Configuring SSL certificates

If the MCU has the Secure management (HTTPS) or Encryption feature key installed, and you enable the secure web service on the Network > Services page, you will be able to access the web interface of the MCU using HTTPS. The MCU has a local certificate and private key pre-installed and this will be used by default when you access the unit using HTTPS. However, we recommend that you upload your own certificate and private key to ensure security as all MCUs have identical default certificates and keys.

To upload your own certificate and key, go to Network > SSL certificates, complete the fields and click Upload certificate and key. Note that you must upload a certificate and key simultaneously. After uploading a new certificate and key, you must restart the MCU.

If you have uploaded your own certificate and key, you can remove it later if necessary; to do this, click Remove certificate and key.

Field	Field description	Usage tips
Local certificate
Subject	The details of the business to which the certificate has been issued: C: the country where the business is registered ST: the state or province where the business is located L: the locality or city where the business is located O: the legal name of the business OU: the organizational unit or department CN: the common name for the certificate, or the domain name
Issuer	The details of the issuer of the certificate.	Where the certificate has been self-issued, these details will be the same as for the Subject.
Issued	The date on which the certificate was issued.
Expires	The date on which the certificate will expire.
Private key	Whether the private key matches the certificate.	Your web browser uses the SSL certificate's public key to encrypt the data that it sends back to the MCU. The private key is used by the MCU to decrypt that data. If the Private key field says 'Key matches certificate' then the data is securely encrypted in both directions.
Upload certificate and key
Certificate	If your organization has bought a certificate, or you have your own way of generating certificates, you can upload it. Browse to find the certificate file.
Private key	Browse to find the private key file that accompanies your certificate.
Private key encryption password	If your private key is stored in an encrypted format, you must enter the password here so that you can upload the key to the MCU.
Local certificate
Trust store	You can upload a 'trust store' of certificates that the MCU will use to verify the identity of the other end of a TLS connection. The trust store must be in '.pem' format.	Note that uploading a new trust store replaces the existing store.
Certificate verification settings	Choose to what extent the MCU will verify the identity of the far end for a connection: No verification: all outgoing connections are permitted to proceed, even if the far end does not present a valid and trusted certificate. Outgoing connections only: outgoing connections are only permitted if the far end has a certificate which is trusted. Outgoing connections and incoming calls: outgoing connections and incoming connections for SIP calls using TLS must have a certificate which is trusted otherwise the MCU will not allow the connection to proceed.	The trust store contains 'master' certificates that can be used to verify the identity of a certificate presented by the far end. Outgoing connections are connections such as SIP calls which use TLS.

	MCU 4510
	host: ASGC_Codian4510

Configuring SSL certificates

Related topics