Cisco SPA series phones and ATAs can use certificate-authenticated HTTPS (SSL) sessions to ensure secure provisioning. For a provisioning server to be acceptable to the SPA phone or ATA, the server must present a certificate signed by Cisco's Certificate Authority (CA).
Over the years, we have added certificate authorities (CA) as needed and for administrative reasons.
If your SPA1xx or SPA232D ATA or SPA5xx IP Phone is running current or newer firmware, 1.3.3 or 7.5.6 respectively, use the newer "Cisco 2k Small Business CA" even though you could use any of the older CAs.
A HTTPS server used for device provisioning must use a certificate signed by the appropriate CA for the device.
To obtain this certificate, you must submit a certificate signing request (CSR) by following the CSR instructions.
When submitting the CSR, you must list the device types that you want to provision so we know what certificates to generate for you.
Following is a list to help you identify the appropriate CA associated with your device:
- Cisco 2k Small Business CA:
- SPA1xx firmware 1.3.3 and newer
(SPA112 and SPA122)
- SPA232D firmware 1.3.3 and newer
- SPA5xx firmware 7.5.6 and newer
(SPA501G, SPA502G, SPA504G, SPA508G, SPA509G, SPA512G, SPA514G, SPA525G, and SPA525G2)
- Cisco Small Business (SB) CA:
- SPA1xx (SPA112 and SPA122)
- SPA232D
- SPA3xx (SPA301 and SPA303)
- SPA5xx (SPA501G, SPA502G, SPA504G, SPA508G, SPA509G, SPA512G, SPA514G, SPA525G, and SPA525G2)
- SRP5xx (SRP521 and SRP541)
- Linksys CA:
- Sipura CA:
- PAP2T
- WRP400
- SPA2xxx (SPA2000 and SPA2102)
- SPA3xxx (SPA3000 and SPA3102
- SPA9xx (SPA901, SPA921, SPA922, SPA941, SPA942, SPA962)
- SPA3xx (SPA301 and SPA303)
- SPA5xx (SPA501G, SPA502G, SPA504G, SPA508G, SPA509G, SPA512G, SPA504G, SPA525G, and SPA525G2)
Note:
A HTTPS server can only present a single certificate per IP address:port
To securely provision devices associated with multiple CAs, you will need to implement multiple HTTPS services. You can use any one or a combination of the following options:
- Deploy multiple computers with one network interface card (NIC) per computer, each performing the role of a CA
Example:
- Deploy a single computer with multiple NICs where each NIC has a unique IP address where each IP address performs the role of a unique CA
Example:
- Deploy a single computer with a single NIC where unique ports are used and each unique port is associated with a unique CA
<end of original document>
<Start of note from >
Informations in such documents seems to be either obsolete or invalid from scratch. Most devices accept more than one CA, so multiple HTTPS server as suggested by document may be overkill in some cases. But I will leave original ocument above, because I can't test all types and firmware versions.
See table bellow for real cross-compatibility list. It is based on real test of mentioned devices.
| Device \ CA |
Linksys CA |
Sipura CA |
Cisco SB CA |
Verisign |
| PAP2T, 5.1.6(LS) |
OK |
OK |
NO |
NO |
| SPA112, 1.3.1(003) |
OK |
OK |
OK |
NO |
| SPA232D, 1.3.1(003_240) |
OK |
OK |
OK |
NO |
| SPA-962, 6.1.5(a) |
OK |
OK |
NO |
? |
| SPA508G, 7.5.4 |
OK |
OK |
OK |
NO |
| SPA508G, 7.6.2 |
NO *)
|
OK |
OK |
? |
| SPA525G2, 7.5.4 |
OK |
OK |
OK |
? |
Note:
Linksys CA:
/C=US/ST=California/L=Irvine/O=Cisco xxx, LLC./OU=Cisco xxx Certificate Authority
/CN=xxx Provisioning Root Authority 1/emailAddress=xxx-certadmin@cisco.com
Serial: D0:7D:8A:7B:AD:BA:7C:B6:44:69:98:B1:EA:89:87:9F
Sipura CA:
/C=US/ST=California/L=San Jose/O=xxx /OU=xxx
/CN=xxx Provisioning Root Authority 1/emailAddress=xxx
Serial: 45:BF:48:C0:CE:B8:8F:7B:C8:E1:6D:85:62:5A:5B:8F
CiscoSB CA:
/C=US/ST=California/L=San Jose/O=Cisco Small Business/OU=Cisco Small Business Certificate Authority
/CN=Cisco Small Business Provisioning Root Authority 1/emailAddress=ciscosb-certadmin@cisco.com
Serial: D0:7D:8C:15:C0:BA:7C:B6:44:69:98:B1:EA:89:87:9F
Verisign CA (based on informations in xxx:
/C=US/O=xxx, Inc./OU=Class 3 Public Primary Certification Authority
Serial: 70:BA:E4:1D:10:D9:29:34:B6:38:CA:7B:03:CC:BA:BF
or
/C=US/O=xxx, Inc./OU=xxx /OU=Terms of use at xxx (c)05
/CN=xxx Class 3 Secure Server CA
Serial: 75:33:7D:9A:B0:E1:23:3B:AE:2D:7D:E4:46:91:62:D4
Note: according Verisign (now Symantec) tech support, VeriSign Class 3 Secure Server CA based certificates are no longer issued. Class 3 Public Primary Certification Authority rooted certificates are sold under product name "Secure Site" and "Secure Site Pro".
*) Linksys CA certificate embedded on SPA50x has expired on end of Jun 2015. Firmwares older than 7.6.2 has been known not to honor certificate times at all. From 7.6.2 onward certificate times are honored, thus Linksys CA certificate is considered expired e.g. untrusted. SSL connections based on Linksys CA certificate are refused with err 10 (certificate expired).
