Certification for web authentication

Certificates are commonly used to identify server or device to which we are trying to connect. Nowadays digital certificates for web application are used according to the ITU X.509 standard. The certificate is issued by some trusted issuer or Certification Authority (also shortened to CA) and assigns public key to either domain name or IP address. If certificate is issued for different IP address or domain name, than the destination really has, modern web browser will usually inform us that the web page can be forged. Certificates are issued on limited time (for security reasons), after this time it is needed to renew validity of the certificate (often a year for server and client applications with reserve of a few days). After the expiration of a certificate web browsers will point out that the certificate is invalid because of authentication fo server will not pass. Connectivity to our devices web interface is provided by secured HTTPS protocol, which requires valid certificate. We are sure you have already encountered this "invalid security certificate" warning in your web browser... Prerequisites 2N IP Intercom / 2N Access Unit / 2N Answering unit / 2N SIP Audio based on 2N OS with the latest firmwareno additional license is required Issuing certificate Certification authority on the InternetIt is possible to find many CAs on the Internet, most of them offer trusted certificates that are issued on the domain name. Many of these CAs are already assigned to trusted root CAs in your web browser. Your own certification authorityIt is possible to create your own CA, however it is needed to import certificate of such CA in to the web browser.We will show you example of using OpenSSL certificate toolkit under a linux based system (e.g. Ubuntu).More information you can find also here: https://ubuntu.com/server/docs/opensslhttps://jamielinux.com/docs/openssl-certificate-authority/introduction.html Open a linux command line (terminal)Create a Certification Authority Start the procedure by this command admin@ubuntu:~$ openssl req -out ca.crt -new -x509 During command processing you will be prompted for password creation and verification. This password will be used to protect your private key so the key file cannot be used to issue assign unauthorised certificates with your private key. Enter PEM pass phrase: YourPassword123 Verifying - Enter PEM pass phrase: YourPassword123 Now fill in data about your CA (use your own data, below is just an example) You are about to be asked to enter information that will be incorporated into your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]: CZState or Province Name (full name) [Some-State]: PragueLocality Name (eg, city) [ ]: PragueOrganization Name (eg, company) [Internet Widgits Pty Ltd]: 2NOrganizational Unit Name (eg, section) [ ]: TechsupportCommon Name (e.g. server FQDN or YOUR name) [ ]: TestUserEmail Address [ ]: (we left this blank) Two files have been created (you can find them in /home) ca.crtcontaining certificate of our CAprivkey.pemcontaining private key of our CA, needed to sign and issue new certificates by this CA Create CSR (Certificate Sign Request) with RSA (cryptographic algorithm) Private Key Start the procedure by this command (name IPINTERCOM can be changed) admin@ubuntu:~$ openssl req -newkey rsa:2048 -noenc -keyout IPINTERCOM.key -out IPINTERCOM.csr This file has been created (you can find it in /home) IPINTERCOM.keyRSA (cryptographic algorithm) Private Key Now fill in data about the certificate and its owner.(use your own data, below is just an example)Very important item is Common Name which must contain IP address or Domain Name under which the 2N device can be accessed. Without this correct parameter authentication won't be made correctly and web browser will inform you that this web page is untrustworthy. You are about to be asked to enter information that will be incorporatedinto your certificate request.What you are about to enter is what is called a Distinguished Name or a DN.There are quite a few fields but you can leave some blankFor some fields there will be a default value,If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]: CZState or Province Name (full name) [Some-State]: PragueLocality Name (eg, city) [ ]: PragueOrganization Name (eg, company) [Internet Widgits Pty Ltd]: 2NOrganizational Unit Name (eg, section) []: TechsupportCommon Name (e.g. server FQDN or YOUR name) [ ]: intercom.localEmail Address [ ]: (we left this blank) Please enter the following 'extra' attributes to be sent with your certificate request A challenge password [ ]: (we left this blank)An optional company name [ ]: (we left this blank) This file has been created (you can find it in /home) IPINTERCOM.csrcontaining new certificate request Create configuration file containing the DNS entries Open a text editor and insert this content (this are not terminal commands), save as "Cert.conf". authorityKeyIdentifier=keyid,issuer basicConstraints=CA:FALSE subjectAltName=@alt_names [alt_names] DNS.1=intercom.local If you are generating for IP address, make sure to change "DNS.1" to "IP.1" instead. Sign the CSR (Certificate Sign Request) with your CA (Certification Authority) Start the procedure by this command (use the files from the previous steps) admin@ubuntu:~$ openssl x509 -req -sha256 -CA ca.crt -CAkey privkey.pem -in IPINTERCOM.csr -out CERT.crt -days 365 -CAcreateserial -extfile Cert.conf Now just enter the pass phrase for the privkey.pem Certificate request self-signature oksubject=C =CZ, ST = Prague, L = Prague, O = 2N, OU = Techsupport, CN = intercom.local Enter pass phrase for privkey.pem: YourPassword123 This file has been created (you can find it in /home) CERT.crtcontaining the certificate for the device Loading CA certificate into browser This is step needed for certificates created by your own CA (e.g. by OpenSSL), in case of trustworthy CA from the Internet, you can pass this section. In the browsers go to Settings - Privacy - Security and just import the certificate authority file (in our case CA.crt).Here is an example for Firefox: Loading device certificate into the device Please go to section System - Certificates - User Certificates and upload a new certificate.You will need the device certificate file CERT.crt, intercom RSA private key IPINTERCOM.key and the private key password.It is possible that some Internet Certification Authorities will give you just one file containing both certificate and private key. This file must be then uploaded in both User Certificate and Private Key boxes. Please go to section Services - Web Server and assign this certificate for web interface. Finally, please go to section System - Maintenance and restart the device.With new start new certificate and key will be used for HTTPS communication.

Configuration backup - How to backup a configuration and how to capture a trace for 2N SIP Speaker (Horn)

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface. The backup of the database of 2N® SIP Speaker (Horn) you do in the web interface in System / Maintenance / Configuration using "Backup configuration" button. The capture of the trace you do in System / Network / Trace using 3 control buttons. The trace file is in the format *.pcap which can be opened in Wireshark. red dot to start the capture black square to stop the capture down arrow to download the trace to your PC

Creation of SIP Trunk

Go to Virtual ports ‐> SIP folder and add there a new virtual port. In popped window specify the SIP trunk name and choose in “Type“ parameter option “SIP Gateway“. Then go to SIP Proxy and in bookmark “Stack” set parameters according to the picture below. Connect to the gateway – IP address of the opposite side (VoIP provider for example).Register line – if your VoIP provider requires registration, activate this parameter and specify registration number.Authorization data – specify a login and a password for authorization.RTP interface – make a right mouse button click and add RTP interface.Codecs – transfer required codecs from “Supported” to “Selected”.DTMF according to RFC‐2833 – check this option for proper transmission of DTMF

Factory reset - How to make a factory reset

To make a factory reset you need to use the RESET button of 2N® SIP Speaker (Horn). How to proceed you can find in the Installation manual, see links below.2N® SIP Speaker HornLINK: https://wiki.2n.cz/sshi/latest/en/3-funkce-a-uziti/3-2-vychozi-nastaveni 2N® SIP Speaker (wall mounted)LINK: https://wiki.2n.cz/sswm/latest/en/3-funkce-a-uziti/3-2-vychozi-nastaven

Firmware - How to make a firmware upgrade

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface. The firmware upgrade of 2N SIP Speaker (Horn) you can do in the web interface in System / Maintenance / System using "Upgrade Firmware" button. The latest firmware files you can find at 2n.cz in the download section.

How to backup database of 2N SIP Mic

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface. The backup of the database of 2N SIP Mic you do in the web interface in System / Maintenance / "Download configuration" button.

How to provide all information to effectively resolve a technical issue on SIP Audio

To answer all your questions as effectively and quickly as possible we would like to ask you kindly to provide all information needed in just one step. Information what we will need are following: Detailed description of device behaviour and also the description of environment S/N (serial number) FW version Database backup Trace Anything else what could be linked with the issue

How to provide all information to effectively resolve a technical issue with 2N OS device

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface. In case you have found some issue with 2N OS device, please report it to Technical Support. If you do not have access information, contact your account manager.Or you can report your issue by creating a ticket - here. The reported issue should contain the following information: Describe us the issue in a close detail, so that we will be able to replicate the behavior at 2N Tech Support. Send us the description of the LAN topology, NATs, IP addresses, etc. If your issue can be clearly visible or heard e.g. LED blinking or bad sound quality, please take a picture or record a video (e.g. on a phone) and send us this behavior. You can attach it to the e-mail or upload it to e.g. WeTransfer, Dropbox, Google Drive and send us the download link. Know the Device Information The serial number and the current FW version of your 2N OS device.It is highly recommended to use always the newest FW version available on 2N web page - here Backup the Configuration Send us the current configuration of the device - in the pictures below there is shown how to do that. Capture the Wireshark trace Catch the Wireshark trace on 2N OS device. Here first of all activate the capturing by "Start" button, make a call and deactivate the capturing by "Stop" button. Then download hiptrace.pcap file and send it to the support. Because the buffer for trace is limited, it is really necessary to start the trace right before you will make a test call. Capture an internal Syslog on 2N OS device. If 2N Tech support asks you for a Syslog they usually want the setting that is shown in the picture below. Unlike in Wireshark trace the buffer is not limited by size but time. Please set the Required Saving Time + Severity level according to 2N Tech support needs. After setting press the "Start" button and the Syslog will automatically stop after the time you defined in Required Saving Time, then save the syslog.txt file and send it to us. 6. Capture an external Syslog on 2N OS device. The external syslog is often use to capture syslog messages immediately after rebooting the device which often can't be done by internal Syslog. Please fill the Severity Level according to 2N Tech support needs. You will need a syslog server where the messages from the device will be sent. Set the Server Address in our example we use 192.168.1.15 - IP Address of a PC where SyslogWatcher is installed 7. Using SyslogWatcher - download here Start the server - it will take a few seconds until you see any messages Stop server - press after you are done with capturingExport - press this button to export messages to fileExport Settings - Choose the time from/to according to what 2N Tech support demands (1h, 24h)Custom files (CSV/XML/TXT/JSON/etc.) - type of file Export folder - choose path to save the fileFilename - name of the file (in default it is date of Syslog capturing) -> export the file with .txt suffix and send it to us

HTTP commands are a very useful tool for interconnection of 2N SIP Audio Converter with remote systems. Please note that HTTP commands are only available with PROFI license. Inbound HTTP commands: Advanced settings > Miscellaneous please allow switch control by HTTP commands. Then you can send a HTTP command in specific format to 2N® SIP Audio Converter and control its switch according to its basic settings. You have to use following format of request: http://intercom_ip_address/enu/lockstate.xml.p?lockXstate=Y, where X is the lock number (1-4) and Y is 0 for switch off, 1 for switch on and 2 for change over. Outbound HTTP commands: You can either send out a signal that a lock has been switched or control some remote device. In Basic settings > lock please the type in the HTTP command which should be sent by your 2N SIP Audio Converter when lock is opened and when it is closed. You can use both or one only. If you just want to use HTTP lock without actually switching the relay of 2N SIP Audio Converter, set Output relay to NONE. In such case you only have HTTP commands that will be sent.

HTTP - How to trigger pre-recorded announcement message by HTTP command

With 2N SIP Audio Converter or 2N SIP Speaker, you are able to upload your own announcement messages. Message can be recorded directly via your microphone or you can upload previously recorded audio file into the device. Info Your audio file has to fulfill certain requirements, to be able to upload the audio file into the device. Parameters of the audio file are: WAV format PCM encoding with 8 kHz sampling frequency 8/16-bit sample resolution File size up to 256 kB (in case of 2N SIP Audio Converter/SIP Speaker) or up to 2 MB (in case of 2N SIP Horn Speaker) Maximum file playing time up to 16 seconds (for 8-bit resolution) or 8 seconds (16-bit resolution). You can verify available licenses in the section System -> licence. Here you can see that the Enhanced Audio license is activated. This means that you don't need any additional licenses to be able to upload your own user sounds. Info By default you don't need any license to be able to use User sounds. You can upload your user sounds in the section Services -> User Sounds. First tab that you will see is the Sound Mapping. In this section you are able to assign your uploaded user sounds to some specific actions such as ringing tone. Figure 2: Sound mapping The next tab is used for the uploading of the user sounds. You can upload the audio file by using (upload button) or you can record your own announcement directly from the web browser by using (record button). The last step is to setup the automation commands which will allow you to trigger the announcement by the HTTP command. First you have to use the command called Event.HttpTrigger. This is used for the detection of the incoming http command. Event.HttpTrigger has only 1 parameter which is the name and it is basically the keyword based on which the audio file will be played. I have used keyword "play" in this example. Second command is the Action.PlayUserSound. You have to specify the event based on which this action will be performed. In this example we have only 1 event which has ID=1. Second parameter is sound. You can select up to 10 user sounds. In this example the user sound has been uploaded into the first slot (see figure 3). Now once the device will receive HTTP command containing the keyword play, the user sound in position 1 will be played. The HTTP command can be sent directly via web browser or via 3rd party systems or applications that are able to send HTTP commands. In this example the following HTTP command has been used http://192.168.50.251/enu/trigger/play IMPORTANT Info Structure of the http command: http:// /enu/trigger/

iOS 14 & macOS Big Sur - Issues with accessing website

Our intercoms use HTTPS protocol for accessing their web interface. HTTPS unlike HTTP requires a certificate for authentication. The certificates for 2N devices are signed by us (self-signed) and not by the certification authority hence the browser will mark it as a potential threat. macOS 10 In macOS 10 when you entered the IP address of your 2N device you would be presented with "Your connection is not private" as shown below.This had a simple solution -> click on Advanced -> Proceed to IP address (unsafe) and you were taken to the webpage of your 2N device: macOS 11 Big Sur With the new macOS update 11, you will not be given the option to Proceed to IP address (unsafe).But here is a workaround if you are using a chromium-based web browser e.g. Google Chrome, Microsoft Edge etc.Workaround: Click anywhere on the blank background and type thisisunsafe on your keyboard and you will be taken to the webpage of 2N Device iOS 14 & macOS 11 Big Sur In order to access the web configuration of our devices, they need to be on firmware 2.31 and newer, if you don't own a Windows or Linux machine, hence you don't have a way how to upgrade the unit, you can upgrade the firmware via a Remote Configuration tool, please follow the steps below: Remote Configuration You can access the web interface via Remote Configuration in our My2N service. The Remote Configuration feature is free for any number of devices and is usable on both macOS and iOS devices. Here are the steps needed: 1) Create an account (if you don't have one yet) here. 2) Log in to your My2N account, go to the Remote Configuration and click ADD DEVICE: 3) Enter the serial number and security code of the device. You can find instructions on where to get these here. If you lost your paper card with the Security Code, this option is not available for you (the Security Code could be found only in the web configuration): 4) Now open the remote configuration for this device by clicking CONFIGURE: 5) Now enter the login credentials to the device's web interface and upgrade the firmware to 2.31 or newer. Once the update process finishes you will have access to the device's web interface through its IP address directly from your device.

IP Address - How to find the IP address of the 2N SIP Mic

Turn on the device switch. Wait until you can hear the sound signal. Press the call hang-up button on the device five times. 2N SIP Mic reads its IP address. If the address is 0.0.0.0, it means that 2N SIP Mic did not get its IP address from the DHCP server. In that case contact your network administrator. Having found the IP address, open any web browser on a PC connected to the same network. Enter http://found_IP_address/ into the address row. Confirm your selection. If 2N SIP Mic is connected in the right network, its configuration web page opens up. Log in using the Admin user name and 2n password

IP address - How to setup static / dynamic IP address

2N SIP Audio Converter or 2N SIP Speaker has the static IP address by default. The address is 192.168.1.100. To be able to change this IP address or obtain the address from the DHCP server, you have to go into the section System -> Network -> Basic. Here you can configure IP address and other network settings such as DNS and VLANs. Info If you don't know what is the IP address of the device, you can use some kind of networks scanner or our own 2N Network scanner which is downloadable for free: https://www.2n.com/cs_CZ/produkty/2n-network-scanner

Loudspeaker - How to properly connect loudspeaker

Loudspeaker connector is located on back side of the 2N SIP Audio Converter. If you use two loudspeakers, please connect left loudspeaker to L+ and L- terminals, and the right one to R+ and R- terminals. Please note that 2N® SIP Audio Converter is a MONO device, thus both connected loudspeakers will get the same signal. If you use one loudspeaker, please connect it to either R+ and L-, or R- and L+.

Scheduler - How to use Announcement Scheduler

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface. With 2N SIP Audio Converter or 2N SIP Speaker, you are able to play your recorded messages automatically in the specific time periods and days via build-in Announcement scheduler. You can enable the scheduler in the section Services -> User sounds ->Announcement Scheduler. If you don't see Announcement Scheduler tab in the section Services -> User sounds, please download the latest firmware version and perform the firmware update. Scheduler is easy to use. First you have to enable the function by the checkbox Scheduler Enabled. Afterwards you will be able to set up the events. You can just simply click on the specific day and the small window will show up. In this window you are able to setup the time, which user sound will be played and the volume. Figure 1: Announcement Scheduler

Static IP address - How to set up static IP address for 2N SIP Audio products

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface. To be able to set up static IP address of 2N SIP Speaker Horn or 2N SIP Audio Converter we need to find this device in the network first. For this purpose, we can use 2N Helios IP Network Scanner which you can download from the link below. The successful installation requires Microsoft .NET Framework 2.0.Link: http://www.2n.cz/download/7/0/2/3/2n_network_scanner_3.0.4.zip After successful installation of 2N Helios IP Network Scanner run the application and let it scan the network. Note: In default settings, the DHCP client is active which means that 2N IP Speaker Horn is waiting for the IP address of a DHCP server in your local network. if there is no DHCP server then 2 SIP Speaker Horn won't get any IP address, nevertheless, the device will still show up in the list of results with IP address 0.0.0.0. To be able, set up static IP address we will need a DHCP server at least at the beginning. When double click to 2N® SIP Speaker Horn or 2N® SIP Audio Converter or when click on "Browse" button you will be redirected to IP address of the device in your web browser where you can change network settings. Login credentials are in default: Admin/2n After login go to System / Network / Basic where you need to deactivate the checkbox "Use DHCP Server" and fill required static network information. Save changes by pressing "Apply" button. From this moment the web interface of SIP Speaker Horn or 2N SIP Audio Converter is available on the IP address which corresponds to your settings.

Static IP address - How to set up static IP address for 2N SIP Audio products

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface. To be able to set up static IP address of 2N SIP Speaker Horn or 2N SIP Audio Converter we need to find this device in the network first. For this purpose, we can use 2N Helios IP Network Scanner which you can download from the link below. The successful installation requires Microsoft .NET Framework 2.0.Link: http://www.2n.cz/download/7/0/2/3/2n_network_scanner_3.0.4.zip After successful installation of 2N Helios IP Network Scanner run the application and let it scan the network. Note: In default settings, the DHCP client is active which means that 2N SIP Speaker Horn is waiting for the IP address of a DHCP server in your local network. if there is no DHCP server then 2N SIP Speaker Horn won't get any IP address, nevertheless, the device will still show up in the list of results with IP address 0.0.0.0. To be able, set up static IP address we will need a DHCP server at least at the beginning. When double click to 2N SIP Speaker Horn or 2N SIP Audio Converter or when click on "Browse" button you will be redirected to IP address of the device in your web browser where you can change network settings. Login credentials are in default: Admin/2nAfter login go to System / Network / Basic where you need to deactivate the checkbox "Use DHCP Server" and fill required static network information. Save changes by pressing "Apply" button. From this moment the web interface of 2N SIP Speaker Horn or 2N SIP Audio Converter is available on the IP address which corresponds to your settings.

Video - 2N SIP Speaker Horn - Basic setting

The steps in this article require using the web interface of a 2N device. Please follow this manual in case this is your first time using the web interface. 2N SIP Speaker Horn is an outdoor speaker with exceptionally loud and clear sound. Use the speaker as a practical tool for broadcasting live announcements across large areas and actively protect your property. If an unwelcome visitor enters your premises, you can respond immediately with a live or preset announcement to promptly deter the trespasser. Prerequisites 2N SIP Speaker Horn Video tutorial Please note, in firmware 2.43, the 2N OS Web GUI has been reorganized,SIP account details are now in the new section Calling .