Jabber Client Secure Device Profile

[Chuck Reid]

Hello,

We noticed that when using Secure device profiles for Jabber clients, that if a user tries to login to another PC, another jabber client, that we have to download the capf certificate again for the new client. If the user then goes back to the first client than we have to download capf again, every time the user changes PC's / clients, they need capf reinstalled, is this normal? Is there a workaround?

Thanks,

Chuck Reid

[Jaime Valencia]

When the phone interacts with CAPF, the phone authenticates itself to CAPF by using an authentication string, existing MIC or LSC certificate, or “null,” generates its public key and private key pair, and then forwards its public key to the CAPF server in a signed message. The private key remains in the phone and never gets exposed externally. CAPF signs the phone certificate and then sends the certificate back to the phone in a signed message.

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/12_0_1/secugd/cucm_b_cucm-security-guide-1201/cucm_b_cucm-security-guide-1201_chapter_01010.pdf

[Chuck Reid]

I reviewed that doc but i don't see a way to avoid the problem of users logging in to jabber from multiple PC's, do you know of a way to mitigate the behavior?

[Jaime Valencia]

That's WAD, read again, highlighted the key points to understand this:

When the phone interacts with CAPF, the phone authenticates itself to CAPF by using an authentication string, existing MIC or LSC certificate, or “null,” generates its public key and private key pair, and then forwards its public key to the CAPF server in a signed message. The private key remains in the phone and never gets exposed externally. CAPF signs the phone certificate and then sends the certificate back to the phone in a signed message.

Above is a 1:1 relationship between CAPF and the device.

[Chuck Reid]

So, does that mean that there is no workaround for users who log into Jabber from more than one client PC?

Anytime a user changes which PC they log onto with Jabber that we will need to set capf to install a new certificate?

Thanks,

Chuck

[Jaime Valencia · Accepted solution]

If you wish to use secure profile, yes, CAPF only tracks one certificate which was generated by the device when they enrolled and as explained, the private key the device generated is never exposed. Each time you use a different device, you generate new certificates and new keys only valid to that device.

This is not a problem for IP Phones, but this is expected with soft clients.

[Chuck Reid]

Thanks very much for explaining that to me!