Install Eap-Tls Authentication Certificates - Cisco 8811 Administration Manual

Supported Security Features

Install EAP-TLS Authentication Certificates

To install authentication certificates for EAP-TLS, perform the following steps.
Procedure
Step 1 From the phone web page, set the Cisco Unified Communications Manager date and time on the phone.
Step 2
If using the Manufacturing Installed Certificate (MIC):
a) From the phone web page, export the CA root certificate and manufacturing CA certificate.
b) From Internet Explorer, install certificates on the Cisco ACS server and edit the trust list.
c) From Microsoft Certificate Services, export the CA certificate from the ACS server and import it to the
phone.
For more information, see:
Step 3 If using a user installed certificate, from phone web page:
a) Generate the Certificate Signing Request (CSR).
b) Send the CSR to CA to sign.
c) Import the certificate.
d) Install certificate on the Cisco ACS server and edit the trust list.
e) Download the CA certificate from the ACS server and import it into the phone.
For more information, see
Step 4
Using the ACS configuration tool, set up the user account.
For more information, see:
• Set Up ACS User Account and Install Certificate, on page 103
• User Guide for Cisco Secure ACS for
secure-access-control-system/products-user-guide-list.html)
Set Date and Time
EAP-TLS uses certificate-based authentication that requires the internal clock on the Cisco IP Phone to be
set correctly. The date and time on the phone might change when it is registered to Cisco Unified
Communications Manager.
If a new server authentication certificate is being requested and the local time is behind the Greenwich
Note
Mean Time (GMT), the authentication certificate validation might fail. Cisco recommends that you set
the local date and time ahead of the GMT.
To set the phone to the correct local date and time, follow these steps.
Cisco IP Phone 8800 Series Administration Guide for Cisco Unified Communications Manager
100
• Export and Install Certificates on ACS, on page 101
• Export CA certificate from ACS using Microsoft Certificate Services, on page 101
Request and Import User-Installed Certificate, on page
Windows(http://www.cisco.com/c/en/us/support/security/
102.