125
IGEL
Technology GmbH
IGEL Zero HDX
5.09.100
Example:
A certificate is valid until 31.12 in any one year. The period for renewal is 10 days. This means that
a new certificate will first be requested on 21.12 of the same year.
Because of the need to enter a fingerprint (root certificate of the certification authority) and the
query password (SCEP server), the configuration process is somewhat awkward. Ideally, it should
be set up in the UMS as a profile and distributed to the clients. At the same time, the certificate
still cannot be used for communication purposes.
8.5.4.
Checking the Client Certificate
If a certificate from the certification authority has been forwarded from the SCEP server to the client, it is
then stored there in the
/wfs/scep_certificates
folder.
The data for the certificate (e.g. its validity, creation date and hash value) can be displayed by using the
shell command
cert_show_status
.
8.5.5.
Example
Certificates issued and managed via SCEP can be used for purposes such as network authentication.
Relevant options can be found when
•
configuring IEEE 802.1x authentication
Network→LAN Interfaces→Interface 1→Authentication
•
or when setting up the wireless network
Network→LAN Interfaces→Wireless→Authentication, WPA Enterprise Encryption, EAP Type TLS
.
One problem when the client certificate is distributed via the network is that the same certificate is needed
for communication. The use of the SCEP in conjunction with 802.1x authentication presents no problems to
the extent that the initial request for the certificate should also be possible without a certificate.
Enable the 802.1x authentication method after the SCEP has been configured.
When requesting the certificate, the client will attempt to establish a connection to the SCEP server
without using any authentication. It will use the authentication only after having received the certificate.
For WLAN connections, a method of certificate-less PSK encryption must first be set up. The client will then
use this connection to obtain the certificate. After this, the WLAN connection can be reconfigured once
again.
While the above-mentioned method for Ethernet connections will also function via the UMS, the initial
configuration of the WLAN can only be performed on the client as the WLAN is disabled by default.
