TLS Question

CREATE THE CERTIFICATION AUTHORITY (CA) CERTIFICATE

1) Generate the key for the CA certificate
> openssl genrsa -des3 -out ca.key 2048
- Enter an appropriate pass phrase.

2) Show the key
> openssl rsa -noout -text -in ca.key

3) Compose the CA certificate from the key
> openssl req -new -x509 -days 2555 -key ca.key -out ca.crt
- Enter a certification authority name in [Common Name] (CN) field.
For example: TEST-CA

4) Show the CA certificate
> openssl x509 -noout -text -in ca.crt



CREATE THE SERVER CERTIFICATE


1) Generate the key for the server certificate
> openssl genrsa -out server.key 2048

2) Show the key
> openssl rsa -noout -text -in server.key

3) Compose the server certificate from the key
> openssl req -new -key server.key -out server.csr
- Enter a SIP server's IP address in [Common Name] (CN) field.
For example: 172.16.14.11

4) Sign the server certificate with the CA certificate
> openssl x509 -days 365 -CA ca.crt -CAkey ca.key -req -CAcreateserial -CAserial ca.srl -in server.csr -out server.crt

5) Show the server certificate
> openssl x509 -noout -text -in server.crt

6) Convert to DER file
> openssl x509 -in server.crt -out cert.der -outform der
> openssl pkcs8 -topk8 -nocrypt -in server.key -out key.der -outform der
- cert.der: server's certificate in DER format
- server.der: server's key in DER format



UPLOAD THE DER FILES

Upload DER files "server.der" and "cert.der" in the [Configuration] -> [SIP] page -> [TLS].