VPN |
 |
|
Certificates |
Digital Certificates (also known as X509 Certificates) are used to authenticate
the identity of users and systems, and are issued by Certification Authorities
(CA) such as Verisign, Thawte and other organizations. Digital Certificates are
used by this router during the Internet Key Exchange (IKE) authentication phase
to authenticate connecting VPN gateways or clients, or to be authenticated by
remote entities. |
Trusted Certificates (CA Certificate) |
Trusted Certificates or
CA certificates are used to verify the validity of
certificates signed by them. When a certificate is generated, it is signed by a
trusted organization or authority called the Certificate Authority. The table
contains the certificates of each CA.
When a remote VPN gateway or client presents a digital certificate, the
authentication process verifies that the presented certificate is issued by one
of the trusted authorities. The Trusted CA certificates are used in this
authentication process.
The following data is displayed for each certificate entry in the table: |
CA Identity (Subject Name): The organization or
person to whom the certificate is issued. |
Issuer Name: The name of the CA that issued the
certificate. |
Expiry Time: The date after which the certificate
becomes invalid. |
Select All: Select all the certificates in the
table. |
Delete: Purge the selected certificate or
certificates. |
New certificates can be uploaded to the router with the
Upload Trusted Certificate option. Click on
Browse and select the certificate file located on
your computer. Click
Upload to store the certificate on the router. |
Active Self Certificates |
This table lists the certificates issued to you by trusted Certification
Authorities (CAs), and available for presentation to remote IKE servers. The
remote IKE server validates this router using these certificates. For each
certificate, the following data is displayed: |
Name: A unique name used to identify a certificate. |
Subject Name: This is the name which other
organizations will see as the Certificate Holder (owner). This is usually your
registered business or company name. |
Serial Number: The serial number is used by the CA
to identify the certificate itself in their records. |
Issuer Name: The name of the CA which issued the
certificate. |
Expiry Time: The date on which the Certificate
expires. You should renew the certificate before it expires. |
Select All: Select all the certificates in the
table. |
Delete: Purge the selected certificate or
certificates. |
Generate Self Certificate Request |
One of the steps in creating a certificate is to generate a certificate request
from the computer or the device that will be using the certificate. The
Certificate Signing Request (CSR) file needs to be
submitted to the CA who will then generate a certificate for this device. |
To generate a certificate request: |
v |
Enter the required data in the
Generate Self Certificate Request section. The
Subject field will populate the CN (Common Name)
entry of the generated certificate. Subject names are usually defined in the
following format: CN=<device name>, OU=<department>, O=<organization>, L=<city>,
ST=<state>, C=<country>. For example: CN=router1, OU=my_company, O=mydept, L=SFO,
C=US. |
v |
Click
Generate. A new certificate request is created and
added to the
Self Certificate Requests table. To view a request,
click on the
View button under the
Action column. |
v |
Copy the contents of the
Data to supply to CA text box and save it in a
file. |
v |
Follow the instructions of the CA to complete the certificate signing process. |
|
Self Certificate Requests |
The Self Certificate Requests table displays a list
of all the certificate requests made. |
Uploading a Certificate File |
After obtaining the signed certificate file from the CA click
Browse, locate the signed certificate file on your
computer and use the
Upload button to upload the certificate. |
Certificate Revocation Lists (CRL) |
CRL (Certificate Revocation List) files show
certificates that have been revoked, and are no longer valid. CRL files are
provided by the CA periodically and can be downloaded from the CA’s website. |
To upload a new CRL, click
Browse, locate the CRL file which you downloaded
from the CA’s website on to your computer. Click on the
Upload button to upload the CRL file to the router. |
|