Technical Bulletin TB37148 describes the way Polycom phones are submitted Certificate Signing Requests (CSR) through the web / provisioning server.
In step 3, on page 7, it states "A message ‘CSR generation completed’ displays on the phone’s screen. The CSR file (<MAC
Address>.csr) and the private key file (<MAC Address >-private.key) are uploaded to the provisioning server. The public key (the other part of the key pair generated by the phone) is included in the CSR."
I tested this workflow and observed that the phone really does try to send the private key to the web server.
a) sending the private key out of the phone is a security risk. It could be sniffed by a man-in-the-middle or a proxy server. Copies of the key may be accidentally left on the web server, some administrators may not even realize they are there, because no other correctly implemented CSR workflow does anything like this, it is completely unexpected behavior
b) it is not necessary to send the private key to the server anyway - all the information needed to create a certificate is actually included in the CSR. Only the CSR should be sent to the web server.
Is anybody able to comment on this issue? Is there any workaround or will it be fixed in the next firmware releases?
Hello pockock ,
this was internally raised via VOIP-121344 and will be added to future software versions.
Please ensure to provide some feedback if this reply has helped you so other users can profit from your experience.
Polycom Global Services
As well as fixing this issue, could you ask the developers to automatically fill out the CN field in the CSR form? It would be really convenient to have the MAC address appear automatically. As it relates very closely to this issue, it can probably be implemented and tested as part of the same release cycle.