Crestron Electronics CP4N - Server Certificates

172 • 4-Series™ Control Systems Product Manual — Doc. 8559B
To configure TLS settings, issue the ssl command:
NOTE: Newer 4-Series control systems do not allow TLS to be turned off. The “off” option is
allowed only for older 4-Series control systems in existing installations (with the exception of
-Rseries residential control systems, which force TLS on following a firmware upgrade).
l
Syntax: ssl [off | self | ca [-p:privatekeypassword]]
o
off: - Turns off TLS if it is on (not valid for newer control systems)
o
self - Turns on TLS using a self-signed certificate
o
ca: Turns on TLS using a CA-signed certificate. The -p argument may be provided
with the private key password for the CA-signed certificate. If the key is encrypted
and the password is not provided, the control system will prompt for the password.
o
No parameter: Displays the current setting
l
Example: ssl ca -p:myprivatekeypassword
NOTE: When TLS is turned on, the control system uses a server certificate. For more
information, refer to Server Certificates (below).
TLS certificates may also be managed using the SSL Management function in Crestron Toolbox.
For more information, refer to the Crestron Toolbox help file.
Server Certificates
When TLS is turned on, the control system uses a server-side certificate to authenticate various
control system components, including the web server.
One of the following three server-side certificate types are used:
l
A self-signed certificate that is generated by the control system
l
A CA (Certificate Authority)-signed certificate that is loaded onto the control system
l
An externally requested and signed certificate and private key that are loaded onto the
control system
Instructions for configuring each server certificate type are provided in the sections that follow.
Self-Signed Certificates
A self-signed certificate is generated by the control system automatically as needed. It is always
available and will be used by default when a certificate is needed but no other certificate is
available. It is also used when the ssl self command is issued.