Appendix J: ICE Private Certificate Stores
A certstore (certificate store) is a repository for certificates used to secure audio communication between Instant Connect components. Note that while certstores use standard X.509 certificates—the same as those used to secure HTTPS connections—the certstore described here applies only to the certificates used by the Instant Connect Engage Engine for voice traffic. The ICE certstore is required to securely provide certificates to servers, clients, and other components of the Instant Connect Enterprise system that utilizes the Engage Engine.
Changes to Certificate Management in 3.6.5
In version 3.6.5 and newer, ICE Enterprise systems generate unique certificates during installation or upgrade. In Tactical environments, when an ICE Server is not in use, ICE Mobile, ICE Desktop and ICE Agent components ship with a new, default, certstore.
Certstore Changes
The following changes to the certstore between versions can potentially effect the behavior and operation of existing environments. User should take note of these special considerations:
Peering Rallypoints: When peering Rallypoints between different ICE Server systems, all Rallypoints must use the same certstores. In versions prior to 3.6.5, this was always true, unless an administrator applied their own certstore. In 3.6.5, each ICE Server system uses its own certificates. To reconfigure the system to use the correct certstore, first create a new certstore and then apply it to all ICE Server systems with Rallypoint connections.Hybrid Tactical Environments: When using ICE Mobile or ICE Desktop in both Tactical and Enterprise modes, in versions prior to 3.6.5, Tactical clients configured to use an Enterprise Rallypoint would successfully connect without any special configuration or intervention (again, because both modes would use the same default certstore). In 3.6.5 and later, a tactical client will not be able to connect to an Enterprise Rallypoint Understanding ICE Certificates
Instant Connect clients typically maintain the following two connections to the ICE Server environment:
A web socket connection for provisioning, configuration, and signaling data (for example, specifying which channels a user has access to and how those channels are configured).A TLS socket to a Rallypoint for transmitting and receiving PTT and phone call audio (“media”). This connection is only used by channels that are configured to use a Rallypoint. Only one connection to a Rallypoint is established, even if there are multiple active channels using that Rallypoint.Each of these connections is secured by a different SSL (X.509-standard) certificate:
Server Identity > Client:The Server Identity Certificate installed on the ICE Server ingress that the ICE Server transmits to clients (such as ICE Desktop and ICE Mobile) to assure clients that the ICE Server they are communicating with is legitimate and not an impostor or man-in-the-middle.
Client < > Rallypoint Mutual:A pair of certificates used for mutual authentication between the ICE client’s Engage Engine and any Rallypoint that client connects to.
Additionally, other certificates may be used, such as those for radio systems, telephony systems, Active Directory (LDAP), and other adjacent systems. This section primarily focuses on the certificates used for mutually authenticating the Engage Engine and Rallypoint.
Mutual authentication means the client provides a certificate to the Rallypoint, and the Rallypoint provides a certificate to the client. Both parties inspect and validate the certificate before completing the connection and allowing information to be sent between them. Verifying a certificate involves checking that it was issued by a certificate authority (“CA”) whose certificate (or certificate chain) is present on the system performing the validation. Each component—the client and the Rallypoint—contains a CA certificate and verifies that the identity certificate from their peer was genuinely created by the certificate authority and appropriately identifies the peer as an authorized agent. This process follows industry standard practices documented elsewhere. (See https://www.ssl.com/article/browsers-and-certificate-validation/).
When Instant Connect is first installed, the ICE OS Installation Wizard offers the option to create a default set of all certificates and provision them throughout the system, or to upload your own certificates. Administrators can also apply a different set of certificates at any time. The following three sets (bundles) of certificates are used in the Instant Connect media ecosystem:
Client BundleA client certificate bundle, consisting of the identity certificate that clients will present to a Rallypoint, the private key associated with the certificate, and the CA certificate used to verify the identity certificate presented by the Rallypoint. This certificate bundle is distributed to all ICE Mobile and ICE Desktop clients.
Server (Rallypoint) BundleA server certificate bundle, consisting of the identity certificate that Rallypoints will present to clients, the private key associated with this certificate, and the CA certificate used to verify the identity certificate presented to Rallypoints by ICE clients. This certificate bundle is distributed to all Rallypoints.
Infrastructure BundleAn infrastructure certificate bundle, consisting of all the aforementioned certificates: the client and Rallypoint identity certificates, their private keys, and the CA certificates used to verify them. This certificate bundle is distributed to server-side infrastructure (like radio and telephony gateways, patch servers, and similar components).
While these certificate bundles are distinct elements, their contents must be interrelated for them to work. When supplying a new configuration of certificate bundles, ICE Server will validate that all three certificate bundles interoperate by ensuring these constraints are met:
Certificate Constraints
Each identity certificate must have a valid private key.The CA certificate(s) in the client bundle must be able to verify the identity certificate in the Rallypoint bundle.The CA certificate(s) in the Rallypoint bundle must be able to verify the identity certificate in the client bundle.The CA certificate(s) in the infrastructure bundle must be able to verify the identity certificates in both the client and Rallypoint bundles.