Cisco Cisco Expressway Maintenance Manual
The Expressway allows you to install appropriate files so that it can act as either a client or a server in connections
using TLS. The Expressway can also authenticate client connections (typically from a web browser) over HTTPS. You
can also upload certificate revocation lists (CRLs) for the CAs used to verify LDAP server and HTTPS client
certificates.
using TLS. The Expressway can also authenticate client connections (typically from a web browser) over HTTPS. You
can also upload certificate revocation lists (CRLs) for the CAs used to verify LDAP server and HTTPS client
certificates.
The Expressway can generate server certificate signing requests (CSRs). This removes the need to use an external
mechanism to generate and obtain certificate requests.
mechanism to generate and obtain certificate requests.
For secure communications (HTTPS and SIP/TLS) we recommend that you replace the Expressway default certificate
with a certificate generated by a trusted certificate authority.
with a certificate generated by a trusted certificate authority.
Note that in connections:
■
to an endpoint, the Expressway acts as the TLS server
■
to an LDAP server , the Expressway is a client
■
between two Expressway systems, either Expressway may be the client with the other Expressway being the
TLS server
TLS server
■
via HTTPS, the web browser is the client and the Expressway is the server
TLS can be difficult to configure. For example, when using it with an LDAP server we recommend that you confirm
that your system is working correctly before you attempt to secure the connection with TLS. You are also
recommended to use a third party LDAP browser to verify that your LDAP server is correctly configured to use TLS.
that your system is working correctly before you attempt to secure the connection with TLS. You are also
recommended to use a third party LDAP browser to verify that your LDAP server is correctly configured to use TLS.
Note:
be careful not to allow your CA certificates or CRLs to expire as this may cause certificates signed by those
CAs to be rejected.
Certificate and CRL files can only be managed via the web interface. They cannot be installed using the CLI.
Managing the Trusted CA Certificate List
The Trusted CA certificate page (Maintenance > Security certificates > Trusted CA certificate) allows you to
manage the list of certificates for the Certificate Authorities (CAs) trusted by this Expressway. When a TLS
connection to Expressway mandates certificate verification, the certificate presented to the Expressway must be
signed by a trusted CA in this list and there must be a full chain of trust (intermediate CAs) to the root CA.
manage the list of certificates for the Certificate Authorities (CAs) trusted by this Expressway. When a TLS
connection to Expressway mandates certificate verification, the certificate presented to the Expressway must be
signed by a trusted CA in this list and there must be a full chain of trust (intermediate CAs) to the root CA.
■
To upload a new file containing one or more CA certificates, Browse to the required PEM file and click
Append CA certificate. This will append any new certificates to the existing list of CA certificates. If you are
replacing existing certificates for a particular issuer and subject, you have to manually delete the previous
certificates.
Append CA certificate. This will append any new certificates to the existing list of CA certificates. If you are
replacing existing certificates for a particular issuer and subject, you have to manually delete the previous
certificates.
■
To replace all of the currently uploaded CA certificates with the system's original list of trusted CA certificates,
click Reset to default CA certificate.
click Reset to default CA certificate.
■
To view the entire list of currently uploaded trusted CA certificates, click Show all (decoded) to view it in a
human-readable form, or click Show all (PEM file) to view the file in its raw format.
human-readable form, or click Show all (PEM file) to view the file in its raw format.
■
To view an individual trusted CA certificate, click on View (decoded) in the row for the specific CA certificate.
■
To delete one or more CA certificates, tick the box(es) next to the relevant CA certificate(s) and click Delete.
Note:
(for account authentication), you must add the PEM encoded CRL data to your trusted CA certificate file.
200
Cisco Expressway Administrator Guide
Maintenance