Cisco 3002 - VPN Hardware Client Especificaciones descargar pdf (Pagina 165)

12-17

VPN 3002 Hardware Client Reference, Release 4.0

OL-3813-01

Chapter 12 Administration

Certificate Management

Digital certificates are a form of digital identification used for authentication. A digital certificate

contains information that identifies a device or user, such as the name, serial number, company,

department, or IP address. Certificate Authorities (CAs) issue digital certificates in the context of a

Public Key Infrastructure (PKI), which uses public-key/private-key encryption to ensure security. CAs

are trusted authorities that “sign” certificates to verify their authenticity, thus guaranteeing the identity

of the device or user.

A CA certificate is one used to sign other certificates. A CA certificate that is self-signed is called a root

certificate; one issued by another CA certificate is called a subordinate certificate. CAs also issue

identity certificates, which are the certificates for specific systems or hosts. There can be up to six root

or subordinate CA certificates (including supporting RA certificates) but only one identity certificate on

a VPN 3002.

The VPN 3002 supports X.509 digital certificates (International Telecommunications Union

Recommendation X.509), including SSL (Secure Sockets Layer) certificates that are self-signed or

issued in a PKI context.

The VPN 3002 stores digital certificates and private keys in Flash memory. You do not need to click Save

Needed

to store them, and they are not visible under Administration | File Management. All stored

private keys are encrypted.

The VPN 3002 can have only one SSL certificate installed. If you generate a self-signed SSL certificate,

it replaces any installed PKI-context SSL certificate; and vice-versa.

For information on using SSL certificates, see the “Installing the SSL Certificate in your Browser”

section in Chapter 1 of the VPN 3002 Hardware Client Reference Volume. See also Configuration |

System | Management Protocols | HTTP/HTTPS and Telnet, and Configuration | System | Management

Protocols | SSL.

The Role of Time

Digital certificates are time-sensitive in the following ways:

• Digital certificates indicate the time frame during which they are valid. Therefore, it is essential that

the time on the VPN Concentrator is correct and synchronized with network time.

• You must complete the enrollment and certificate installation process within one week of generating

the request. If you do not, the pending request is deleted.

Configuring Digital Certificates: SCEP and Manual Methods

To use digital certificates for authentication, you first enroll with a Certificate Authority (CA), and

obtain and install a CA certificate on the VPN Concentrator. Then you enroll and install an identity

certificate from the same CA.

You can enroll and install digital certificates on the VPN Concentrator in either of two ways:

• Using Cisco’s Simple Certificate Enrollment Protocol (SCEP).

SCEP is a secure messaging protocol that requires minimal user intervention. SCEP is the quicker

method, and it lets you to enroll and install certificates using only the VPN Concentrator Manager.

To use SCEP, you must enroll with a CA that supports SCEP, and you must enroll via the Internet.

• Manually, exchanging information with the CA directly.

1 2 ... 160 161 162 163 164 165 166 167 168 169 170 ... 317 318

Comentarios a estos manuales

Sin comentarios

Cisco 3002 - VPN Hardware Client Especificaciones Pagina 165

Comentarios a estos manuales

Relacionado con productos y manuales para Redes Cisco 3002 - VPN Hardware Client