7
IPsec VPN
130
Trusting certificates
When
using
certificates,
the
SEG
can
trust
any
party
whose
certificate
is
signed
by
a
given
CA.
Before
a
certificate
is
accepted,
the
following
steps
are
taken
to
verify
the
validity
of
the
certificate:
•
Construct
a
certification
path
up
to
the
trusted
root
CA.
•
Verify
the
signatures
of
all
certificates
in
the
certification
path.
•
Fetch
the
CRL
for
each
certificate
to
verify
that
none
of
the
certificates
have
been
revoked.
Uploading certificates
Certificates
are
uploaded
to
the
SEG
using
Secure
Copy
(SCP).
When
the
SEG
receives
certificates,
it
recognizes
them
as
certificates
and
stores
them
until
they
are
referenced
in
a
CLI
command
to
create
a
certificate
object.
The
upload
process
will
consist
of
a
Root
Certificate
and
Host
Certificate
upload
plus
any
intermediate
certificates
that
will
be
required.
The
root
certificate
has
2
parts
added:
a
certificate
file
and
a
private
key
file.
Using
SCP
is
described
in
Secure
copy
on
page
30
.
Self
‐
signed
certificates
cannot
be
used
with
the
SEG.
Creating certificate configuration objects
Once
the
certificate
files
are
uploaded
using
SCP,
Certificate
SEG
configuration
objects
have
to
be
created
which
are
associated
with
these
files.
Assume
that
the
CA
signed
certificate
file
has
the
filename
myfile.cer
and
the
host
certificate
files
have
the
filenames
anotherfile.cer
and
anotherfile.key
.
First,
the
CA
signed
root
certificate
is
added
to
the
SEG
configuration.
This
consists
of
only
one
.cer
file
that
was
previously
uploaded
with
SCP:
Device:/>
add
Certificate
ca_signed_cert
CertificateData=file://myfile.cer
Type=Remote
Next,
the
host
certificate
is
added.
This
consists
of
two
files,
a
.cer
file
and
a
.key
file:
scp
C:\cert
‐
1.cer
admin@192.168.3.1:MyCert
Device:/>
add
Certificate
host_cert
CertificateData=file://anotherfile.cer
Type=Local
PrivateKey=file://anotherfile.key
Certificates are global SEG objects
In
the
SEG,
certificates
are
global
objects
that
can
be
reused
between
VPN
tunnels.
Even
though
a
certificate
is
associated
with
one
VPN
tunnel
in
the
SEG,
it
can
still
be
reused
with
any
number
of
other,
different
VPN
tunnels.
