Device Certificate

Programming to manage the certificate manually

Select Use this form to manage the certificate option to perform the following procedures:

Generating a Certificate Signing Request (CSR)

A CSR is a text file you send to a Certificate Authority (CA) to apply for an SSL certificate. The option to generate a CSR is only available if the current certificate is a system-generated certificate or an imported certificate.

To generate a CSR:

1. Click Generate a CSR...

Enter the requested information:

• Country Name (2 letter code): The two-letter International Organization for Standardization (ISO) format country code for where your organization is legally registered. For codes, see https://www.iso.org/obp/ui/#search

• State or Province Name (full name): Name of the state or province where your organization is located. Do not abbreviate.

• Locality Name (eg., city): Name of the city where your organization is registered/located. Do not abbreviate.

• Organization name (eg., company): The legally-registered name for your business. If you are enrolling as an individual, enter the certificate requestor's name.

• Organizational Unit Name (eg., section): HR, Finance, IT, and so on. (Abbreviations permitted)

• Common Name (eg., your server's hostname): The IP address or host name of the MiVoice Business system you are securing.

• Add IP Address: Select this check box optionally if you want to add the IP address (or FQDN) of the MiVoice Business system to the CSR.

3. Click Generate.
   The generated CSR is displayed in a dialog box.

4. Copy the generated CSR including the BEGIN CERTIFICATE REQUEST and the END CERTIFICATE REQUEST lines to a text file.

5. Click Close on the dialog box.

6. Log into your account on the CA's website and paste the full CSR from the text file into the SSL enrollment form.

7. After you receive your SSL Certificate, return to this form to install the certificate.

IMPORTANT: The generated CSR contains the IP address of the MiVoice Business (optionally) and host name information in the Subject Alternate Name (SAN) extension of the certificate. Some Certificate Authority servers may not accept SAN information from a CSR. In this case, the resulting certificate will not contain the IP address of the MiVoice Business system.

Creating or updating a self signed certificate

If the current certificate is not a system-generated self-signed certificate, then you can create a self-signed certificate. If the current certificate is a self-signed certificate,  then you can update (for example, issuer, e-mail address, validity, and so on)  the self-signed certificate.

NOTE: If you update the host or domain name in the Server Manager, then you must manually update the host or domain name in the self-signed certificate.

To create a system-generated certificate:

1. Click Create certificate...

2. Enter the required information into the form. (Use the same rules that apply to entering information in a CSR; see above.)

3. Click Update.

4. In the Maintenance Commands form, in the Command field, enter the RESET SYSTEM command.

5. After system reboot, log in to the System Administration Tool again to confirm that there are no certificate errors.

To update the system-generated certificate:

1. Click Update certificate...

2. Change the information in the form, according to your requirements. (Use the same rules that apply to entering information in a CSR; see above.)

3. Click Update.

4. In the Maintenance Commands form, in the Command field, enter the RESET SYSTEM command.

5. After system reboot, log in to the System Administration Tool again to confirm that there are no certificate errors.

Installing a new certificate

Instead of using a system-generated certificate, you can install a self-signed certificate using a common root certificate or received from a known CA.

To install a new certificate:

1. Click Install a new certificate...

2. Under SSL Certificate, click Choose File to upload a certificate file.

3. Under SSL Private Key, click Choose File to upload a private key.

4. (Optional) Under Intermediate Certificate(optional), click Choose File to upload a certificate file.

5. Click Upload to complete the installation.

6. In the Maintenance Commands form, in the Command field, enter the RESET SYSTEM command.

7. After system reboot, log in to the System Administration Tool again to confirm that there are no certificate errors.

NOTE: The certificates and private key file must be in PKCS1 format. Ensure that the Certificate Authorities (CA) provide certificates and private key file in PKCS1 format. If the CA provides the certificates and the private key file in a different format, use a tool such as OpenSSL to convert it.

Removing an existing third-party or self-signed certificate

You can remove the current third-party or self-signed certificate from the system. After you remove the certificate, the system uses the default Mitel legacy certificate upon reboot.

To remove the existing third-party certificate:

1. Click Remove Certificate.

2. Click OK to confirm that you want the certificate removed.

3. In the Maintenance Commands form, in the Command field, enter the RESET SYSTEM command.

4. After system reboot, log in to the System Administration Tool again to confirm that there are no certificate errors.

Downloading the currently installed SSL certificate

To download the currently installed SSL certificate:

• Click Download this certificate.
  The system downloads the certificate.

Web Server Certificate from  Server Manager (Not applicable to Container-based MiVoice Business (cMiVB))

You can also use the Web Server certificate defined in the Server Manager (Security > Web Server) as a device certificate.

1. Select Use the Web Server certificate defined in Server Manager.

2. Click Save.

3. Reboot the system. The Web Server certificate details are displayed in the form.