1. Access the certificate-record configuration element.

   ORACLE# configure terminal
   ORACLE(configure)# security
   ORACLE(security)# certificate-record
   ORACLE(certificate-record)# 

2. For the Certificate Record configuration, do the following:
   • Name—(Required) Enter the name of this certificate record.
   • Country—Enter the country name abbreviation. For example, CA for Canada. Range: 2 characters.
   • State—Enter the region abbreviation. For example, Quebec. Range: 1-128 characters.
   • Locality—Enter the name of the locality in the region. For example, Montreal. Range:1-128 characters.
   • Organization—Enter the name of the organization. For example, Office of Information Technology. 1-64 characters.
   • Unit—Enter the name of the unit in the organization. For example, Global Network Security. 1-64 characters.
   • Common name—Enter the common name for the certificate record. For example, your name. Range: 1-64 characters.
   • Key algor—Set a key algorithm. Valid algorithms: rsa | ecdsa.
   • Digest algor—Set a digest algorithm. Valid values: sha1 | sha256 | sha384.
   • Key size—For the RSA key algorithm, set the RSA key size. Valid key size: 512 | 1024 | 2048 | 4096.
   • ECDSA key size—For the ECDSA key algorithm, set the ECDSA key size. Valid key size: p256 | p384.
   • Alternate name—(Optional) Enter one or more alternative names for the certificate holder.
   • Trusted—Do one of the following:
     • Select to make the certificate trusted. (Default)
     • Deselect to make the certificate un-trusted.
   • Key usage list—Set key the usage extensions you want to use with this certificate record. Multiple values allowed. Default: The combination of digitalSignature and keyEncipherment. For a list of possible values and their descriptions, see “Key Usage List.”
   • Extended key usage list—Set the extended key usage extensions you want to use with this certificate record. Default: serverAuth. For a list of possible values and their descriptions, see “Extended Key Usage List.”
   • Options—Set any optional features or parameters that you want.
3. Type done to save your configuration.

Using the ACLI generate-certificate-request command allows you to generate a private key and a certificate request in PKCS10 PEM format. You take this step after you configure a certificate record.

The Oracle Communications Session Border Controller stores the private key that is generated in the certificate record configuration in 3DES encrypted form with in internally generated password. The PKCS10 request is displayed on the screen in PEM (Base64) form.

You use this command for certificate record configurations that hold end-entity certificates. If you have configured the certificate record to hold a CA certificate, then you do not need to generate a certificate request because the CA publishes its certificate in the public domain. You import a CA certificate by using the ACLI import-certificate command.

This command sends information to the CA to generate the certificate, but you cannot have Internet connectivity from the Oracle Communications Session Border Controller to the Internet. You can access the internet through a browser such as Internet Explorer if it is available, or you can save the certificate request to a disk and then submit it to the CA.

To run the applicable command, you must use the value you entered in the name parameter of the certificate record configuration. You run the command from main Superuser mode command line:

ORACLE# generate-certificate-request acmepacket
Generating Certificate Signing Request. This can take several minutes...
-----BEGIN CERTIFICATE REQUEST-----
MIIDHzCCAoigAwIBAgIIAhMCUACEAHEwDQYJKoZIhvcNAQEFBQAwcDELMAkGA1UE
BhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExETAPBgNVBAcTCFNhbiBKb3NlMQ4w
DAYDVQQKEwVzaXBpdDEpMCcGA1UECxMgU2lwaXQgVGVzdCBDZXJ0aWZpY2F0ZSBB
dXRob3JpdHkwHhcNMDUwNDEzMjEzNzQzWhcNMDgwNDEyMjEzNzQzWjBUMQswCQYD
VQQGEwJVUzELMAkGA1UECBMCTUExEzARBgNVBAcTCkJ1cmxpbmd0b24xFDASBgNV
BAoTC0VuZ2luZWVyaW5nMQ0wCwYDVQQDEwRhY21lMIGfMA0GCSqGSIb3DQEBAQUA
A4GNADCBiQKBgQCXjIeOyFKAUB3rKkKK/+59LT+rlGuW7Lgc1V6+hfTSr0co+ZsQ
bHFUWAA15qXUUBTLJG13QN5VfG96f7gGAbWayfOS9Uymold3JPCUDoGgb2E7m8iu
vtq7gwjSeKNXAw/y7yWy/c04FmUD2U0pZX0CNIR3Mns5OAxQmq0bNYDhawIDAQAB
o4HdMIHaMBEGA1UdEQQKMAiCBnBrdW1hcjAJBgNVHRMEAjAAMB0GA1UdDgQWBBTG
tpodxa6Kmmn04L3Kg62t8BZJHTCBmgYDVR0jBIGSMIGPgBRrRhcU6pR2JYBUbhNU
2qHjVBShtqF0pHIwcDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWEx
ETAPBgNVBAcTCFNhbiBKb3NlMQ4wDAYDVQQKEwVzaXBpdDEpMCcGA1UECxMgU2lw
aXQgVGVzdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHmCAQAwDQYJKoZIhvcNAQEFBQAD
gYEAbEs8nUCi+cA2hC/lM49Sitvh8QmpL81KONApsoC4Em24L+DZwz3uInoWjbjJ
QhefcUfteNYkbuMH7LAK0hnDPvW+St4rQGVK6LJhZj7/yeLXmYWIPUY3Ux4OGVrd
2UgV/B2SOqH9Nf+FQ+mNZOlL7EuF4IxSz9/69LuYlXqKsG4=
-----END CERTIFICATE REQUEST-----;
WARNING: Configuration changed, run save-config command.
ORACLE# save-config
Save-config received, processing.
waiting 1200 for request to finish
Request to ‘SAVE-CONFIG’ has Finished,
Save complete
Currently active and saved configurations do not match!
To sync & activate, run ‘activate-config’ or ‘reboot-activate’
ORACLE# activate-config
Activate-Config received, processing.
waiting 12000 for request to finish
Add LI flows
LiSysClientMgr::handleNotifyReq
H323 Active Stack Cnt: 0
Request to ‘ACTIVATE-CONFIG’ has finished
Activate Complete
ORACLE#

After the Certificate Authority (CA) generates the certificate, you can import it into the Oracle Communications Session Border Controller (SBC) with the import-certificate command.

ORACLE # import-certificate [try-all|pkcs7|x509] [certificate-record file-name]

1. When you use the import-certificate command, you can specify whether you want to use PKCS7 or X509v3 format, or try all. In the command line, you enter the command, the format specification, and the name of the certificate record.

   ORACLE# import-certificate try-all acme

   The SBC displays the following:

   Please enter the certificate in the PEM format.
   Terminate the certificate with ";" to exit.......
   -----BEGIN CERTIFICATE-----
   MIIDHzCCAoigAwIBAgIIAhMCUACEAHEwDQYJKoZIhvcNAQEFBQAwcDELMAkGA1UE
   BhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExETAPBgNVBAcTCFNhbiBKb3NlMQ4w
   DAYDVQQKEwVzaXBpdDEpMCcGA1UECxMgU2lwaXQgVGVzdCBDZXJ0aWZpY2F0ZSBB
   dXRob3JpdHkwHhcNMDUwNDEzMjEzNzQzWhcNMDgwNDEyMjEzNzQzWjBUMQswCQYD
   VQQGEwJVUzELMAkGA1UECBMCTUExEzARBgNVBAcTCkJ1cmxpbmd0b24xFDASBgNV
   BAoTC0VuZ2luZWVyaW5nMQ0wCwYDVQQDEwRhY21lMIGfMA0GCSqGSIb3DQEBAQUA
   A4GNADCBiQKBgQCXjIeOyFKAUB3rKkKK/+59LT+rlGuW7Lgc1V6+hfTSr0co+ZsQ
   bHFUWAA15qXUUBTLJG13QN5VfG96f7gGAbWayfOS9Uymold3JPCUDoGgb2E7m8iu
   vtq7gwjSeKNXAw/y7yWy/c04FmUD2U0pZX0CNIR3Mns5OAxQmq0bNYDhawIDAQAB
   o4HdMIHaMBEGA1UdEQQKMAiCBnBrdW1hcjAJBgNVHRMEAjAAMB0GA1UdDgQWBBTG
   tpodxa6Kmmn04L3Kg62t8BZJHTCBmgYDVR0jBIGSMIGPgBRrRhcU6pR2JYBUbhNU
   2qHjVBShtqF0pHIwcDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWEx
   ETAPBgNVBAcTCFNhbiBKb3NlMQ4wDAYDVQQKEwVzaXBpdDEpMCcGA1UECxMgU2lw
   aXQgVGVzdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHmCAQAwDQYJKoZIhvcNAQEFBQAD
   gYEAbEs8nUCi+cA2hC/lM49Sitvh8QmpL81KONApsoC4Em24L+DZwz3uInoWjbjJ
   QhefcUfteNYkbuMH7LAK0hnDPvW+St4rQGVK6LJhZj7/yeLXmYWIPUY3Ux4OGVrd
   2UgV/B2SOqH9Nf+FQ+mNZOlL7EuF4IxSz9/69LuYlXqKsG4=
   -----END CERTIFICATE-----;
   Certificate imported successfully....
   WARNING: Configuration changed, run "save-config" command.

2. Save the configuration.

   ORACLE# save-config
   Save-Config received, processing.
   waiting 1200 for request to finish
   Request to 'SAVE-CONFIG' has Finished,
   Save complete
   Currently active and saved configurations do not match!
   To sync & activate, run 'activate-config' or 'reboot activate'.

3. Synchronize and activate the configurations.

   ORACLE# activate-config
   Activate-Config received, processing.
   waiting 120000 for request to finish
   Add LI Flows
   LiSysClientMgr::handleNotifyReq
   H323 Active Stack Cnt:  0
   Request to 'ACTIVATE-CONFIG' has Finished,
   Activate Complete
   ORACLE#

4. Reboot the system.

1. Copy the certificate to the /opt directory of the Oracle Communications Session Border Controller using SFTP.
2. Import the certificate with the import-certificate command.
   Use the following syntax:

   import-certificate [try-all|pkcs7|x509] [certificate name] [filename]

   Use the value of the name parameter from the previously configured certificate-record configuration element for the certificate name argument.

   ORACLE# import-certificate x509 acme certificate.pem
   Certificate imported successfully....
   WARNING: Configuration changed, run "save-config" command.
   ORACLE#

3. Save the configuration.

   ORACLE# save-config

4. Activate the configurations.

   ORACLE# activate-config

5. Reboot the system.

When you need to renew an expiring certificate on the SBC, you can either create a new certificate-record or you can overwrite the existing certificate-record with the renewed certificate.

1. Use the import-certificate command to import the new certificate into the certificate-record element that you want to renew.
   For example, if updating a certificate-record element called restless used by an http-server element:

   ORACLE# import-certificate try-all restless 
   
   IMPORTANT:
            Please enter the certificate in the PEM format. 
            Terminate the certificate with ";" to exit....... 

2. Paste your certificate into the ACLI.
3. Type 'y' to overwrite the existing certificate.

   Warning: A certificate already exist for the cert record "restless". 
   Do you want to overwrite it [y/n]?:

4. Save your configuration.
5. Reboot the SBC.

The SBC supports Public Key Cryptography Standard (PKCS) #12 for bundling a private key with the associated X.509 public key certificate in a file for archiving, importing, and exporting. The SBC does not support bundling all members of the chain of trust.

You can view either a brief version or a detailed version of your certificates.

1. Type session-router and press Enter to access the session-router path.

   ORACLE(configure)# session-router

2. Type sip-interface and press Enter. The system prompt changes to let you know that you can begin configuring individual parameters.

   ORACLE(session-router)# sip-interface
   ORACLE(sip-interface)#

3. Select the existing SIP interface to which you want to apply the TLS profile. If you do not know the same of the profile, press Enter again after you use the select command to see a list of all SIP interfaces. Type in the number corresponding to the SIP interface you want to select, and press Enter. You will then be modifying that SIP interface.

   ORACLE(sip-interface)# select

4. Type sip-ports and Enter. The system prompt changes to let you know that you can begin configuring individual parameters.

   ORACLE(session-interface)# sip-ports
   ORACLE(sip-port)#

5. transport-protocol—Change the transport protocol to TLS.

   ORACLE(sip-interface)# transport-protocol tls

6. tls-profile—Enter the name of the TLS profile you want applied. This is the same value you enter for the name parameter in the TLS profile configuration. This profile will be applied when the transport protocol is TLS.

   ORACLE(sip-interface)# tls-profile acmepacket

7. Save your updated SIP interface configuration.

1. In Superuser mode, type configure terminal and press Enter.

   ORACLE# configure terminal

2. Type session-router and press Enter to access the system-level configuration elements.

   ORACLE(configure)# session-router

3. Type sip-interface and press Enter. The system prompt changes to let you know that you can begin configuring individual parameters.

   ORACLE(session-router)# sip-interface
   ORACLE(sip-interface)#

   From this point, you can configure SIP interface parameters. To view all sip-interface parameters, enter a ? at the system prompt.

4. max-incoming-conns—Enter the maximum number of simultaneous TCP/TLS connections for this SIP interface. The default value is zero (0) which disables any limit to the number of simultaneous TCP/TLS connections on this SIP interface. The valid range is:

   • Minimum—0

   • Maximum—20000

5. per-src-ip-max-incoming-conns—Enter the maximum number of connections allowed from an end point.The default value is zero (0). The default disables the parameter. The valid range is:

   • Minimum—0

   • Maximum—20000

     Note:

     To make this parameter effective, you need to set the realm’s access-control-trust-level to low or medium.
6. inactive-conn-timeout—Enter the time in seconds you want a connection from an endpoint discontinued. This provides protection from end points doing an initial registration without sending any messages. The default value is zero (0). The default disables the parameter. The valid range is:

   • Minimum—0

   • Maximum—999999999

7. Save and activate your configuration.

1. In Superuser mode, type configure terminal and press Enter.

   ORACLE# configure terminal

2. Type session-router and press Enter to access the system-level configuration elements.

   ORACLE(configure)# session-router

3. Type sip-config and press Enter. The system prompt changes.

   ORACLE(session-router)# sip-config
   ORACLE(sip-config)#

   From this point, you can configure SIP configuration parameters. To view all sip-config parameters, enter a ? at the system prompt.

4. inactive-dynamic-conn—Enter the time in seconds after which the Oracle Communications Session Border Controller tears down inactive dynamic TCP connections. Inactive is defined as not transporting any traffic. This protects against endpoints establishing TCP/TLS connections and then not sending messages. The default value is 32. The valid range is:

   • Minimum—0

   • Maximum—999999999

     Note:

     Setting this parameter to 0 disables this parameter.

   Because the Oracle Communications Session Border Controller first establishes a TCP connection, then the TLS connection it waits twice the value entered here after the initiation of a TLS connection before tearing down the connection.

   After an endpoint establishes a TCP/TLS connection, it is supposed to keep the connection active by sending messages or by using the NAT interval configuration. Whenever a connection is torn down because of inactivity, a log at the level ERROR is generated.

1. In Superuser mode, type configure terminal and press Enter.

   ORACLE# configure terminal

2. Type media-manager and press Enter to access the media-related configurations.

   ORACLE(configure)# media-manager

3. Type realm-config and press Enter. The system prompt changes to let you know that you can begin configuring individual parameters.

   ORACLE(media-manager)# realm-config
   ORACLE(realm-config)#

   From this point, you can configure realm parameters. To view all realm configuration parameters, enter a ? at the system prompt.

4. deny-period—Indicate the time period in seconds after which the entry for this host is removed from the deny list. The default value is 30. The valid range is:

   • Minimum—0

   • Maximum—4294967295

5. invalid-signal-threshold— Enter the number of invalid TLS signaling messages that trigger host demotion. The value you enter here is only valid when the trust level is low or medium. Available values are:

   • Minimum—Zero (0) is disabled.

   • Maximum—999999999

     If the number of invalid messages exceeds this value based on the tolerance window parameter, configured in the media manager, the host is demoted.

     The tolerance window default is 30 seconds. Bear in mind, however, that the system uses the same calculation it uses for specifying "recent" statistics in show commands to determine when the number of signaling messages exceeds this threshold. This calculation specifies a consistent start time for each time period to compensate for the fact that the event time, such as a user running a show command, almost never falls on a time-period's border. This provides more consistent periods of time for measuring event counts.

     The result is that this invalid signal count increments for two tolerance windows, 60 seconds by default, within which the system monitors whether or not to demote the host. The signal count for the current tolerance window is always added to the signal count of the previous tolerance window and compared against your setting.

6. access-control-trust-level—Set the trust level for the host within the realm. The default value is none. The valid values are:

   • none—Host is always untrusted. It is never promoted to the trusted list or demoted to the deny list.

   • low—Host can be promoted to the trusted list or demoted to the deny list.

   • medium—Host can be promoted to the trusted list but is only demoted to untrusted. It is never added to the deny list.

   • high—Host is always trusted.

7. Save and activate your configuration.