Media Encryption

Media encryption, also called secure media, refers to configuring CUCM to allow devices to register as secure devices, if they are capable. For instance, if an IP phone has secure media capability, it will register with CUCM as a secure device. Audio for calls to/from that phone will then be encrypted, if the far-end device is also a secured device.

In order to enable encrypted audio in a CUCM environment, there are several steps that need to be completed, both on the PBX end and on the TSP end. On the PBX, the overall security mode needs to be updated, followed by creating secure phone profiles and secure SIP trunk profiles. Phones need to be updated, and trunks need to created/updated to use the secure profiles. Lastly, Application User Certification Authority Proxy Function (CAPF) Profiles need to be created for each Application User that is to be used to establish a secure connection between PBX and TSP. The Application Users must then be updated to use the new CAPF Profiles. On the TSP side, a secure Application User must be entered, and the Security settings need to be updated.

Provided in this section is a condensed version of the process needed to enable encrypted audio in a Cisco UCM environment, in preparation to use encrypted audio in a QMS installation that uses Forked Audio. While these steps will cause audio and call control to be encrypted in general, QMS only supports encrypted audio in a Forked Audio installation. Full details for the steps listed in the PBX Configuration section below can be found in the Cisco Unified Communications Manager Security Guide.

PBX Configuration

Set the Cluster Security Mode to Mixed Mode on the PBX
1. Purchase at least two USB security keys from Cisco.
2. From a PC or server that is able to communicate with the PBX, download the CTL Client.
  1. Log into the CUCM Admin site.
  2. Go to Application > Plugins, and click Find.
  3. Find the CTL Client in the list, click the Download link, and run the installer.
3. Launch the CTL Client after the installation has completed.
4. Select the option Set Cisco Unified CallManager Cluster to Mixed Mode and click Next.
5. Insert the Cisco security keys when prompted.
6. After both keys have been processed and added to the PBX, click Finish.
7. Reboot the PBX when prompted and close the CTL Client.
Set up secure phone profiles
1. Log into the CUCM Administration site with a user that has admin-level permissions.
2. Go to System > Security > Phone Security Profile.
3. Create a new Phone Security Profile with the following settings:
  1. Device Security Mode = Encrypted.
  2. TFTP Encrypted Config enabled.
  3. Authentication Mode = By Existing Certificate (precedence to MIC).
  4. Key Size = 1024 (default, 2048 can be used if stronger encryption is desired).
4. Click Save. No phones have been assigned to the profile yet, so Apply Config is not necessary.
Set up an Encrypted SIP Trunk Security Profile
1. Log into the CUCM Administration site with a user that has admin-level permissions.
2. Go to System > Security > SIP Trunk Security Profile.
3. Create a new SIP Trunk Security Profile with the following settings:
  1. Device Security Mode = Encrypted.
  2. Incoming Transport Type = TLS.
  3. Outgoing Transport Type = TLS.
  4. Incoming Port = 5061.
4. Click Save. No SIP Trunks have been assigned to the profile yet, so Apply Config or Reset are not necessary.
Configure phones to register with the PBX as Encrypted
1. Log into the CUCM Administration site with a user that has admin-level permissions.
2. Go to Device > Phone, click Find.
3. Click the device name for the phone.
4. Scroll down the list of phone settings and find Device Security Profile.
5. Set the Device Security Profile to the Secure Profile for the given phone model.
6. Click Save, then Click Apply Config.
7. If the phone doesn’t reset automatically, then click Reset.
8. Verify the phone registers with the PBX as Encrypted by doing the following:
  1. Press the settings button on the phone.
  2. Scroll down the menu and select Security Configuration.
  3. Security Mode will say Encrypted if the phone registers securely with the PBX, and Non-Secure otherwise.
Create encrypted SIP trunks for each TSP that needs to have a secure connection to the PBX.
1. Log into the CUCM Administration site with a user that has admin-level permissions.
2. Go to Device > Phone, click Find and select an existing trunk or click Add New to create a new trunk. Set the following:
  1. Enable SRTP Allowed.
  2. Consider Traffic on This Trunk Secure = When using both sRTP and TLS.
  3. SIP Destination Port = 5061.
  4. SIP Trunk Security Profile = (the encrypted SIP Trunk profile created above).
3. Click Save. If prompted to do a reset, click Reset.
Create Application (TSP) User CAPF Profiles to establish secure communication with the PBX
1. Log into the CUCM Administration site with a user that has admin-level permissions.
2. Go to User Management > User Settings > Application User CAPF Profile and click Add New. Set the following:
  1. Select an Application User from the list that will be used to establish a secure connection between PBX and TSP.
  2. Enter an Instance ID, which can be any valid string of text.
  3. Certificate Operation: Install/Upgrade.
  4. Authentication Mode: By Authentication String.
  5. Click the Generate String button to populate the Authentication String.
  6. Set the desired Key Size.
  7. Set the Operation Completed By to a date far enough into the future to allow the TSP to be installed and configured.
3. Click Save.
Create an Application (TSP) User for each TSP requiring secure communication with the PBX.
1. Log into the CUCM Administration site with a user that has admin-level permissions.
2. Go to User Management > Application User, click Find and select an existing Application User, or click Add New to create a new Application User.
3. Enter a User ID and Password.
4. For the devices this Application User is supposed to control, move the devices from the Available Devices list down to the Controlled Devices list.
5. Confirm the Associated CAPF Profiles list contains the CAPF Profile created previously for this user.
6. Add the following three groups to the Groups list under Permissions Information:
  1. Standard CTI Allow Reception of SRTP Key Material.
  2. Standard CTI Enabled.
  3. Standard CTI Secure Connection.
7. Verify Roles of the same names have been populated in the Roles list.
8. Click Save.

TSP Configuration

On the TSP side, configuration for encrypted media is contained on the Security tab of the Cisco TSP Configuration. On the QMS server, right click the Cisco TSP Notifier icon, and select Cisco TAPI Configuration.
Highlight CiscoTSP001.tsp (this is the default name of the configuration profile, and may have been named differently during TSP installation), then click Configure.
Click on the Security tab.
Check both Secure Connection to CTIManager and Fetch Certificate checkboxes.
In the CAPF Settings section, enter the Authorization String and Instance Identifier values created in step 6.2 in the PBX Configuration section above.
Enter in the CAPF Server IP (usually the IP of the CUCM server), CAPF Port, Number of Retries and Retry Interval for Certificate Fetch values.
In the TFTP Settings section, enter in the TFTP Server IP address (usually the IP of the CUCM server).
Click OK to save the changes.
For the TSP to actually fetch the certificate information from CUCM, an application must exercise the TSP to communicate with CUCM. Stop the QMS Call Recording Service if it is running, pause 20 seconds to make sure all ports used by QMS have been released, then restart QMS Call Recording Service.
Access the Security tab within the Cisco TSP Configuration.
If the certificate information was successfully received, the Fetch Certificate checkbox will be unchecked, Certificate STATUS will report Available, and the Authorization String field will be blank.

QMS Configuration

Creating self-signed certificates on the QMS server: To enable security between QMS and the Cisco PBX using self-signed certificates, we need to generate two certificates:

A root certificate that represents the Certificate Authority.
A certificate that represents the identity of the client or service.

If the environment has more than one Call Recording Server, each Call Recording Server will need to have the Cisco TSP installed. The steps below will therefore need to be executed on EACH Call Recording server, because each server will need to have its own unique certificate to create a secure connection to the PBX.

There are three command-line utilities that are used to create the certificates. The utilities can be found in the Program Files (x86)\Windows Kits\8.0\bin\x64 folder. An alternative location, depending on what version of .NET is installed, would be the Program Files (x86)\Windows Kits\10\bin\x64 folder. If neither of these locations exist on the QMS server, download and install either the Windows 8.1 or Windows 10 SDK onto the QMS server. This will install the three utilities, which are:

Makecert.exe: creates X.509 certificates, as well as the following:
- Generates a public key and a private key.
- Associates the key pair with a host name.
- Binds the host name to the public key.
Cert2spc.exe: creates a Software Publisher’s Certificate (SPC) from an X.509 certificate.
Pvk2pfx.exe: creates a PKCS12 file from a certificate’s private key and an SPC file.

The steps to create the self-signed certificates are as follows:

On the QMS server, start a Command Line window, using the Run As Administrator option.
First, a self-signed Root CA certificate needs to be created. Type the following command:
```
C:\>  makecert -sv <server name>_RootCA.pvk -r -n "CN=<server name or IP address>" -len 1024 <server name>_RootCA.cer
```
1. Replace the <> bracketed items with values relevant to the environment.
2. -sv specifies the file that contains the private key. The private key will be used for signing certificates issued by this certificate authority. Makecert will ask for a password to protect the private key in the file.
3. -r indicates that the certificate will be a root certificate because it is self-signed.
4. -n specifies the common name for the root certificate authority; this should be the name of the server. The convention is to prefix the name with "CN=" where CN stands for "Common Name".
5. -len specifies the key length in bits (default is 2048)
6. The <server name>_RootCA.cer file will contain the public key only.
Next, a certificate will need to be created for the QMS Call Recording service. Type the following command:
```
C:\>  makecert -ic <server name>_RootCA.cer -iv <server name>_RootCA.pvk  -n "CN=<server name or IP address>" -sv <server name>_Cert.pvk -pe -sky exchange -len 1024 <server name>_Cert.cer
```
1. Replace the <> bracketed items with values relevant to the environment.
2. -ic specifies the name of the root certificate (.cer) file created in step 1.2 above.
3. -iv specifies the name of the container file for the private key of the root certificate created in step 1.2 above.
4. -n specifies the name for the certificate.
5. -sv specifies the key file for the certificate. This must be unique for each certificate created. If a name is reused, an error message is displayed.
6. -pe specifies that the private key is exportable and is included with the certificate. For message security this is required because the corresponding private key is needed.
7. -sky specifies what kind of key is being created. Using the exchange option enables the certificate to be used for signing and encrypting messages.
8. -len specifies the key length in bits (default is 2048), and should be the same value specified in step 1.2 above.
Finally, a PKCS12 (.pfx) file needs to be created. First, run the following command to create the intermediate SPC file:
```
C:\>  cert2spc <server name>_Cert.cer <server name>_Cert.spc
```
1. Replace the <> bracketed items with values relevant to the environment.
2. Next, run the following command to create the PKCS12 file based on the certificate and SPC files:
  C:\> pvk2pfx -pvk <server name>_Cert.pvk -spc <server name>_Cert.spc -pi <password> -pfx <server name>_Cert.pfx
3. Replace the <> bracketed items with values relevant to the environment.
4. -pvk specifies the name of the file containing the private key created in step 1.3 above.
5. -spc specifies the SPC file created in step 1.4 above.
6. -pi specifies the password to be used to secure the PKCS12 file.
7. -pfx specifies the name of the PKCS12 file to be created.
Repeat steps 2 through 5 for every Call Recording Server

Import certificates into the QMS server’s certificate store: On the QMS end, the PKCS12 and root certificates will need to be installed into the QMS server’s certificate store. If there is more than one Call Recording Server in the environment, these steps will need to be run on EACH server. The following steps outline installing both certificates:

Start the Microsoft Management Console by right-clicking the Start button, selecting Run, typing in "mmc", and clicking OK.
In the MMC window, go to the File > Add/Remove Snap In menu item.
Under Available snap-ins, select Certificates, click Add to move it under Selected snap-ins.
In the "Certificates snap-in" window, select "Computer account" and click Finish.
On the Select Computer window, verify Local Computer is selected, and click Finish.
Click OK. Certificates should now appear under Console Root in the MMC window.
Expand the Certificates node.
To import the RootCA certificate, right-click on the Trusted Root Certification Authorities node, mouse-over All Tasks, and select Import.
On the Certificate Import Wizard window, click Next (Local Machine should be selected as the Store Location).
On the "File to Import" view, click the Browse button to locate and select the <server name>_RootCA.cer file. Click Open.
Click Next. On the "Certificate Store" view, the "Place all certificates in the following store" option should be selected, and "Trusted Root Certificate Authorities" should be automatically populated in the Certificate store field.
Click Next, then click Finish. A message should pop stating "The import was successful."
To import the PKCS12 file, in the main MMC window, right-click on the Personal node under the Certificates node, mouse-over All Tasks, and select Import.
On the Certificate Import Wizard window, click Next (Local Machine should be selected as the Store Location).
On the "File to Import" view, click Browse to locate and select the <server name>_Cert.pfx file. Change the file type drop-down from the default "X.509 Certificate (.cer;.crt)" to "Personal Information Exchange (.pfx;.p12)". Find and select the .pfx file, and click Open.
Click Next. On the "Private key protection" view, enter in the password specified in the pvk2pfx command-line options from step 1.5 in the previous section.
Click Next. On the "Certificate Store" view, the "Place all certificates in the following store" option should be selected, and "Personal" should be automatically populated in the Certificate store field.
Click Next, then click Finish. A message should pop stating "The import was successful."
Close the MMC window.
Repeat these steps for every Call Recording Server.

Upload certificates to the Cisco PBX: On the PBX side, both the RootCA certificate and the service certificate need to be uploaded. If there is more than one Call Recording Server in the environment, these steps will need to be run to import certificates for all server. To upload the certificates, do the following:

Copy the <server name>_Cert.cer and <server name>_RootCA.cer to a location that is accessible from the Cisco PBX.
Log into the Cisco Unified Communications Operating System site with a user that has admin-level privileges.
For each of the two .cer files, do the following steps:
1. Navigate to Security > Certificate Management. The Certificate List window displays.
2. Click Upload Certificate. The Upload Certificate/Certificate Chain dialog box opens.
3. Select "CallManager-trust" from the Certificate Type list.
4. Click Browse, navigate to the certificate file, and click Open.
5. Click Upload File.
6. Repeat for every Call Recording Server’s certificates.