- Overview
- Reference Guide
- Setup & Architecture
- Release Notes
- Workflow
- API Reference
- Integration Guide
- Discovery Agent Setup Guide
AudioCodes
Renews the certificates of the TLS contexts on an AudioCodes Mediant session border controller (SBC). One server is one SBC. Each endpoint is one TLS context on that SBC, such as the one that carries SIP over TLS, or the SBC's own web interface. The Renewal Manager works with the SBC through its management interface.
Before You Start
- The Renewal Manager must be Online and must be able to reach the SBC's management interface over HTTPS. By default, this is port 443. Use the SBC Web Port field if the web interface listens on another port.
- An SBC user account whose credentials the Renewal Manager can use to sign in to the management interface.
- The number of each TLS context to renew. In the SBC's web interface, it is shown under IP Network > Security > TLS Contexts. Context 0 is the SBC's own web certificate.
- The name each context's certificate should carry, for example
sbc.ec.com.
Adding an AudioCodes Server
- On the Renewal Manager tab, click the AudioCodes tile in the connector grid and click Add Server.
- Fill in the fields below.
- Click Submit.
| Field | Applies to | What it means |
|---|---|---|
| Server Type | Required, Add only | AudioCodes. Already selected when you start from the AudioCodes tile. |
| Server Name | Required, Add only | A unique display name for this SBC. Cannot be changed later. Maximum 50 characters. |
| Server IP / Hostname | Required | The SBC's management IP address or hostname. Enter the address only, without a scheme or path. |
| SBC Web Port | Optional | The HTTPS port of the SBC's web interface. Leave blank to use 443. Can be changed later. |
| Trusted Certificate ID | Optional | Identifies the SBC's web certificate. Leave blank: CertSecure trusts the certificate the SBC shows the first time it connects, and remembers it. To set it yourself, paste the certificate's SHA-256 fingerprint. Can be changed later. |
| Server Username | Required | The account used to sign in to the SBC. |
| Server Password | Required on Add | The password for Server Username. Stored encrypted. On Edit, leave blank to keep the existing password. |
| Certificate Authority | Required | The CA that will issue renewed certificates for this SBC. |
| Template | Required | The certificate template/profile to request from the selected CA. Options depend on the CA chosen. |
| Owner | Required | The person responsible for this SBC. Autocompletes as you type an organization user's name or email. |
| Organization ID | Only when CA = DigiCert | The DigiCert organization ID to request the certificate under. |
| Order Validity | Only when CA = DigiCert | How many days the requested certificate should be valid for. |
Note: The CA, template, and owner are set on the server, and every endpoint of the SBC is renewed with them.
AudioCodes Server List Actions
Right-click a server row (or open its actions menu) to see:
- View Details – opens a read-only summary of the server's configuration. For an SBC it also shows SBC Web Port, Trusted Certificate ID, and, when there is one, Pending Certificate ID.
- Edit Details – reopens the Add Server form pre-filled, so you can update credentials, CA, template, owner, SBC Web Port, or Trusted Certificate ID.
- Manage Endpoints – opens the endpoint list for this server.
- View Tasks – opens the task history for this server.
- Delete – deletes the server after a confirmation prompt. Deleting a server also removes every endpoint added under it.
How the SBC's Web Certificate Is Trusted
CertSecure remembers the certificate that the SBC's web interface presents, so that it can tell a certificate you renewed from a connection that has been redirected elsewhere.
- Trusted Certificate ID is the certificate CertSecure trusts for this SBC. It is filled in automatically on the first connection and after the SBC's web certificate is renewed.
- Pending Certificate ID appears only after the SBC's web certificate (context 0) has been renewed and before the SBC starts using it. It becomes the Trusted Certificate ID automatically.
- If you type a fingerprint into Trusted Certificate ID yourself, that certificate is the one trusted.
- Saving a Trusted Certificate ID on the server clears any Pending Certificate ID.
Adding an AudioCodes Endpoint
An endpoint is one TLS context on the SBC.
- From the server list, open Manage Endpoints on the server (right-click → Manage Endpoints).
- Click Add Endpoint.
- Fill in the fields below.
- Click Submit.
| Field | Applies to | What it means |
|---|---|---|
| Hostname | Required | The name on the certificate, for example sbc.contoso.com. A leading "." is allowed for a wildcard certificate. Stored in lowercase. |
| Port | Required | The port this context serves, for example 5061 for SIP-TLS or 443 for the web interface. |
| TLS Context ID | Required | The context's number on the SBC, under IP Network > Security > TLS Contexts, from 0 to 1023. 0 is the SBC's own web certificate. Each context can be added only once per server. |
| TLS Context Name | Optional | A label to recognise this context, for example teams. |
| Rotate Key | Optional | When switched on, the SBC creates a new private key on the device at each renewal. Off by default. Not available for context 0. |
| New Key Size | Only when Rotate Key is on | The size of the new private key: 2048 Bits (default) or 4096 Bits. |
The endpoint list shows Hostname, Port, TLS Context, Context Name, Rotate Key, and New Key Size for each endpoint.
Endpoint Actions
From the endpoint list, use the row actions (right-click or the actions menu) to:
- View Details – opens the Endpoint Information window.
- Renew – opens the Renew Endpoint dialog.
- Delete – removes this endpoint from the server. It does not affect other endpoints on the same server.
Renewing an AudioCodes Certificate
- Open Manage Endpoints on the server, find the endpoint, right-click and choose Renew.
- If the endpoint is in TLS context 0, read the warning and tick I understand the SBC's own certificate will be replaced.
-
Pick one of:
- Renew Now – queues the renewal immediately.
- Schedule Renewal – pick a date and time at least 30 minutes from now using Enter Schedule Time.
- Click Renew (or Schedule if you chose to schedule it).
Before you can renew manually:
- The Renewal Manager Agent must be Online.
- The endpoint must already exist under the server. Add it first if it does not.
Context 0 and Key Rotation
- TLS context 0 is the SBC's own web and REST certificate. Renewing it replaces the certificate you use to reach the SBC, which is why the Renew dialog asks you to confirm first.
- The key of context 0 cannot be rotated. Rotate Key is switched off and unavailable when the TLS Context ID is 0.
- After context 0 is renewed, the new certificate is shown as the Pending Certificate ID until the SBC starts using it.
Viewing Tasks
Here is how to check renewal progress:
- Right-click a server → View Tasks.
- Use Search Keyword, the column filters, or Refresh to find a specific task.
Task Columns
| Column | What it shows |
|---|---|
| Info | A colored status badge: OK, ERROR, PROCESSING, PENDING, INITIALIZED, or WARNING. |
| Task ID | The unique ID of this task. |
| Updated On | When the task status last changed. Filterable by date. |
| Task Name | What kind of task this is, for example a renewal. |
| Details | A short description of the current status or the last error. |
| IP Address | The endpoint address(es) involved. |
| Status | The current status text. |
Task Status Meanings
- INITIALIZED – the task was just created and is queued.
- PENDING – waiting for the agent to pick it up.
- PROCESSING – the agent is actively working on it.
- OK – completed successfully.
- WARNING – completed, but with something worth checking.
- ERROR – failed. Check Details for the reason.
Troubleshooting
| Symptom | What to check |
|---|---|
| The form shows "Enter a SHA-256 fingerprint: 64 hex characters, colons optional" | Paste the SBC web certificate's SHA-256 fingerprint as 64 hexadecimal characters. Separators are ignored. Leave the field blank to let CertSecure learn it on first connection. |
| The endpoint is skipped when added | That TLS Context ID already exists on the server. A context can be added only once per server. |
| The endpoint is refused with "rotate_key is not supported on TLS context 0" | Switch Rotate Key off for context 0. |
| The form shows "TLS Context ID must be between 0 and 1023" | Enter a whole number from 0 to 1023, as listed under IP Network > Security > TLS Contexts on the SBC. |
| The form shows "Enter the name on the certificate, for example sbc.ec.com" | Enter a DNS name, with an optional leading "." for a wildcard certificate. |