AudioCodes Mediant 800B - Page 1101

Version 7.2 1101 Mediant 800B Gateway & E-SBC
User's Manual 72. Configuration Parameters Reference
Parameter Description

[0] Disable (default).
 [1] Server Only = Verify Subject Name only when acting as a
client for the TLS connection.
 [2] Server & Client = Verify Subject Name when acting as a
server or client for the TLS connection.
If the device receives a certificate from a SIP entity (IP Group)
and the parameter is configured to Server Only or Server &
Client, it attempts to authenticate the certificate based on the
certificate's address.
The device searches for a Proxy Set that contains the same
address (IP address or FQDN) as that specified in the certificate's
SubjectAltName (Subject Alternative Names). For Proxy Sets with
an FQDN, the device checks the FQDN itself and not the DNS-
resolved IP addresses. If a Proxy Set is found with a matching
address, the device establishes a TLS connection.
If a matching Proxy Set is not found, one of the following occurs:
 If the certificate's SubjectAltName is marked as "critical", the
device rejects the call.
 If the SubjectAltName is not marked as "critical", the device
checks if the FQDN in the certificate's Common Name (CN) of
the SubjectName is the same as that configured for the
TLSRemoteSubjectName parameter or for the Proxy Set. If
they are the same, the device establishes a TLS connection;
otherwise, the device rejects the call.
Note:
 If you configure the parameter to Server & Client, you also
need to configure the SIPSRequireClientCertificate parameter
to Enable.
 For FQDN, the certificate may use wildcards (*) to replace
parts of the domain name.
TLS Client Verify Server
Certificate
configure network/security-
settings/tls-vrfy-srvr-cert
[VerifyServerCertificate]
Determines whether the device, when acting as a client for TLS
connections, verifies the Server certificate. The certificate is
verified with the Root CA information.
 [0] Disable (default)
 [1] Enable
Note: If Subject Name verification is necessary, the parameter
PeerHostNameVerificationMode must be used as well.
TLS Remote Subject Name
configure network/security-
settings/tls-rmt-subs-name
[TLSRemoteSubjectName]
Defines the Subject Name that is compared with the name
defined in the remote side certificate when establishing TLS
connections.
If the SubjectAltName of the received certificate is not equal to
any of the defined Proxies Host names/IP addresses and is not
marked as 'critical', the Common Name (CN) of the Subject field is
compared with this value. If not equal, the TLS connection is not
established. If the CN uses a domain name, the certificate can
also use wildcards (‘*’) to replace parts of the domain name.
The valid range is a string of up to 49 characters.
Note: The parameter is applicable only if the parameter
PeerHostNameVerificationMode is set to 1 or 2.