AdminGuide:Service:SSLSettings/en - Cronologia

Troccoli il 08:40, 21 set 2022

2022-09-21T08:40:13Z

← Versione meno recente		Versione delle 08:40, 21 set 2022
Riga 15:		Riga 15:
	The server certificate is rarely issued directly from one of the CAs on the phone, since they are no-root CAs. Often certificates are issued by intermediate CAs.		The server certificate is rarely issued directly from one of the CAs on the phone, since they are no-root CAs. Often certificates are issued by intermediate CAs.

	'''N.B.'''' It is important to remember the correct sequence of the chain: root CA > intermediate CA > server certificates		'''N.B.''' It is important to remember the correct sequence of the chain: root CA > intermediate CA > server certificates

Troccoli: Creata pagina con "* Download root certificate (.pem) * Download root certificate (.der) * Delete local CA"

2022-07-25T13:09:56Z

Creata pagina con "* Download root certificate (.pem) * Download root certificate (.der) * Delete local CA"

← Versione meno recente		Versione delle 13:09, 25 lug 2022
Riga 52:		Riga 52:
	In this section you can observe the '''Root Certificate Details''' and the '''Certificates List'''.		In this section you can observe the '''Root Certificate Details''' and the '''Certificates List'''.

	~~<div lang="it" dir="ltr" class="mw-content-ltr">~~		It is also possible to:
	~~È anche possibile~~:		* Emit new certificate and to insert:
	* ~~emettere un nuovo certificato premendo su "Emetti nuovo certificato" e inserendo~~:		new certificate details and Subject Alternative Names:
	~~i dettagli del nuovo certificato e le identità aggiuntive~~:		** Install as server certificate
	** ~~Installa come un certificato del~~ server		** Country
	** ~~Stato~~		** State
	** ~~Provincia~~		** Locality
	** ~~Località~~		** Organization
	** ~~Ente~~		** Organizational unit
	** ~~Reparto~~		** Common name
	** ~~Nome comune~~
	** E-mail		** E-mail
	~~</div>~~

	~~<div lang="it" dir="ltr" class="mw-content-ltr">~~		* Download root certificate (.pem)
	* ~~Scaricare il certificato di~~ root ~~della CA locale~~ (.pem)		* Download root certificate (.der)
	* ~~Scaricare il certificato di~~ root ~~della CA locale~~ (.der)		* Delete local CA
	* ~~Eliminare l'autorità di certificazione locale~~
	~~</div>~~

FuzzyBot: Aggiornamento come da nuova versione della pagina di origine

2022-07-25T13:01:27Z

Aggiornamento come da nuova versione della pagina di origine

← Versione meno recente		Versione delle 13:01, 25 lug 2022
Riga 35:		Riga 35:
	By default, on all Kalliope, there is a self-assigned certificate that is issued by a self-generated, in-house CA.		By default, on all Kalliope, there is a self-assigned certificate that is issued by a self-generated, in-house CA.

	A new certificate ~~can be issued~~ by clicking on "Create new CSR" and entering:		You can create a new CSR certificate (Certificate Signing Request) by clicking on "Create new CSR" and entering:

	the details of the new certificate:		the details of the new certificate:
	* Install as a server certificate
	* Country		* Country
	* State		* State
Riga 47:		Riga 46:
	* E-mail		* E-mail

	~~And Subject Alternative Names.~~

	[[File:Create new csr.PNG\|700px]]		[[File:Create new csr.PNG\|700px]]

			=== Local CA Management ===
			In this section you can observe the '''Root Certificate Details''' and the '''Certificates List'''.

			<div lang="it" dir="ltr" class="mw-content-ltr">
			È anche possibile:
			* emettere un nuovo certificato premendo su "Emetti nuovo certificato" e inserendo:
			i dettagli del nuovo certificato e le identità aggiuntive:
			** Installa come un certificato del server
			** Stato
			** Provincia
			** Località
			** Ente
			** Reparto
			** Nome comune
			** E-mail
			</div>

			<div lang="it" dir="ltr" class="mw-content-ltr">
			* Scaricare il certificato di root della CA locale (.pem)
			* Scaricare il certificato di root della CA locale (.der)
			* Eliminare l'autorità di certificazione locale
			</div>

Troccoli: Creata pagina con "700px"

2022-07-25T12:39:52Z

Creata pagina con "700px"

← Versione meno recente		Versione delle 12:39, 25 lug 2022
Riga 7:		Riga 7:

	== Configuration ==		== Configuration ==
	[[File:~~Impostazioni sistema~~, ssl.png\|400px\|destra]]		[[File:System settings, ssl.png\|400px\|destra]]
	To reach the SSL settings section you can follow the path '''"System settings > SSL Settings"''' as shown in the right figure.		To reach the SSL settings section you can follow the path '''"System settings > SSL Settings"''' as shown in the right figure.

Riga 21:		Riga 21:
	You have to upload the server certificate consisting of the actual certificate and private key and the intermediate CAs that are used to build the chain of trust up to the root CA.		You have to upload the server certificate consisting of the actual certificate and private key and the intermediate CAs that are used to build the chain of trust up to the root CA.

	The certificates must be put together inside a single ''.pem.'' file.		The certificates must be put together inside a single ''.pem'' file.
	The phone then provides the client certificate, the certificate is validated by the pbx using the trusted CAs in the panel.		The phone then provides the client certificate, the certificate is validated by the pbx using the trusted CAs in the panel.

Riga 48:		Riga 48:

	And Subject Alternative Names.		And Subject Alternative Names.

			[[File:Create new csr.PNG\|700px]]

Troccoli: Creata pagina con "=== Trusted CA Management === This section contains the list of Certification Authorities of phone vendors that the pbx considers valid to authenticate a client certificate."

2022-07-25T12:27:33Z

Creata pagina con "=== Trusted CA Management === This section contains the list of Certification Authorities of phone vendors that the pbx considers valid to authenticate a client certificate."

← Versione meno recente		Versione delle 12:27, 25 lug 2022
Riga 10:		Riga 10:
	To reach the SSL settings section you can follow the path '''"System settings > SSL Settings"''' as shown in the right figure.		To reach the SSL settings section you can follow the path '''"System settings > SSL Settings"''' as shown in the right figure.

	~~<div lang~~=~~"it" dir~~=~~"ltr" class~~=~~"mw-content-ltr">~~		=== Trusted CA Management ===
	~~=== Gestione delle~~ CA ~~affidabili~~ ===		This section contains the list of Certification Authorities of phone vendors that the pbx considers valid to authenticate a client certificate.
	~~In questa sezione è presente la lista delle~~ Certification ~~Autority dei vendor dei telefoni che la centrale ritiene valide per autenticare un certificato~~ client.
	~~</div>~~

	The server certificate is rarely issued directly from one of the CAs on the phone, since they are no-root CAs. Often certificates are issued by intermediate CAs.		The server certificate is rarely issued directly from one of the CAs on the phone, since they are no-root CAs. Often certificates are issued by intermediate CAs.
Riga 37:		Riga 35:
	By default, on all Kalliope, there is a self-assigned certificate that is issued by a self-generated, in-house CA.		By default, on all Kalliope, there is a self-assigned certificate that is issued by a self-generated, in-house CA.

	~~<div class="mw-translate-fuzzy">~~		A new certificate can be issued by clicking on "Create new CSR" and entering:
	A new certificate can be issued by entering:
	~~</div>~~

	the details of the new certificate:		the details of the new certificate:
	* Install as a server certificate		* Install as a server certificate
			* Country
	* State		* State
	* ~~Province~~		* Locality
	* ~~Location~~		* Organization
	* ~~Entity~~		* Organizational unit
	* Department
	* Common name		* Common name
	* E-mail		* E-mail

	~~Additional identities~~.		And Subject Alternative Names.

FuzzyBot: Aggiornamento come da nuova versione della pagina di origine

2022-07-25T12:23:50Z

Aggiornamento come da nuova versione della pagina di origine

← Versione meno recente		Versione delle 12:23, 25 lug 2022
Riga 8:		Riga 8:
	== Configuration ==		== Configuration ==
	[[File:Impostazioni sistema, ssl.png\|400px\|destra]]		[[File:Impostazioni sistema, ssl.png\|400px\|destra]]
	To reach the SSL settings section you can follow the path "System settings > SSL Settings" as shown in the right figure.		To reach the SSL settings section you can follow the path '''"System settings > SSL Settings"''' as shown in the right figure.

	<div lang="it" dir="ltr" class="mw-content-ltr">		<div lang="it" dir="ltr" class="mw-content-ltr">

Troccoli il 12:23, 25 lug 2022

2022-07-25T12:23:49Z

← Versione meno recente		Versione delle 12:23, 25 lug 2022
Riga 7:		Riga 7:

	== Configuration ==		== Configuration ==
	=== ~~Managing trusted CAs~~ ===		[[File:Impostazioni sistema, ssl.png\|400px\|destra]]
	~~This section contains the list of~~ Certification ~~Authorities of phone vendors that the pbx considers valid to authenticate a~~ client ~~certificate~~.		To reach the SSL settings section you can follow the path "System settings > SSL Settings" as shown in the right figure.

			<div lang="it" dir="ltr" class="mw-content-ltr">
			=== Gestione delle CA affidabili ===
			In questa sezione è presente la lista delle Certification Autority dei vendor dei telefoni che la centrale ritiene valide per autenticare un certificato client.
			</div>

	The server certificate is rarely issued directly from one of the CAs on the phone, since they are no-root CAs. Often certificates are issued by intermediate CAs.		The server certificate is rarely issued directly from one of the CAs on the phone, since they are no-root CAs. Often certificates are issued by intermediate CAs.
Riga 32:		Riga 37:
	By default, on all Kalliope, there is a self-assigned certificate that is issued by a self-generated, in-house CA.		By default, on all Kalliope, there is a self-assigned certificate that is issued by a self-generated, in-house CA.

			<div class="mw-translate-fuzzy">
	A new certificate can be issued by entering:		A new certificate can be issued by entering:
			</div>

	the details of the new certificate:		the details of the new certificate:

Troccoli: Creata pagina con "==Description== The SSL (Secure Sockets Layer) settings section contains the management of trusted CAs (Certification Authorities)."

2022-07-24T15:33:51Z

Creata pagina con "==Description== The SSL (Secure Sockets Layer) settings section contains the management of trusted CAs (Certification Authorities)."

← Versione meno recente		Versione delle 15:33, 24 lug 2022
Riga 1:		Riga 1:
	<languages />		<languages />

	Return to [[AdminGuide:Service/en\|AdminGuide:Service]]		Return to [[AdminGuide:Service/en\|AdminGuide:Service]]

Troccoli: Creata pagina con "By default, on all Kalliope, there is a self-assigned certificate that is issued by a self-generated, in-house CA."

2022-07-24T15:22:04Z

Creata pagina con "By default, on all Kalliope, there is a self-assigned certificate that is issued by a self-generated, in-house CA."

Nuova pagina

<languages />
Return to [[AdminGuide:Service/en|AdminGuide:Service]]

==Description==
The SSL (Secure Sockets Layer) settings section contains the management of trusted CAs (Certification Authorities).

== Configuration ==
=== Managing trusted CAs ===
This section contains the list of Certification Authorities of phone vendors that the pbx considers valid to authenticate a client certificate.

The server certificate is rarely issued directly from one of the CAs on the phone, since they are no-root CAs. Often certificates are issued by intermediate CAs.

'''N.B.'''' It is important to remember the correct sequence of the chain: root CA > intermediate CA > server certificates

The root CA issues a certificate to an intermediate CA and the intermediate CA issues the server certificates.
You have to upload the server certificate consisting of the actual certificate and private key and the intermediate CAs that are used to build the chain of trust up to the root CA.

The certificates must be put together inside a single ''.pem.'' file.
The phone then provides the client certificate, the certificate is validated by the pbx using the trusted CAs in the panel.

If the certificate is deemed valid and both the CN (common name) and MAC address match the file it is requesting, then everything matches, the session closes, and the download of the provisioning file can start.

While on browsers intermediate CAs are often preloaded, on phones, for reasons of memory occupancy there are only root CAs. If we load the server certificate signed by an intermediate (signed by a root CA) on the machine, but the server passes only its own certificate and not the intermediate one to the phone, it is not considered valid by the phone.

It is then necessary to upload both the intermediate CA and the server certificate.

===Server certificate management===
In this section you can upload the server certificate in a single ''.pem'' file.

By default, on all Kalliope, there is a self-assigned certificate that is issued by a self-generated, in-house CA.

A new certificate can be issued by entering:

the details of the new certificate:
* Install as a server certificate
* State
* Province
* Location
* Entity
* Department
* Common name
* E-mail

Additional identities.