Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Adding a Certificate
Authority
Chapter 14: Configuring Virtual Private Networks
Configuring Certificate Management
• Export a certificate—Click Export to export a CA certificate from local
cache to a file and/or a screen.
• Retrieve a CRL—Click Get CRL to manually retrieve a new Certificate
Revocation List (CRL) for this CA. A CRL identifies certificates that have
been revoked. CRLs expire on a regular basis, which is why you must
periodically obtain a new CRL. You generally only need to manually get a
CRL for Netscape CAs when the CA is initially added. After that CRLs are
automatically updated every 15 minutes or so for Netscape 4.2 CAs.
Note: If you do not have access to either a Netscape CA or have access to an
LDAP directory, you should disable the Perform CRL Checking button on the
Certificate Server window.
The New Certificate Authority window enables you to add a new Certificate
Authority to the list of CAs used when authorizing certificates in a Sidewinder
G2 VPN connection. To add a new Certificate Authority, follow the steps below.
1 In the CA Name field, type a name for this certificate authority. Only
alphanumeric characters are accepted in this field.
2 In the Type drop-down list, select the type of CA used by your location.
Valid options are:
• Manual—Indicates the necessary files are obtained and loaded by an
administrator rather than by a CA.
• Netscape 4.2—Indicates that a Netscape version 4.2 CA is being
defined.
• SCEP (Simple Certificate Enrollment Protocol)—Indicates the CA being
defined supports this widely-used certificate enrollment protocol. The
CA can be of any type (Netscape 4.2, Baltimore, Entrust, VeriSign, etc.)
as long as it supports SCEP.
3 [Conditional] In the File field, type the name and location of the root
certificate for the CA, or click Browse to browse your network directories for
the location of the root certificate. The root certificate is used to verify
certificates issued by this CA. (This field is available only if you select
Manual in the Type field.)
Note: Valid file formats are .pem and .der. For information on obtaining a root
certificate, see the documentation that accompanied the CA.
4 [Conditional] In the URL field, type the URL address of the Netscape CA in
the URL field. Certificates that need to be signed by the CA are sent to this
address. (This field is available only if you select Netscape or SCEP in the
Type field.)
5 [Optional] In the CA Id field, type the value used to identify this specific CA.
Check with your CA administrator to determine the identifier to use. Many
administrators use the fully-qualified domain name of the CA as the
identifier. (This field is available only if you select SCEP in the Type field.)
421