HP X Unified Security Platform Series Manual de usuario descargar pdf (Pagina 272)

Chapter 9 Authentication

256 X Family LSM User’s Guide V 2.5.1

own CA server or use a third-party organization for creating certificates. The same CA certificate is

imported onto all X family devices that must authenticate with each other.

• Certificate Requests—provides a form and encoding method for the X family administrator to

generate a signed Local certificate from the CA server. The administrator has to export the Certificate

Request, and then provide it to the CA server. The CA server signs the request to generate a Local

Certificate and returns the signed certificate to the administrator who then imports it back into the X

family device. A successful import of the Local Certificate removes the corresponding Certificate

Request as the request has now been satisfied.

•A Distinguished Name uniquely identifies a certificate. The Distinguished Name is defined when

creating the Certificate Request is used by the Local Certificate. The X family uses PKCS#10 format

for Certificate Requests.

• Local Certificates—digitally signed certificates that are used to authenticate IPSec on the X family.

Local Certificates are signed by a CA using a certificate request. The local certificate is a personal

certificate, installed on the X family devicee or remote device. Each device has a unique local

certificate. Other devices that have imported the CA certificate that was used to sign a local certificate

can authenticate this device.

• Certificate Revocation List (CRL)— a list of certificates which have been revoked before their

expiry dates by a Certificate Authority, along with the reasons for revocation and a proposed date for

the next release. The Certificate Authority would revoke a certificate, for example, if there was a

suspected compromise of the private part of public/private key pair that invalidates the public part,

or if there was a change of user details.

Configuring X.509 Certificates

To use X.509 certificates as a secure method of authentication for VPN access to the network, you must

configure both local and CA certificates before you configure other VPN services.

STEP 1

Import the CA certificate used to validate local certificates. For details, see “CA Certificates”

on page 257.

STEP 2

Create a Certificate Request and export it as a file that can be sent to the CA server. For details,

see

“Certificate Requests” on page 260.

The CA server converts the request into a signed local certificate.

The local certificate is a personal certificate, installed on the X family device or remote device.

Each device has a unique local certificate. The local certificate refers to the CA certificate for

validation.

STEP 3

Import the signed local certificate retrieved from the CA server. For details, see “Import a

signed Local Certificate” on page 263.

STEP 4

To maintain the integrity of the CA certificates on the X family device, you can also associate a

CRL with each certificate and configure parameters to automatically update the CRL. For

details, see

“Certificate Revocation List (CRL) for a CA Certificate” on page 258.

For more detailed information on X.509 Certificates, see the Concepts Guide.

Note If you already have a local certificate with its own private key,

you can import this certificate to the device from the Local

Certificates page. It is not necessary to complete the Certificate

Request process.

1 2 ... 267 268 269 270 271 272 273 274 275 276 277 ... 332 333

Comentarios a estos manuales

Sin comentarios

HP X Unified Security Platform Series Manual de usuario Pagina 272

Comentarios a estos manuales

Relacionado con productos y manuales para Redes HP X Unified Security Platform Series