Merge pull request #245297 from rcdun/document_communications_gateway_certificates

Describe certificates for Communications Gateway in more detail

Author: prmerger-automator[bot]

articles/communications-gateway/prepare-for-live-traffic.md

@@ -5,7 +5,7 @@ author: rcdun
 ms.author: rdunstan
 ms.service: communications-gateway
 ms.topic: how-to
-ms.date: 05/11/2023
+ms.date: 07/18/2023
 ---
 
 # Prepare for live traffic with Azure Communications Gateway
@@ -37,10 +37,13 @@ In some parts of this article, the steps you must take depend on whether your de
 
 ## 1. Connect Azure Communications Gateway to your networks
 
+1. Exchange TLS certificate information with your onboarding team.
+    1. Azure Communications Gateway is preconfigured to support the DigiCert Global Root G2 certificate and the Baltimore CyberTrust Root certificate as root certificate authority (CA) certificates. If the certificate that your network presents to Azure Communications Gateway uses a different root CA certificate, provide your onboarding team with this root CA certificate.
+    1. The root CA certificate for Azure Communications Gateway's certificate is the DigiCert Global Root G2 certificate. If your network doesn't have this root certificate, download it from https://www.digicert.com/kb/digicert-root-certificates.htm and install it in your network.
 1. Configure your infrastructure to meet the call routing requirements described in [Reliability in Azure Communications Gateway](reliability-communications-gateway.md).
 1. Configure your network devices to send and receive SIP traffic from Azure Communications Gateway. You might need to configure SBCs, softswitches and access control lists (ACLs). To find the hostnames to use for SIP traffic:
     1. Go to the **Overview** page for your Azure Communications Gateway resource.
-    1. In each **Service Location** section, find the **Hostname** field.
+    1. In each **Service Location** section, find the **Hostname** field. You need to validate TLS connections against this hostname to ensure secure connections.
 1. If your Azure Communications Gateway includes integrated MCP, configure the connection to MCP:
     1. Go to the **Overview** page for your Azure Communications Gateway resource.
     1. In each **Service Location** section, find the **MCP hostname** field.

articles/communications-gateway/security.md

@@ -5,7 +5,7 @@ author: rcdun
 ms.author: rdunstan
 ms.service: communications-gateway
 ms.topic: conceptual
-ms.date: 02/09/2023
+ms.date: 07/18/2023
 ms.custom: template-concept
 ---
 
@@ -26,15 +26,26 @@ Azure Communications Gateway stores all data at rest securely, including any cus
 
 ## Encryption in transit
 
-All traffic handled by Azure Communications Gateway is encrypted. This encryption is used between Azure Communications Gateway components and towards Microsoft Teams.
+All traffic handled by Azure Communications Gateway is encrypted. This encryption is used between Azure Communications Gateway components and towards Microsoft Phone System.
+
 * SIP and HTTP traffic is encrypted using TLS.
 * Media traffic is encrypted using SRTP.
 
 When encrypting traffic to send to your network, Azure Communications Gateway prefers TLSv1.3. It falls back to TLSv1.2 if necessary.
 
+### TLS certificates for SIP
+
+Azure Communications Gateway uses mutual TLS for SIP, meaning that both the client and the server for the connection verify each other.
+
+You must manage the certificates that your network presents to Azure Communications Gateway. By default, Azure Communications Gateway supports the DigiCert Global Root G2 certificate and the Baltimore CyberTrust Root certificate as root certificate authority (CA) certificates. If the certificate that your network presents to Azure Communications Gateway uses a different root CA certificate, you must provide this certificate to your onboarding team when you [prepare for live traffic](prepare-for-live-traffic.md#1-connect-azure-communications-gateway-to-your-networks).
+
+We manage the certificate that Azure Communications Gateway uses to connect to your network and Microsoft Phone System. Azure Communications Gateway's certificate uses the DigiCert Global Root G2 certificate as the root CA certificate. If your network doesn't already support this certificate as a root CA certificate, you must download and install this certificate when you [prepare for live traffic](prepare-for-live-traffic.md#1-connect-azure-communications-gateway-to-your-networks).
+
+### Cipher suites for SIP and RTP
+
 The following cipher suites are used for encrypting SIP and RTP.
 
-### Ciphers used with TLSv1.2
+#### Ciphers used with TLSv1.2
 
 * TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
 * TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
@@ -45,12 +56,12 @@ The following cipher suites are used for encrypting SIP and RTP.
 * TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
 * TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
 
-### Ciphers used with TLSv1.3
+#### Ciphers used with TLSv1.3
 
 * TLS_AES_256_GCM_SHA384
 * TLS_AES_128_GCM_SHA256
 
-### Ciphers used with SRTP
+#### Ciphers used with SRTP
 
 * AES_CM_128_HMAC_SHA1_80