CuCM Secure Communication

CuCM SIPS protocol uses mutual certificate authentication.

It means the SIP endpoint (Device) must also provide a client certificate for a strong authentication.

TLS connection between TPO and CuCM for SIP registration

Context

•TPO: 10.10.7.7

•CuCM: cucm12pub.iptrade.local, 10.12.1.235

•Certificates:

➢Client certificate signed by CuCM CAPF Service

➢CuCM CAPF Certificate is signed by subordinate CA IPTBERDSRV052

➢CuCM CallManager Certificate is signed by subordinate CA IPTBERDSRV052

➢Subordinate CA Certificate is signed by CA IPTBERDSRV051

➢CA Certificate is a self-signed

•SIP Device Id used on TPO DDI place: SEP800000000009

•Extension: 8900

•Client Certificate: SEP800000000009.cer

•CA certificate:

• Subordinate CA:

Scenario

Start the TPO DDI place

Result: place is started and Device SEP800000000009 is registered properly

Network Trace

Wireshark filter: tcp.port == 5061 || tcp.port == 5062 || tcp.port == 5063 || tcp.port == 5064 || tcp.port == 5060

Two TLS connections are necessary to register the SIP device

TPO to CuCM

1.TPO connects to CUCM TLS port 5061

2.TPO starts TLS handshake

3.TLS handshake in progress

4.TLS handshake - CuCM sends the "Server" certificates (CA &  subordinate CA Certificates) and requests Client Certificate

5.TLS handshake - TPO sends Client Certificate

CuCM to TPO

6.CuCM connects to TPO listening port associated with this device 5064. This port is indicates in the contact header of the SIP registration.

7.CuCM starts TLS handshake

8.TPO sends the  "Server" certificate. In our case, it is SEP800000000009.cer.

•Client Certificates information is located in the chapter TPO Client Certificates of debug information

•TLS information is located in the chapter TLS engines for Client Certificates of debug information