This document describes the Certificate Management software. It has the following sections.
Overview
How Certificate Management Works
Entering Certificate Management Commands
Using the Certificate Management Software
Certificate Management Commands
Overview
The Certificate Management module handles all the certificate requirements for IKE and IPSec. A certificate binds a person or entity to a public key using a digital signature. Certificates provide confidence in the public key.
IKE and IPSec use certificates only to authenticate remote peers. IKE does not use the public keys in the certificates for Diffie-Hellman calculations.
Terminology
This document uses the following terminology.
Compatibility and RFCs Supported
The OpenROUTE Certificate Management feature supports X.509 v3 certificates for signatures. It is 100% compatible with existing CA products from Entrust, Verisign, and Checkpoint.
Certificate Management implements the following RFCs:
RFC 2314, PKCS #10: Certification Request Syntax Version 1.5
RFC 2315, PKCS #7: Cryptographic Message Syntax Version 1.5
Here is a brief overview of the certificate management process.
certificate request information, which consists of the requestor's name, public key, and a set of attributes that identify those using the certificate.
a signature algorithm identifier.
a digital signature on the certificate request information. This implementation uses DSA/SHA1 to sign the request.
Getting the Remote Device's Certificates
The remote device, in most cases, is an IPSec device, such as a security router. The router requests the remote device's certificate during IKE phase 1 negotiations.
The router validates the signature of all remote device certificates using the CA's public key. If a CRL exists, the software checks the CRL for the remote device's certificate. The router rejects invalid remote device certificates and generates an ELS message.
Certificate Revocation Lists
Certificate Revocation Lists (CRLs) contain certificates that were revoked prior to their expiration date. Certificates are revoked due to changes in relationships, such as an employee who ends employment with a company, or due to a private key being compromised.
Certificate Management compares certificates of remote devices and CAs against the CRL as part of certificate verification.
The issuing CA regularly updates the CRL. You need to promptly import the new CRL the router. (See Putting CRLs Into the Router.) The time between CRL issuances is defined in the CA's Certificate Practice Statement.
The list crl command shows the expiration date and time of a CRL, and the date and time when the next update will be available. You can also view information regarding the expiration of a certificate using the list certificate command.
Because you need to manually update CRLs, the Certificate Management module generates ELS messages every hour to remind you when a CRL has expired and you should load the next CRL. When you display the certificate management prompts, the router checks for expired CRLS and displays the following message if one exists.
You will experience a slight delay when you display the certificate prompts while the router checks CRLs.CRL 'mycrl' has expired.
CertMgmt Config>), enter certificates at the Config> prompt.
To display the Certificate Management monitoring prompt (CertMgmt>), enter certificates at the + prompt.
add a user that has administrative access to the router software. To do this, enter add user at the Config> prompt.
set the time on the router. See Setting the Time on the Router.
Config> prompt.
To set the time, enter the following commands at the Config> prompt.To set the time of day, enter time set.
To set the offset from GMT, enter time offset.
Boot config> prompt. You can then use the router's tftp put and tftp get commands. Config>boot
TFTP Boot/dump configuration
Boot config>tftp get
Enter local filename [CONFIG]?
Enter remote host's IP address or name in host table?
CertMgmt Config> add ca entr
You can view the contents of the router's IBD file system. In this example, cert4entr in bank 25 is the name of the CA certificate.
Config>boot
Boot config>list ibd
Banks 1-24 contain load "gtx.ldc" which uses 1508186 bytes
Loaded using TFTP over IP
Filename gtx.ldc
Host 0.0.0.0
Bank 25 contains load "cert4entr" which uses 1469 bytes
Loaded using TFTP over IP
Filename
Host 170.170.170.170
Bank 26-60 have been erased
Enter the retrieve ca command followed by the CA name and then the CA certificate file name in the router IBD.
CertMgmt Config> retrieve Ca entr cert4entr
You must define at least two of the following fields in a request: name, department, or company. Your CA may require that you include other information in a request. Each CA has a Certificate Policy Statement that specifies what must be in a request.
You also specify how the router encodes the request and the key type it uses to sign the request. See add request for all the options you can use with this command.
CertMgmt Config> add Request HQ name = Westboro department = Engineering company = "OpenROUTE Networks, Inc." state = MA country = US key_type = dsa/sha1 key_length = 1024 format = DER
At any time in the process you can view the status of a request.
CertMgmt Config> list status hq
Request: hq
Subject: "Westboro", "Engineering","OpenROUTE Networks, Inc.","MA","US"
Key Type/Len: DSA/SHA1 / 1024
Format: DER
Status: Not submitted
CertMgmt Config> submit request hq manual hq.req
This command will overwrite your current private/public keys
thus invalidating any certificates you may have for this request.
Do you wish to proceed? (Yes or [No]): [no]? yes
Please wait. This may take a while..............
Certificate Request in IBD/entrreq
The router generates a certificate request and saves it in the router's IBD. You can view the contents of the router's IBD file system.
Config>boot
TFTP Boot/dump configuration
Boot config>list ibd
Banks 1-24 contain load "gtx.rap" which uses 1508186 bytes
Loaded using TFTP over IP
Filename gtx.ldc
Host 0.0.0.0
Bank 25 contains load "hq.req" which uses 1362 bytes
Loaded using TFTP over IP
Filename
Host 0.0.0.0
Banks 26-60 have been erased
Boot config> prompt.
Boot config>tftp put ibd/hq.req 192.168.1.3 /gw/gmd/hq.req
TFTP transfer complete, status: OK
Boot config> prompt.
Boot config>tftp get ibd/hq.cert 192.168.1.3 /gw/gmd/hq.cert
TFTP transfer complete, status: OK
Boot config>list ibd
Banks 1-24 contain load "gtx.rap" which uses 1508186 bytes
Loaded using TFTP over IP
Filename gtx.ldc
Host 0.0.0.0
Bank 25 contains load "hq.req" which uses 1362 bytes
Loaded using TFTP over IP
Filename
Host 0.0.0.0
Bank 26 contains load "hq.cert" which uses 911 bytes
Loaded using TFTP over IP
Banks 27-60 have been erased
In this example, default is the name of the certificate and entcertif is the certificate file name in the router's IBD.
CertMgmt Config> retrieve Certificate hq hq.cert
CertMgmt Config> list Status hq
Request: hq
Subject: "Westboro", "Engineering", "OpenROUTE
Networks, Inc.","MA", "US"
Key Type/Len: DSA/SHA1 / 1024
Format: Base-64
Status: Certificate received for this request
Cert. File: hq.cert
CertMgmt Config> add crl entr_crl
Enter the retrieve CRL command followed by the name of the CRL and then the CRL file name in the router IBD.
CertMgmt Config> retrieve CRL entr_crl Oct12crl
Once you send a certificate request to a CA, delete the request from the IBD.
Once you retrieve a certificate from the IBD, delete the certificate from the IBD.
Boot config> prompt. To display this prompt, enter boot at the Config> prompt.Config>boot
TFTP Boot/dump configuration
Boot config>
Boot config>list ibd
Banks 1-24 contain load "gtx.ldc" which uses 1508186 bytesLoaded using TFTP over IP
Filename gtx.ldc
Host 0.0.0.0
Bank 25 contains load "entcacert2" which uses 1469 bytes
Loaded using TFTP over IP
Filename
Host 170.170.170.170
Bank 26-60 have been erased
Boot config>delete
Loadname or Bank Number:entcacert2
Erasing flash please wait ...
Press Space twice after you type a command to display the available parameters for each command. Enter help for information about using the command line interface.
[C] means the command is available at the CertMgmt Config> prompt.
[M] means the command is available at the CertMgmt> prompt.
Add CA [C] [M]
Adds a Certificate Authority to your configuration, and specifies whether the CA provides manual or automatic certificate enrollment. Currently, OpenROUTE software supports only manual enrollment.
Notes:
Both the local router and the remote IPSec device must use the same certificate authority.
You must assign the same name to the CA certificate as you do to the certificate request that you use with this CA. To differentiate between the two certificates, the software displays the owner of CA certificates as Root, and the owner of other certificates as Local.
add ca entr mode = manual
The fields name, department, company, state, and country are all optional and you can enter them in any order. However, you must fill in two of either name, department, or company.
While you can submit a certificate request to a CA with just two fields filled in, the CA may not allow issuance of a certificate with such limited information.
The default name for a request is default. This name coincides with the default certificate name used in the IKE configuration. If you use a name other than default, make sure you enter that name in your IPSec peer definition. Use the my_certificate option with either the add peer or set peer IPSec commands.
You must assign the same name to the certificate request as you do to the CA certificate that you use with this certificate. To differentiate between the two certificates, the software displays the owner of CA certificates as Root, and the owner of other certificates as Local.
To use more than a one word name in your request fields, put quotation marks around the name.
add request default
| Entry | Description |
|---|---|
| dsa/sha1 | Digital Signature Algorithm/Secure Hash Algorithm-1 (SHA)-1. |
Example:
add request default key_type = dsa/sha1 key_length
The possible key length values depend on the algorithm you selected for the key type.
The default key length is 1024.
Syntax: key_length =
add request default key_length = 2048
add request default name = gmd
add request default department = finance
add request default company = "OpenROUTE Networks"
add request default state = ma
add request default country = US
| Entry | Description |
|---|---|
| der | Distinguished Encoding Rules (DER) as defined in X.509. |
| Base-64 |
Example:
add request default format = pem Add CRL [C] [M]
Adds the name of a Certificate Revocation List request. After you add a CRL name, you copy the CRL into the router's IBD and then use the retrieve crl to move the CRL into the Certificate Management module.
add crl entrCRL
delete ca entr
delete request default
delete certificate boston
This command will delete this certificate and its private/public keys.
You will never be able to use this certificate again.
Do you wish to proceed? (Yes or [No]): [no]?
delete crl entr_crl
delete keys boston
This command will delete this private/public key pair.
You will never be able to use the certificate for these keys again.
Do you wish to proceed? (Yes or [No]):[no]? yes
list ca
CA Name Root Mode
entr No Manual
list all
CA Name Mode
hq Manual
Request Subject (name, department, company, state, country)
hq "Westboro", "Engineering", "OpenROUTE Networks, Inc.",
"MA", "US"
Cert Owner Issuer Length Type Valid From Valid To
entr Root Entrust 1024 DSA Sep 25,1999 Sep 25,2019
default Local Entrust 1024 DSA Oct 8,1999 Dec 8,1999
CRL Issuer Valid From Valid To Filename
entr_crl No CRL
Key Length Type Public Key
boston 1024 DSA
245AC3ECAB76FCC6B445DC4ECEC3E418DF104BA85CEF8E0A3FB9ACF7D5C5A814BE3B968
20FAF41A1D6DEBEF27D744E22BC8DD8AFE42BC4D1E6ECBA5F25EF87D6AADFA4DC093C6D
DD6A46239E990A1A2603BA05453067AEDF1BE3A252DA60A4582FCB640AD1264DF3D56FE
295C787D4C54AFF1596570514691FCD9893A7721A97
list request
Request Subject (name, department, company, state, country)
hq "Westboro", "Engineering", "OpenROUTE Networks, Inc.","MA", "US"
list certificate
Cert Owner Issuer Length Type Valid From Valid To
entr Root Entrust 1024 DSA Sep 25,1998 Sep 25,2018
default Local Entrust 1024 DSA Oct 8,1999 Dec 8,1999
list crl
Name Issuer Valid From Valid To
hq-CRL hq-ca July 7, 1999 1200 July 7, 1999 1300
list status hq
Request: hq
Subject: "Westboro", "Engineering", "OpenROUTE Networks, Inc.","MA", "US"
Key Type/Len: DSA/SHA1 / 1024
Format: Base-64
Status: Not submitted
list keys
Key Length Type Public Key
boston 1024 DSA
245AC3ECAB76FCC6B445DC4ECEC3E418DF104BA85CEF8E0A3FB9ACF7D5C5A814BE3B968
20FAF41A1D6DEBEF27D744E22BC8DD8AFE42BC4D1E6ECBA5F25EF87D6AADFA4DC093C6D
DD6A46239E990A1A2603BA05453067AEDF1BE3A252DA60A4582FCB640AD1264DF3D56FE
295C787D4C54AFF1596570514691FCD9893A7721A97
gmd 1024 DSA
7A5AE1BE9392D849E28E1844179DCD6D9DC4FBDEE6313EAA1B0822CA0E98108CAA4E387
37A404EC6FDB4EA8BED840A1131AA8999BB73D054399089EFB7EB5AA0A3012681BAEA8B
5763FBB57A2B43D00190CAF5E958BE4CF32ED9A53273065B3E2368105BCD2AF887CCED9
15C428F9F31C2901E90423DE1D3E0030EB202A43DB9
hq 1024 DSA
93C952A0C5D0BAA787ABC74F10F6C2B45E4223AB6ADB07DE0E5EC354932BFAC2F6DCB0C
D3BC072AE0521E24860C7EBB831034584DA4DC6C90FB13D8E26B1EF5E0B19287B2AD92A
5FD5C9127B6FCA7D36A27521D4BDEF406CA45146A37D21D165F89A20C7CB98AF06D0D4F
E2222592A38F94F4FD4BE27DA90DF6CC0E3D7599701
When you receive a CA certificate from the CA, you copy the certificate to the router's IBD and then use this command to retrieve the certificate. For the complete process, see Putting CA Certificates Into the Router.
Upon retrieving the certificate, you can view it with the list certificates command. When you enter the retrieve ca command, you include the name of the CA you assigned with the add ca command followed by the name of the CA certificate file in the IBD. Syntax: retrieve ca
retrieve CA entr entcacert2
When you enter the retrieve certificate command, you include the name of the certificate you assigned with the add request command followed by the name of the certificate file in the IBD. Syntax: retrieve certificate
retrieve Certificate default entcertif
retrieve crl hqCRL hqCRL23
set ca hq-ca mode = manual
Example:
set request hq format = Base-64 Submit Request [C] [M]
Using the information you provided with the add request or set request commands, the router creates a certificate request in the format ready to send to your CA. It saves the certificate request in the router's IBD.
CAUTION:
Make sure you do not submit the same request more than once. If you do, the router generates a new pair of public/private keys. This means that when the router receives a certificate that was generated from the request, the keys will not match and the router will reject the certificate.
Once you submit a certificate request, you can delete the request from your configuration.
Currently, OpenROUTE software supports only manual certificate requests.
submit Request hq manual hq.req
This command will overwrite your current private/public keys
thus invalidating any certificates you may have for this request.
Do you wish to proceed? (Yes or [No]): [no]? yes
Please wait. This may take a while..............
Certificate Request in IBD/hq.req