Phone security (CAPF)

Purpose

For encrypted signaling and voice, a Cisco phone needs its own certificate (LSC). The CUCM issues it through the Certificate Authority Proxy Function (CAPF). For this, the CAPF fields must be set on every phone: certificate operation, authentication mode, key type and a deadline.

This dialog defines these values once per CUCM connection. If the feature is switched on, EasyUC writes them to the device over AXL when it creates a phone: certificate operation “Install/Upgrade”, the selected authentication mode, the key order with key size and, as the deadline, today's date plus the configured days.

With Enable only per Device, EasyUC does not set the values automatically. Instead, the Make it Secure entry appears under Actions for phones. You use it to start certificate issuance for a single phone.

Prerequisites

• License with the cucm module and the provisioning feature. Without provisioning, the entry is missing from the Actions menu.
• EasyUC account with the ROLE_APP_ADMIN role. Only administrators see the Administration menu.
• The CUCM connection has been created and enabled. For a disabled connection, Actions shows only Enable Connection.
• In the CUCM, the Cisco Certificate Authority Proxy Function service is set up and the phones use a security profile that matches the intended operation. EasyUC sets only the CAPF fields on the device.
• For the Make it Secure entry, the operator needs the ROLE_APP_UPDATE_DEVICE role.

Step by step

1. In the header, select the EasyUC Cisco workspace.
2. In the menu, open Administration → CUCM & Provisioning → CUCM Connections. The Manage CUCM Connections page lists all connections.
3. In the row of the connection you want, click Actions. The Menu popover opens.
4. Click Phone Security. The Phone security dialog opens.
5. Switch on Enable. The CAPF fields appear.
6. Switch on Enable only per Device if EasyUC is not to set the values for every new phone, but only through the Make it Secure device action.
7. Select the Authentication Mode. With By Authentication String, also enter the Authentication String.
8. Select the Key Order and, to match it, the RSA Key Size, the EC Key Size or both.
9. Under Days, enter how many days the certificate operation is to remain open.
10. Click Save (top right or at the bottom of the dialog). The dialog closes and EasyUC shows a success message (“Success”). Cancel closes the dialog without changes.
11. Create a test phone or click Actions → Make it Secure for an existing phone. In the CUCM, check the CAPF section on the device.

Fields and options

Check the result and narrow down errors

• Success: In the Manage CUCM Connections list, the Ph. Security column shows the status of the connection. A phone created afterwards has the certificate operation “Install/Upgrade” with the selected values in the CUCM.
• Message “This value should not be blank.”: A required field is missing, usually the key size for the selected key order, the string or Days.
• The Make it Secure entry is missing on the phone: It appears only if Enable and Enable only per Device are set, the device is a phone and the account has ROLE_APP_UPDATE_DEVICE.
• The phone does not receive a certificate: In the CUCM, check the CAPF service, the security profile of the phone and whether the deadline has expired. EasyUC only sets the fields on the device and does not issue a certificate itself.
• The setting alone is no proof of encrypted telephony. The security profile and the cluster mode in the CUCM are decisive.