes Glied der RADIUS-Zertifikatskette) oder
+
** RootCA-certificate (= public key = first element of the RADIUS-certificate chain) or
** RADIUS-Zertifikat (= public Key des RADIUS-Zertifikates)
+
** RADIUS-certificate (= public key des RADIUS-certificates)
** Key Size: 1024 Bit
+
** Key size: 1024 Bit
* OpenStage SIP/HFA (für OpenStage HFA wird 802.1x ab V2R0 freigeben):
+
* OpenStage SIP/HFA  
** Phone-Zertifikat (Zertifikatskette + priv. Key in PKCS#12 Container)
+
** Phone-certificate (certificate chain + priv. key in PKCS#12 container)
** RootCA-Zertifikat (= public Key = erstes Glied der RADIUS-Zertifikatskette)
+
** RootCA-certificate (= public key = first element of the RADIUS-certificate chain)
** Key Size: max. 2048 Bit, sollte aber aus Gründen der Kompatibilität zum optiPoint auf 1024 Bit beschränkt werden.
+
** Key size: max. 2048 Bit, should be limited for reasons of the compatibility to optiPoint to 1024 bits.

Revision as of 06:11, 29 March 2010

ToDo: Page to be translated to English - any contribution is welcome!

This page summarizes the requirements for certificates and their properties, as they apply to the 802.1x (EAP-TLS) authentication of OpenStage and optiPoint IP phones.

1. Basic requirements to 802.1x certificates

  • The intended purpose must be "client authentication".
  • The purpose to use must be "signature and encryption".
  • The type is X.509-certificate, version: 3.
  • The algorithm class for the private dey is: 0xa000(5) ALG_CLASS_KEY_EXCHANGE
  • Normally is used sha1RSA, however, it can be fallen back on various other algorithms, provided that these algorithms are supported by OpenSSL and e.g. Win2003.
  • From DLS view there are any X.509 V3 certificates possible. The only restriction is the size (max. approx. 7kB).

Phone-certificate

  • X509v3 Extended Key Usage: Client Authentication
  • RSA Public Key: (1024 bit) with optiPoint, (2048 bit) with OpenStage

RADIUS-certificate

  • RSA Public Key: (2048 bit)
  • X509v3 extensions:
  • X509v3 Key usage: critical, digital signature, key Encipherment, key agreement, certificate Sign
  • X509v3 Extended key usage: server authentication, client authentication

SubCA-certificate

  • RSA Public Key: (2048/4096 bit)
  • X509v3 extensions:
  • X509v3 Basic Constraints: critical, CA:TRUE
  • X509v3 Key Usage: critical, Digital Signature, Certificate Sign, CRL Sign

RootCA-certificate

  • RSA public key: (2048/4096 bit)
  • X509v3 extensions:
    • X509v3 basic constraints: critical, CA:TRUE
    • X509v3 Key usage: critical, digital signature, certificate sign, CRL Sign

2. Difference between optiPoint und OpenStage

  • optiPoint SIP/HFA:
    • Phone-certificate(certificate chain + priv. key in PKCS#12 container)
    • RootCA-certificate (= public key = first element of the RADIUS-certificate chain) or
    • RADIUS-certificate (= public key des RADIUS-certificates)
    • Key size: 1024 Bit
  • OpenStage SIP/HFA
    • Phone-certificate (certificate chain + priv. key in PKCS#12 container)
    • RootCA-certificate (= public key = first element of the RADIUS-certificate chain)
    • Key size: max. 2048 Bit, should be limited for reasons of the compatibility to optiPoint to 1024 bits.