Digital Certificates

Certificate Revocation List (CRL)

The VPN Concentrator can be configured to enable CRL information caching in RAM to speed the process of verifying the revocation status of certificates. When the VPN Concentrator needs to check the revocation status of a certificate, it first checks to see if the CRL exists in cache and that it hasn’t expired. If the CRL has expired, a new one is requested, but if it hasn’t expired, the Concentrator searches the list of revoked serial numbers for the certificate serial number. If a match exists, the authentication fails.

Time Issues

Digital certificates have an expiration date beyond which they’re of no value, much like the driver’s license and passport examples in the paper-based world. Note, because of this expiration date, the VPN Concentrator time and date must be correct and synchronized with network time.

A second time issue is this: certificate enrollment and installation process must be completed within one week of generating the request. Otherwise, the request is deleted.

Certificate Task Summary

Regardless of whether SCEP or the manual method is used, the following tasks must be completed to obtain and install certificates:

1. Request and install the required CA certificate(s).

2. Create an enrollment request for one or more identity certificates.

3. Request an identity certificate from the same CA that issued the CA certificate(s).

4. Install the identity certificate on the VPN Concentrator.

5. Enable CRL checking and caching.

6. Enable certificates.

Using SCEP to Obtain and Install CA Certificates Automatically

Follow these steps for each CA Certificate you want to obtain:

1. Use the Concentrator Manager navigation system to display the Administration | Certificate Management screen, as shown in Figure 14-36.

   
   Figure 14-36: Certificate management screen

2. Click the Click here to install a CA certificate option at the top of the screen. The Administration | Certificate Management | Install | CA Certificate screen appears, as shown in Figure 14-37.

   
   Figure 14-37: Install CA Certificate screen

   The previous link option is only available on this screen if no CA certificates have been installed on the Concentrator. If the link is missing, click the Click here to install a certificate option, the third link in the last figure. The Administration | Certificate Management | Install screen is displayed, from which you can choose Install CA Certificate.

3. Click the SCEP (Simple Certificate Enrollment Protocol) link to display the Administration | Certificate Management | Install | CA Certificate | SCEP screen, shown in Figure 14-38. Enter the following information in the two fields:

   
   Figure 14-38: CA certificate request information

   URL—The URL of the CA’s SCEP interface.

   CA Descriptor—Some CAs require and provide a descriptor to identify a certificate. If the CA doesn’t use a descriptor, enter one of your own. Something must be entered in this field.

   Click Retrieve.

   Once complete, the CA certificate is installed on the Concentrator and appears in the Certificate Authorities box of the Administration | Certificate Management screen (as shown in the previous Figure 14-36).

Using SCEP to Enroll and Install Identity Certificates Automatically

Follow these steps for each identity certificate you want to obtain:

1. Using the Administration | Certificate Management screen from the previous Figure 14-36, Click the Click here to enroll with a Certificate Authority link.The Administration | Certificate Management | Enroll screen displays, as shown in Figure 14-39.

   
   Figure 14-39: Certificate management enrollment screen

2. Click the Identity Certificate link to display the Administration | Certificate Management | Enroll | Identity Certificate screen, as shown in Figure 14-40. If SCEP-enabled CA certificates were on the VPN Concentrator, they would be listed as links beneath the Enroll via PKCS10 Request (Manual) shown in the figure.

   
   Figure 14-40: Enrollment Identity screen to select a certificate

   The link title includes the name of the CA certificate in the following format: Enroll via SCEP at Certificate Name. So, a CA certificate on the Concentrator named “CA-Test” would look like the following:

   • Enroll via PKCS10 Request (Manual).

   • Enroll via SCEP at CA-Test.

3. Click the link to the SCEP certificate to be enrolled and the Administration | Certificate Management | Enroll | Identity Certificate | SCEP screen display, as shown in Figure 14-41.

   
   Figure 14-41: Screen to add certificate enrollment information

4. Complete the fields and click the Enroll button. Some CAs require manual verification of credentials and this can take some time—the certificate request could enter Polling mode. In this case, the Concentrator will resend the request to the CA a defined number of times, until either the CA responds or the process times out.

   Once the CA responds and issues the certificate, the VPN Concentrator installs it automatically and displays the Administration | Certificate Management | Enrollment | Request Generated screen, as shown in Figure 14-42.

   
   Figure 14-42: SCEP Status: Installed

IKE Configuration

Use the Manager navigation to locate the Configuration | System | Tunneling Protocols IPSec | IKE Proposals screen, shown in Figure 14-43. This screen displays both the Active and Inactive IKE options available on the Concentrator.

Figure 14-43: IKE Proposal options

You can change an existing Active proposal from preshared keys to certificates or create a new one. Select an existing proposal, and then click the Modify button or click the Add button. Either way, a screen similar to the one shown in Figure 14-44 appears.

Figure 14-44: IKE Proposal option to be modified

You only have one choice here. Use the Authentication mode drop-down list and select RSA Digital Certificate. Then click the Apply button.

IPSec Configuration

Use the Manager navigation to locate the Configuration | Policy Management | Traffic Management | Security Associations | Modify screen for the appropriate IPSec SA. The resulting screen is large, but the bottom panel, as shown in Figure 14-45, is all that must be changed.

Figure 14-45: Defining the IKE parameters for the IPSec SA

Use the Digital Certificate drop-down list to select the appropriate certificate name.

If necessary, use the IKE Proposal drop-down list to select the IKE proposal defined in the last section, and then click Apply.