ENABLE_PUBLIC_CA_CERTS

Numeric

0

Specifies whether the services other than Device Enrollment Service (DES) and re-directed file server using DES use embedded public root CA certificates.

Valid values:

• 0: Embedded public CA certificates are trusted when TRUSTCERTS is empty/null. (Default)
• 1: Embedded public CA certificates are always trusted.

DES always uses the embedded public root CA certificates. For the re-directed file server using DES, the embedded public root certificates are used if DES service did not provide private CA.

If DES provides private CA, then the embedded public root CA certificates are ignored (however if DES is re-triggered from admin menu and private CA is provided from DES then the embedded public root CA certificates will be used according to ENABLE_PUBLIC_CA_CERTS).

For rest of the services, this parameter controls whether embedded public root CA certificates are used (in addition, to downloaded trusted certificates) or not (only downloaded trusted certificates are used).

If DES did not provide private CA, then the ENABLE_PUBLIC_CA_CERTS is set to "1" without ability to change it. If DES provides private CA, then this parameter is configurable (in such case, TRUSTCERTS shall include DES service private CA, else the phone will not be able to re-connect to the re-directed file server).

For cases where DES is not used, then the parameter is fully configurable and if ENABLE_PUBLIC_CA_CERTS is "0" and no downloaded trusted certificates (TRUSTCERTS=="") then the phone trusts for any HTTP/S file server for configuration / image download and fails with rest of services (PPM/SIP, AADS, etc.). If either ENABLE_PUBLIC_CA_CERTS is "1" and/or TRUSTCERTS<> "" then the service must have identity certificate that can be validated using the embedded public root CA certificates (if ENABLE_PUBLIC_CA_CERTS is "1") or downloaded trusted certificates (if TRUSTCERTS <>"") - there is no exception to configuration and software files download from the HTTP/S file server.

TRUSTCERTS

String

NULL

Specifies a list of file names that contain copies of CA certificates in the PEM format. These certificate files are downloaded, saved in the non-volatile memory, and used by the phone to authenticate the received server identity certificates.

The list can contain up to 255 characters. The file names are comma-separated without intervening spaces.

Define the file name in one of the following formats:

• Absolute URL. For example,http://username:password@provisioning.example.com:8088/path/Trust1.txt
• Absolute Path, that ignores the defined HTTPDIR or TLSDIR values. For example, /path/Trust1.txt
• Relative Path, that appends to the defined HTTPDIR or TLSDIR values. For example, path/Trust1.txt

MAX_TRUSTCERTS

Numeric

10

Specifies the maximum number of trusted certificates files that the phones can download. MAX_TRUSTCERTS enforces the number of certificates. Valid values are from 1 to 10.