18.07.2013 Views

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Configuring Certificate Management<br />

13-28 Configuring Virtual Private Networks<br />

5. If you are configuring a VPN between the <strong>Sidewinder</strong> <strong>G2</strong> and a machine<br />

running the client version <strong>of</strong> the <strong>Sidewinder</strong> <strong>G2</strong> VPN solution, and if you<br />

are not using a CA, you must create a remote certificate, export it, then<br />

import the certificate into the VPN client. Refer to the section titled<br />

“Exporting remote or firewall certificates” on page 13-48.<br />

Understanding Distinguished Name syntax<br />

The Certificate Manager supports using distinguished names (DN) for<br />

a number <strong>of</strong> purposes, including identifying the subject <strong>of</strong> an X.509<br />

certificate. DNs need to be entered using the proper syntax. As<br />

defined in the X.500 specifications, a DN is an Abstract Syntax<br />

Notation One (ASN.1) value. Within an X.509 certificate, a DN is<br />

represented as a binary value. When it is necessary to represent a DN<br />

in a human–readable format, as when entering information into the<br />

Certificate Manager, the <strong>Sidewinder</strong> <strong>G2</strong> uses the string syntax defined<br />

by RFC 2253. This section summarizes the DN string syntax through a<br />

series <strong>of</strong> examples.<br />

Note: For more information on this string syntax, visit http://www.ietf.org/rfc.html and<br />

search for RFC 2253, “Lightweight Directory Access Protocol (v3): UTF-8 String<br />

Representation <strong>of</strong> Distinguished Names.”<br />

A distinguished name (DN) consists <strong>of</strong> a sequence <strong>of</strong> identity<br />

components, each composed <strong>of</strong> a type tag and a value. The<br />

components <strong>of</strong> a DN are sets <strong>of</strong> attribute type/value pairs. The<br />

attribute type indicates the type <strong>of</strong> the item, and the attribute value<br />

holds its contents. Each type/value pair consists <strong>of</strong> an X.500 attribute<br />

type and attribute value, separated by an equal sign (‘=’). In the<br />

example CN=Jane Smith, “CN” is the attribute type and “Jane Smith”<br />

is the value.<br />

The attribute type/value pairs are separated by commas (‘,’). This<br />

example shows a DN made up <strong>of</strong> three components:<br />

CN=Jane Smith, OU=Sales, O=Secure Computing<br />

Plan out your organization’s certificate identification needs before<br />

creating any DNs. DNs have a hierarchical structure, reading from<br />

most specific to least specific. No preset hierarchy <strong>of</strong> attribute type<br />

exists, but the structure for a given organization need to be consistent.<br />

In this example, the organization Secure Computing has<br />

organizational units, making the organizational unit attribute type<br />

more specific than the organization attribute type.<br />

CN=Jane Smith, OU=Sales, O=Secure Computing<br />

CN=Ira Stewart, OU=Engineering, O=Secure Computing

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!