1. Essentials Guide
  2. Transport Layer Security
  3. TLS Configuration Process
  4. Configure a TLS Profile

Configure a TLS Profile

The TLS profile configuration contains the information required to run SIP over TLS.

  • Obtain the necessary certificates.
  • Confirm that the system displays the Superuser mode.
When the Oracle Communications Core Session Manager (OCCSM) negotiates with TLS, it starts with the highest TLS version and works its way down until it finds a compatible version and cipher that works for the other side.
  1. Access the tls-profile configuration element. 
    ORACLE# configure terminal
ORACLE(configure)# security
ORACLE(security)# tls-profile
ORACLE(tls-profile)#
  2. name—Enter the name of the TLS profile. Required.
  3. end-entity-certificate—Enter the name of the entity certification record.
  4. trusted-ca-certificates—Enter the names of the trusted CA certificate records.
  5. cipher-list—Use either the default DEFAULT, or enter a list of ciphers that you want to support. For a complete list of supported ciphers, see the Oracle Communications Core Session Manager Release Notes.
  6. verify-depth—Specify the maximum depth of the certificate chain to verify. Default: 10. Valid range: 0-10.
  7. mutual-authenticate—Define whether or not you want the OCCSM to mutually authenticate the client. Valid values: enabled | disabled. Default: disabled.
  8. tls-version—Enter the TLS version that you want to use with this TLS profile. Valid values are:
    • tlsv12 (default)
    • compatibility — When the OCCSM/SLRM negotiates on TLS, it starts with the highest TLS version and works its way down until it finds a compatible version and cipher that works for the other side.
    • tlsv1
    • tlsv11

    Note:

    The sslmin option in security-config specifies the lowest TLS version allowed when tls-version is set to compatibility. By default, compatibility mode excludes TLS 1.0 unless sslmin is set to tlsv10.
  9. Type done to save your configuration.