18.2.3. Supported Certificates 
The following certificates (X.509v3) can be imported:
- CA certificates (*.crt, *.cer) from the certification authority
- Certificates in the format Public Key Cryptography Standards #12 (PKCS #12) (*.p12)
- Certificates in the format X.509 PEM
An expired certificate should not be reloaded. If a certificate expires
in the course of implementation, a HISTA message is issued along with
an error message (F5881 with Error Cause: CERTIFICATE EXPIRED). The system
may no longer function in secure mode with certification verification
level Trusted or Full. Phones may not register to boards, trunks may
not work. Security may be deactivated until the certificates will be
renewed (see Section 2.4,
“Renew a Certificate”).
IMPORTANT:
Certificates should be replaced when their validity
expires.
Certificate chaining is supported. CA certificate chains can either be imported as
separate files
(one by one), or a CA certificate chain can be imported directly, with up to 3 CA
certificates
in PEM format. The order of the CA certificate chain import or in the PEM file does
not have any
effect.