15: Security in Detail
EDS User Guide
146
A certificate is also used to sign any message transmitted to the peer to
identify the originator and prevent tampering while transported.
In short:
When using HTTPS, SSL Tunneling in Accept mode, and/or EAP-TLS, the
EDS needs a personal certificate with matching private key to identify itself
and sign its messages.
When using SSL Tunneling in Connect mode and/or EAP-TLS, EAP-TTLS or
PEAP, the EDS needs the authority certificate(s) that can authenticate those
it wishes to communicate with.
RSA or DSA
As mentioned above, the certificates contain a public key. Different key exchange
methods require different public keys and thus different styles of certificate. The EDS
supports key exchange methods that require a RSA-style certificate and key
exchange methods that require a DSA-style certificate.
If only one of these certificates is stored in the EDS, only those key exchange
methods that can work with that style certificate are enabled. RSA is sufficient in
most cases.
Obtaining a Certificate and Private Key
You can obtain a certificate by completing a certificate request and sending it to a
certificate authority that will create a certificate/key combo, usually for a fee. Or
generate your own. A few utilities exist to generate self-signed certificates or sign
certificate requests. The EDS also has the ability to generate its own self-signed
certificate/key combo.
You can use XML to export the certificate in PEM format, but you cannot export the
key. Hence the internal certificate generator can only be used for certificates that are
to identify that particular EDS.
Certificates and private keys can be stored in several file formats. Best known are
PKCS12, DER and PEM. Certificate and key can be in the same file or in separate
files. The key can be encrypted with a password or not. The EDS currently only
accepts separate PEM files. The key needs to be unencrypted.
Utilities
Several utilities exist to convert between the formats.
OpenSSL
OpenSSL is a widely used open source set of SSL related command line utilities. It
can act as server or client. It can generate or sign certificate requests. It can convert
from and to all kinds of formats.
Signing other certificate requests is also possible with OpenSSL.
Executables are available for Linux and Windows.
See
www.openssl.org
or
www.madboa.com/geek/openssl
for more information.
