|
Once you have MPP phones connect to UPLINX Phone Control Webex as per Enable MPP Phone for Remote Control, you can secure it with the steps described below.
How to enable WSS (secure MPP Control Server)
What is WS and WSS
The MPP phones (Cisco 68xx, 78xx and 88xx) connect to the MPP Control Server of UPLINX Phone Control Webex. The phones use the URL shown on the Server tab:
ws://{IP address}:{port}/ not encrypted
wss://{FQDN}:{port}/ encrypted (TLS)
With ws:// everything between the phone and UPLINX Phone Control Webex is sent unencrypted: the screen of the phone, the keys that are pressed, and all control commands.
Which one to use
Use ws:// if the phones and this PC are in the same LAN. This is the simplest way: it needs no certificate, and the traffic does not leave your company network.
Use wss:// if the traffic between a phone and this PC crosses the internet, for example phones in a home office. Never use ws:// over the internet: anybody on the way can read and change the traffic. This is dangerous and not safe.
Requirements for wss
To use wss (when the checkbox Secure is ticked) you must have a certificate from a public CA:
- The phones only trust certificates of public CAs. A certificate cannot be uploaded to a phone.
- A self-signed certificate, or a certificate of a private or company CA, is not trusted by the phones and does not work. The app shows an error and does not accept it.
- The certificate must be issued for a fully qualified domain name (FQDN) that you own, for example mpp.mycompany.com. A host name only (MYPC) or an IP address does not work, and a public CA does not issue such certificates.
- The FQDN must resolve (DNS) to this PC, or for phones outside your network to the public address that forwards the port to this PC.
- The certificate needs a private key (a .pfx or .p12 file with the key and a password), must not be expired, and must be valid for Server Authentication.
The certificate expires. Renew it before that date, otherwise the phones cannot connect any more. If the certificate is not usable when the app starts or when the MPP Phone Listener is enabled, the app switches back to ws:// and shows a warning.
Steps
1. Choose an FQDN, for example mpp.mycompany.com, and create the DNS entry for it.
2. Order a certificate for this FQDN from a public CA.
3. Get the certificate as a .pfx file (certificate with private key, protected by a password).
4. Open the Server tab and tick Secure. The certificate dialog opens (or press Certificate...).
5. Press Import .pfx file..., select the file and enter its password. The certificate is added to the certificate store of your Windows user.
6. Select the certificate in the list. The dialog checks it. Press OK only if there is no ERROR.
7. The URL of the Server tab now starts with wss:// and has the FQDN of the certificate. Press the copy button.
8. On the web page of each phone open Voice > Phone, and enter that URL in the section Control Server URL.
9. Allow the port in the firewall (the app checks the Windows Firewall when the listener starts).
10. Tick Enable MPP Phone Listener.
If a phone does not connect
- The FQDN in the URL of the phone must be exactly the name in the certificate.
- The FQDN must resolve to this PC from where the phone is.
- The certificate must be from a public CA and not expired. The date and time of the phone must be correct.
- The port must be open in all firewalls between the phone and this PC.
- Check the certificate with the button Certificate... on the Server tab: ERROR and WARNING lines tell what is wrong.
|
