Installation and Operation Manual

Table Of Contents
TD 92579EN
10 April 2015 / Ver. N
Installation and Operation Manual
IP-DECT Base Station & IP-DECT Gateway (software version 7.2.X)
5
2.2 Introduction to IP Security in IP-DECT
A secure system requires more planning than an unsecured system.
2.2.1 Secure Web Access (https)
For IP-DECT devices
https access should be enabled
http access should preferably be disabled
For more information see 4.8.3 Configure the HTTP settings on page 78 .
2.2.2 TLS Certificates
Security in Web-based applications rely on cryptography. Cryptographical systems are only
as secure as their keys. This makes Key Management a critical and often neglected
concern. TLS Certificates have emerged as a clever way of managing large scale key
distribution.
Two certificate management tasks are needed for TLS:
1 Trust relationships when the device must know which third parties (e.g. IP-PBX) it
shall trust in, see
1. Trust Relationships.
2 Device certificates to authenticate the device against third parties, see 2. Certificate
Handling Options with Device Certificates.
1. Trust Relationships
Trust relationships are defined by a trust list in the device. The list contains the certificates
to be accepted by the device for TLS secured connections (e.g. HTTPS, SIPS).
For more information see Trust List on page 39.
2. Certificate Handling Options with Device Certificates
There are three certificate handling options:
Default Device certificate
The default certificate is supplied with the device. It is a self-signed certificate. Self-
signed certificates provide only encryption, not authentication.
For more information see Default Device Certificate on page 41.
Self-signed certificates
This option is for customers not planning on having their certificates signed by public
or private CAs. Self-signed certificates
provide encryption but do in most cases not
provide authentication.
For more information see Self-signed Certificates on page 41.
Certificates signed by a Certificate Authority (CA)
Two options are possible:
- A) Certificates signed by the customer’s own CA. Customers possessing the
knowledge and infrastructure to house their own CA could build an internal