To alleviate the errors customers receive while logging into the SMI, customers may want to install their own vendor signed certificates on their Messaging systems. These certificates are signed by a certificate authority (CA) and are built for a particular system name – fully qualified domain name.
The Certificate Signing Request (CSR) Web page enables you to manage the CSRs present on the server. The customer can generate a CSR to send to their CA, that is, Entrust, VeriSign, and so on. If there are outstanding requests in etc/opt/ecs/certs/signing-requests, the system displays the CSR Web page. If there are no outstanding signing requests, the system displays the CSR - Form Web page. A maximum of four certificate signing requests can be outstanding at any given point of time.
Procedure
- On the Administration menu, click .
- Complete the fields with the appropriate information. For more information, see Certificate Signing Request - Form field descriptions.
If there are outstanding certificate service requests, click New Request and complete the fields.
- Click Generate Request.
The system displays the Certificate Signing Request - Display Web page. You need to send the certificate output from the Certificate Signing Request - Display Web page to the CA.
- Copy and paste a portion of the CSR data, from the Begin Certificate Request section to the End Certificate Request section into a notepad, and save the notepad.
- Click Continue.
- Send the notepad document to the CA.
The CA vendor will send back to the customer a Messaging certificate file. The certificate file will end with a .pem or .crt extension. This is the certificate that will be used for Messaging voice mail. Installing this certificate will eliminate the error seen by customers when the customers log in to the Messaging SMI.
The certificates are chained certificates. To install a chained certificate, you must install the CA Root certificate. Some certificate authorities, such as VeriSign will require you to install an Intermediate certificate. Once you load the Root certificate and Intermediate certificate (if required), then you can install the Messaging certificate.
The Root certificate has to be downloaded by the customer and is the first certificate that must be installed on the Messaging system. Below are the links for the Root certificates for VeriSign and Entrust.
Note Larger customers may have a contract with the vendor and therefore have direct access to the Root and Intermediate certificates. The customer follows the directions on how to download the Root certificate. If an Intermediate certificate is required, the vendor’s Web site will direct the customer on how to obtain the Intermediate certificate.
VeriSign: http://www.verisign.com/repository/roots/root-certificates/PCA-3G2.pem. Copy the certificate information that is displayed into a file called PCA-3G2.pem.
Entrust: https://www.entrust.net/downloads/root_request.cfm. Enter your name, company name, and e-mail address and then select the Entrust Root CA check box and select the Server/Host Type as Apache (OpenSSL). Click Accept. Once you receive the mail, copy the certificate information into a file called PCA-3G2.pem.
- Once the customer has all of the certificates, Root, Intermediate, and Messaging, the customer can download these certificates to the Messaging system. The customer must first copy these certificates to the /var/home/ftp/pub directory.
To copy these certificates to the /var/home/ftp/pub directory, see Download files.