Polycom DMA 7000 System Operations Guide

DMA Operations Guide
• When a client connects to a server, the server shows its signed public
certificate to the client. Trust is established because the certificate has been
signed by the certificate authority, and the client has been pre-configured
to trust the certificate authority.
How Certificates Are Used by the DMA System
Frequently Asked Questions
The Polycom DMA system uses X.509 certificates in three different ways:
1 When a user logs into the Polycom DMA system’s browser-based
management interface, the Polycom DMA system (server) offers an X.509
certificate to identify itself to the browser (client).
The Polycom DMA system’s certificate must have been signed by a
certificate authority (see “Certificate Configuration Procedures” on
page 9-3).
The browser must be configured to trust that certificate authority (beyond
the scope of this documentation).
If trust can’t be established, most browsers allow connection anyway, but
display a ‘nag’ dialog to the user, requesting permission.
2 When the Polycom DMA system connects to a Microsoft Active Directory
server, X.509 certificates may be used to identify the Polycom DMA
system (client) to the MS Active Directory server.
If the MS Active Directory is configured to require a client certificate (this
is not the default), the Polycom DMA system offers the same certificate
that it offers to browsers connecting to the system management interface.
The MS Active Directory must be configured to trust the certificate
authority, or it rejects the certificate and the connection fails.
The Polycom DMA system currently doesn’t check the certificate offered
by the MS Active Directory.
3 When the Polycom DMA system connects to an RMX MCU configured
for secure communications (this is not the default), an X.509 certificate
may be used to identify the RMX MCU (server) to the Polycom DMA
system (client).
The Polycom DMA system currently doesn’t check the certificate offered
by the RMX MCU.
Q. Is it secure to send my certificate request through e-mail?
A. Yes. The certificate request, signed certificate, intermediate certificates,
and authority certificates that are sent through e-mail don’t contain any
secret information. There is no security risk in letting untrusted third
parties see their contents. For maximum security, verify the certificate
9–2 Polycom, Inc.