How to obtain X.509 Certificates - Innominate Security Technologies ...

Application Note
How to obtain X.509 Certificates
mGuard smart mGuard PCI mGuard blade
mGuard industrial RS EAGLE mGuard mGuard delta
Innominate Security Technologies AG
Albert-Einstein-Str. 14
12489 Berlin
Germany
Phone: +49 (0)30-6392 3300
Fax: +49 (0)30-6392 3307
contact@innominate.com
www.innominate.com

Application Note: How to obtain X.509 Certificates
CONTENTS
1 Disclaimer _______________________________________________________________________________ 3
2 Introduction _____________________________________________________________________________ 4
3 OpenSSL _________________________________________________________________________________ 5
3.1 Create self signed Certificates ____________________________________________________________ 6
3.1.1 Creating a password protected RSA Key ________________________________________________ 6
3.1.2 Creating the OpenSSL Configuration File _______________________________________________ 7
3.1.3 Creating the mGuard Certificate _______________________________________________________ 8
3.1.4 Creating the PKCS#12 File ___________________________________________________________ 9
3.2 Using a Certification Authority (CA) Environment ___________________________________________ 10
3.2.1 Preparing the CA environment _______________________________________________________ 10
3.2.2 Modifying the OpenSSL Configuration File _____________________________________________ 11
3.2.3 Create the CA Certificate and Key ____________________________________________________ 13
3.2.4 Create a Certificate Request for the mGuard ___________________________________________ 14
3.2.5 Sign the mGuard’s Certificate Request with the CA______________________________________ 15
3.2.6 Creating the mGuard’s PKCS#12 File (Machine Certificate)_______________________________ 16
3.2.7 Example: Obtaining X.509 Certificates for a VPN Connection between two mGuards _________ 17
4 XCA_____________________________________________________________________________________ 18
4.1 Options ______________________________________________________________________________ 18
4.2 Create a Certificate Template____________________________________________________________ 19
4.3 Create a Certification Authority (CA) Certificate ____________________________________________ 20
4.4 Create a Client Certificate _______________________________________________________________ 21
4.5 Certificate Export ______________________________________________________________________ 22
4.6 Signing a Certificate Request with the CA _________________________________________________ 22
4.7 Certificate Revocation List (CRL) _________________________________________________________ 23
4.8 Required Certificates - Examples_________________________________________________________ 24
4.8.1 VPN between two mGuards__________________________________________________________ 24
4.8.2 VPN between mGuard and Netscreen 5GT/204/5400____________________________________ 24
4.8.3 VPN between mGuard and Cisco VPN 3000 Concentrator Series __________________________ 25
4.8.4 L2TP/IPsec connection between Windows client and mGuard ____________________________ 25
4.8.5 VPN between SafeNet SoftRemote and mGuard ________________________________________ 25
5 Microsoft Certification Authority (CA) Server ____________________________________________ 26
5.1 Request the mGuard Certificate from the Certification Authority ______________________________ 26
5.2 Issue the mGuard Certificate Request on the MS CA Server__________________________________ 28
5.3 Retrieve the issued mGuard Certificate ___________________________________________________ 28
5.4 Export of the mGuard Machine Certificate _________________________________________________ 29
5.5 Export of the mGuard Certificate_________________________________________________________ 31
Document ID: AN201002907-004 Version: 1.00 Page 2 of 32

Application Note: How to obtain X.509 Certificates
1 Disclaimer
© Innominate Security Technologies AG
October 2007
“Innominate” and “mGuard” are registered trademarks of the Innominate Security Technologies AG. All
other brand names or product names are trade names, service marks, trademarks, or registered trade
marks of their respective owners.
mGuard technology is protected by the German patents #10138865 and #10305413. Further national
and international patent applications are pending.
No part of this documentation may be reproduced or transmitted in any form, by any means without prior
written permission of the publisher.
All information contained in this documentation is subject to change without previous notice. Innominate
offers no warranty for these documents. This also applies without limitation for the implicit assurance of
scalability and suitability for specific purposes.
In addition, Innominate is neither liable for errors in this documentation nor for damage, accidental or
otherwise, caused in connection with delivery, output or use of these documents.
This documentation may not be photocopied, duplicated or translated into another language, either in
part or in whole, without the previous written permission of Innominate Security Technologies AG.
Document ID: AN201002907-004 Version: 1.00 Page 3 of 32

Application Note: How to obtain X.509 Certificates
2 Introduction
The enrolment of certificates requires a certification authority (CA) which issues public key certificates for
a specific period of time. A CA can be a private (in-house) CA, run by your own organization, or a public
CA. A public CA is operated by a third party that you trust to validate the identity of each client or server
to which it issues a certificate.
There are several tools available for creating and managing certificates, as for example Microsoft
Certification Authority (CA) Server, OpenSSL and XCA. This application note explains how to create
X.509 certificates with those tools for setting up a VPN connection using X.509 certificates as
authentication method.
The scope of this document is not to be a complete user’s guide for the described tools. It shall help you
getting familiar with them and to create the required certificates in a short term.
Document ID: AN201002907-004 Version: 1.00 Page 4 of 32

Application Note: How to obtain X.509 Certificates
3 OpenSSL
OpenSSL is available for several platforms (Linux, UNIX, Windows) and can be downloaded from the
Internet. We have used OpenSSL 0.9.8a on a Windows XP platform. Please refer to
http://www.openssl.org for getting further information about OpenSSL and the supported command line
options.
OpenSSL provides various ways for specifying the required options. You can enter them at the command
line, specify them in a configuration file or you’ll be prompted to enter them when the openssl command
is executed. When using configuration files, you can either specify all required parameters in one single
file or use different ones, depending on the kind of certificate you want to create. The OpenSSL
configuration file which comes with OpenSSL is called openssl.cnf. Please note that Windows hides the file
extension .cnf, even if you’ve configured the Windows Explorer not to do so. Therefore we use the
extension .conf.
In the following chapters we will explain how to create self signed certificates with OpenSSL and how to
setup a CA environment as well. You can use self signed certificates if you only need a small number of
certificates for establishing VPN connections between mGuards. If appliances from other manufacturers
are involved in the VPN connection or if you need certificates for a huge number of mGuards then you
should use the CA environment.
Here is a small legend with file extensions we will use for the created files and their meaning. All files
that will be created will have one of these extensions:
key
csr
crt
p12
- Private key (Restrictive permissions should be set on this).
- Certificate Request (This will be signed by the CA in order to create the
certificate. Afterwards it is not needed and can be deleted).
- Certificate (This can be publicly distributed).
- PKCS#12 export of the certificate, containing its private and public key.
Document ID: AN201002907-004 Version: 1.00 Page 5 of 32

Application Note: How to obtain X.509 Certificates
3.1 Create self signed Certificates
This chapter explains how to create self signed certificates which must not be signed by a Certification
Authority (CA). You can use self signed certificates if you only need a small number of certificates for
establishing VPN connections between mGuards. You need to execute the described steps for each
mGuard for which a certificate is required.
Basically you can use the examples of the following chapters for creating the certificates. You only need
to adjust the parameters in the section mGuard_dn of the OpenSSL configuration file mGuard.conf (refer
to Creating the OpenSSL configuration file).
3.1.1 Creating a password protected RSA Key
At first create the private key to use when creating the mGuard certificate. The private key is protected
by a pass phrase (password). The pass phrase will be requested whenever you use this RSA private key
for anything, so make sure you remember it.
Following is the syntax to create a password-protected private RSA key:
openssl genrsa - -out
Option
genrsa
-
-out
Description
This command generates an RSA private key.
Specifies the algorithm to be used for encrypting the private key (using a password
supplied by the user).
The output filename.
The size of the private key to generate in bits. This must be the last option
specified. The default is 512.
Example:
C:\ssl>openssl genrsa -out mGuard.key -des3 1024
Loading 'screen' into random state - done
Generating RSA private key, 1024 bit long modulus
................................++++++
.............++++++
e is 65537 (0x10001)
Enter pass phrase for mGuard.key: - choose a memorable pass phrase to use for this key
Verifying - Enter pass phrase for mGuard.key: - type your pass phrase again for verification
C:\ssl>
The pass phrase will be requested whenever you use this certificate for anything, so make sure you
remember it. This command will create a file called mGuard.key, containing the mGuard certificate
private key.
Document ID: AN201002907-004 Version: 1.00 Page 6 of 32

Application Note: How to obtain X.509 Certificates
3.1.2 Creating the OpenSSL Configuration File
In our example we have named the configuration file mGuard.conf. The "req" section of the configuration
file is used when creating certificate requests, and supplies defaults and length limits (if specified) for the
various distinguished name fields. Some of these fields (e.g. commonName) will be different for each
certificate request, while others will use the default (e.g. countryName). In our examples the "req"
section contains the following options:
[ req ]
prompt
distinguished_name
x509_extensions
string_mask
[ mGuard_dn ]
countryName
countryName_default
organizationName
organizationName_default
organizationalUnitName
organizationalUnitName_default
commonName
= yes
= mGuard_dn
= mGuard_ext
= utf8only
= Country Name (2 letter code)
= DE
= Organization Name (company)
= Innominate Security Technologies AG
= Organizational Unit Name (department, division)
= Support
= Common Name (hostname, IP, or your name)
#emailAddress
= Email Address
#emailAddress_default =
#localityName
= Locality Name (city, district)
#localityName_default =
#stateOrProvinceName
= State or Province Name (full name)
#stateOrProvinceName_default =
[ mGuard_ext ]
basicConstraints
= CA:false
Contents of the configuration file mGuard.conf
The section mGuard_dn is called when the distinguished name of the certificate is created. In the
example above we have only used four parameters and commented out emailAddress, localityName and
stateOrProvinceName. Apart of this we have defined default values (*_default) for consistency reasons
and less typing. We don’t have specified a default value for commonName because this field will be
different for each certificate request. You’ll be prompted to modify or enter those values when calling
openssl with the option req.
Document ID: AN201002907-004 Version: 1.00 Page 7 of 32

Application Note: How to obtain X.509 Certificates
3.1.3 Creating the mGuard Certificate
Now create the mGuard certificate based on the RSA private key you have created previously. The output
file contains the public key only and needs to be imported on the remote VPN gateway as connection
certificate.
Following is the syntax to create the mGuard certificate:
openssl req -new -config -days 365 -key -keyform PEM
-sha256 -x509 -outform PEM -out
Option
Description
req
The req command primarily creates and processes certificate requests. It can
additionally create self signed certificates when the option –x509 is specified.
-new
This option generates a new certificate request.
-config
This allows an alternative configuration file to be specified.
-days
When the -x509 option is being used this specifies the number of days the
certificate will be valid.
-key
This specifies the file to read the private key from. This is the filename containing
the RSA private key you’ve created in the previous step.
-keyform PEM
The format of the private key file specified in the -key argument.
-sha256
This specifies the message digest to sign the request with.
-x509 This option outputs a self signed certificate instead of a certificate request.
-outform PEM
This specifies the output format.
-out
This specifies the output filename to write to.
Example:
C:\ssl>openssl req -new -config mGuard.conf -days 365 -key mGuard.key -keyform PEM -sha256 -x509 -outform PEM
-out mGuard.crt
Enter pass phrase for mGuard.key: - enter the password of the mGuard’s private key
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [DE]: - we have kept the default value
Organization Name (company) [Innominate Security Technologies AG]: - we have kept the default value
Organizational Unit Name (department, division) [Support]: - we have kept the default value
Common Name (hostname, IP, or your name) []:mGuard - we have entered the common name for this certificate
C:\ssl>
This command will create the certificate called mGuard.crt, containing the public key. This certificate is a
self signed certificate valid for 365 days.
Document ID: AN201002907-004 Version: 1.00 Page 8 of 32

Application Note: How to obtain X.509 Certificates
3.1.4 Creating the PKCS#12 File
This file combines the private and public key and is the mGuard’s machine certificate which needs to be
imported through the menu Authentication -> Certificates, tab Machine Certificate. You’ll be prompted to
enter a password which protects the PKCS#12 export of the certificate against unauthorized usage.
Following is the syntax to create the mGuard machine certificate:
openssl pkcs12 -export -in -inkey -out
Option
pkcs12
-export
-in
-inkey
-out
Description
The pkcs12 command allows PKCS#12 files to be created and parsed.
This option specifies that a PKCS#12 file will be created rather than parsed.
The filename to read the certificate from. The format of the file must be PEM. This
is the mGuard’s certificate you have created in the previous step.
File to read private key from. This is the file which contains the private key of the
mGuard’s certificate.
The filename to write certificates and private keys to. They are all written in PEM
format.
Example:
C:\ssl>openssl pkcs12 -export -in mGuard.crt -inkey mGuard.key -out mGuard.p12
Loading 'screen' into random state - done
Enter pass phrase for mGuard.key: - enter the password of the mGuard’s private key
Enter Export Password: - choose a memorable pass phrase to use for this machine certificate
Verifying - Enter Export Password: - type your pass phrase again for verification
C:\ssl>
This command will create a file called mGuard.p12, containing the mGuard’s certificate public und
private key. The file is protected by the entered password.
Document ID: AN201002907-004 Version: 1.00 Page 9 of 32

Application Note: How to obtain X.509 Certificates
3.2 Using a Certification Authority (CA) Environment
This chapter explains how to setup OpenSSL to act as certification authority (CA). A certificate request
must be signed by the CA to become a valid certificate. You should use the CA environment if appliances
from other manufacturers are involved in the VPN connection or if you need certificates for a huge
number of mGuards.
Basically you can use the examples of the following chapters for creating the certificates. You only need
to follow the instructions and adjust the parameters in the section req_dn of the OpenSSL configuration
file openssl.conf (refer to chapter Modifying the OpenSSL configuration file) to your company needs.
3.2.1 Preparing the CA environment
First of all we will create a directory structure where all certificate stuff will be kept. In the following
examples we use C:\CA as root directory. The following subdirectories need to be created:
Subdirectory
.\certs
.\newcerts
.\private
Purpose
Directory where the certificates will be placed.
Directory where OpenSSL puts the created certificates in PEM (unencrypted) format
and in the form cert_serial_number.pem (eg 07.pem). OpenSSL requires this
directory, so we create it.
Directory for storing the private keys. Be sure that you set restrictive permissions
to this directory so that they can be read only by user with the appropriate
privileges. If anyone steals your private keys things could get really bad.
Apart of the directory tree the following two files need to be created:
• index.txt: This file is used as certificate “database” by OpenSSL. To create this file:
o Open a DOS prompt.
o Switch to the CA root directory (in our example C:\CA).
o Execute the command copy NUL: index.txt. This command creates the empty file index.txt.
• serial: This file contains the certificate serial number counter. This counter will be incremented
automatically by OpenSSL when its value has been used for creating a certificate. To create this file:
o Open a DOS prompt.
o Switch to the CA root directory (in our example C:\CA).
o Execute the command echo 0001 > serial. This command creates the file serial with the
initial serial number 0001.
Document ID: AN201002907-004 Version: 1.00 Page 10 of 32

Application Note: How to obtain X.509 Certificates
3.2.2 Modifying the OpenSSL Configuration File
We have named the OpenSSL configuration file openssl.conf and placed it into the CA root directory (in
our example C:\CA). The OpenSSL configuration file has multiple sections. Each section is used for a
different purpose, and the sections include the following:
• ca, CA_default: Defines certification authority configuration.
• policy_any: Defines request policies.
• req, req_dn: Defines request defaults.
In our examples the configuration file has the following entries:
[ req ]
prompt
= yes
default_bits = 1024
distinguished_name
= req_dn
x509_extensions
= req_ext
string_mask
= utf8only
[ ca ]
default_ca
= CA_default
[ CA_default ]
dir = .
certs
= $dir/certs
database
= $dir/index.txt
new_certs_dir
= $dir/newcerts
certificate
serial
private_key
= $dir/certs/ca.crt
= $dir/serial
= $dir/private/ca.key
default_md
= sha1
default_days = 365
x509_extensions
policy
[ req_dn ]
countryName
countryName_default
organizationName
organizationName_default
organizationalUnitName
organizationalUnitName_default
commonName
# Not used in our example
#emailAddress
#localityName
#stateOrProvinceName
[ policy_any ]
countryName
organizationName
organizationalUnitName
commonName
# Not used in our example
#emailAddress
#localityName
#stateOrProvinceName
[ req_ext ]
basicConstraints
= req_ext
= policy_any
= Country Name (2 letter code)
= DE
= Organization Name (company)
= Innominate Security Technologies AG
= Organizational Unit Name (department, division)
= Support
= Common Name (hostname, IP, or your name)
= Email Address
= Locality Name (city, district)
= State or Province Name (full name)
= supplied
= supplied
= optional
= supplied
= optional
= optional
= optional
= critical, CA:false
[ ca_ext ]
basicConstraints
= critical, CA:true, pathlen:0
keyUsage
= critical, cRLSign, keyCertSign
Contents of the file openssl.conf
Document ID: AN201002907-004 Version: 1.00 Page 11 of 32

Application Note: How to obtain X.509 Certificates
Section Option Description
[ req ]
This section is called when requesting a certificate by calling the openssl command with the option
req.
prompt
If set to the value no this disables prompting of certificate fields and
just takes values from the configuration file directly. You should
enable this option for being able to enter the common name or to
modify the default values of the certificate’s distinguished name for
each requested certificate.
default_bits
This specifies the default key size in bits. If not specified then 512 is
used.
distinguished_name This specifies the section containing the distinguished name fields to
prompt for when generating a certificate or certificate request. In
our example this section is called [ req_dn ].
x509_extensions
This specifies the configuration file section containing a list of
extensions to add to certificate generated when the -x509 switch is
used. It can be overridden by the -extensions command line
switch.
string_mask
This option masks out the use of certain string types in certain
fields. If the utf8only option is used then only UTF8Strings will be
used: this is the PKIX recommendation in RFC2459 after 2003.
[ ca ]
This section is called when signing certificate requests by calling the openssl command with the
option ca.
default_ca
If the -name command line option is used, then it names the
section to be used. Otherwise the section to be used must be named
in the default_ca option of the ca section of the configuration file,
in our example [ CA_default ].
[ CA_default ] This section is called when signing certificate requests by calling the openssl command with the
option ca, referenced by the default_ca option of the ca section.
dir
Root directory of the CA environment. If the configuration file is
located in this directory and if you execute all openssl command
from this directory, you simply can specify “dir = .”.
certs
Certificates output directory.
database
The text database file to use (mandatory parameter). This file must
be present though initially it will be empty.
new_certs_dir
It specifies the directory where new certificates will be placed.
Mandatory.
certificate
Location and filename of the CA certificate.
serial
A text file containing the next serial number to use in hex.
Mandatory. This file must be present and contain a valid serial
number.
private_key
Location and filename of the file which contains the CA’s private
key.
default_md
This option specifies the digest algorithm to use. Possible values
include md5 sha1. If not present then MD5 is used. This option can
be overridden on the command line.
default_days
The default number of days the certificate will be valid. This default
value can be overridden by the -days command line switch.
x509_extensions
This specifies the configuration file section containing a list of
extensions to add to certificate generated when the -x509 switch is
used. It can be overridden by the -extensions command line
switch.
[ req_dn ]
This specifies the parameters containing the distinguished name fields to prompt for when
generating a certificate or certificate request, referenced by the distinguished_name option of
the req section. If the prompt option in the req section is absent or set to yes then the section
contains field prompting information. is the field name being used, for example
commonName (or CN).
=
“prompt”
The "prompt" string is used to ask the user to enter the relevant
details.
_default
=”default field value”
If the user enters nothing then the default value is used if no default
value is present then the field is omitted.
[ policy_any ] This option defines the CA "policy" to use and needs to be specified by the –policy command line
switch. This is a section in the configuration file which decides which fields should be mandatory
or match the CA certificate. The policy section consists of a set of variables corresponding to
certificate DN fields. If the value is match then the field value must match the same field in the
CA certificate. If the value is supplied then it must be present. If the value is optional then it
may be present. Any fields not mentioned in the policy section are silently deleted.
[ …_ext ]
Those sections specify the X.509 extensions and are referenced by the x509_extensions option
within the configuration file (section [ req ] and [ CA_default ]). It can be overridden by the
-extensions command line switch.
basicConstraints
This flag is used to determine whether the certificate can be used as
a CA.
Document ID: AN201002907-004 Version: 1.00 Page 12 of 32

Application Note: How to obtain X.509 Certificates
3.2.3 Create the CA Certificate and Key
Now, that all initial configuration is done, we may create a self signed certificate, that will be used as our
CA certificate. In other words, we will use this to sign other certificate requests.
Change to the CA root directory. From there we should issue all the openssl commands because here is
our openssl configuration file (openssl.conf).
Following is the syntax to create the CA certificate and private key:
openssl req -new -config -x509 -extensions -keyout
-out -days
Option
Description
req
The req command primarily creates and processes certificate requests. It can
instead create self signed certificates when the option –x509 is specified.
-new
This option generates a new certificate request.
-config
This allows an alternative configuration file to be specified.
-x509 This option outputs a self signed certificate instead of a certificate request.
-extensions Specifies the section in the openssl configuration file (specified by -config
) where the X.509 certificate extensions are defined.
-keyout
Filename of the CA’s private key. Although it is protected with a pass phrase you
should restrict access to it, so that only authorized users can read it.
-out
Filename of the CA certificate.
-days
When the -x509 option is being used this specifies the number of days to certify
the certificate for.
Example:
C:\CA>openssl req -new -config openssl.conf -x509 -extensions ca_ext -keyout private/ca.key -out certs/ca.crt -days
3640
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
...........++++++
.......................................................................++++++
writing new private key to 'private/ca.key'
Enter PEM pass phrase: - choose a memorable pass phrase to use for this key
Verifying - Enter PEM pass phrase: - type your pass phrase again for verification
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [DE]: - we have kept the default value
Organization Name (company) [Innominate Security Technologies AG]: - we have kept the default value
Organizational Unit Name (department, division) [Support]: - we have kept the default value
Common Name (hostname, IP, or your name) []:CA – here we have entered the common name for the CA certificate
C:\CA>
Two files are created:
• certs/ca.crt: This is the CA’s certificate and can be publicly available and of course world readable.
• private/ca.key: This is the CA’s private key. Although it is protected with a pass phrase you should
restrict access to it, so that only authorized users can read it.
Document ID: AN201002907-004 Version: 1.00 Page 13 of 32

Application Note: How to obtain X.509 Certificates
3.2.4 Create a Certificate Request for the mGuard
For obtaining a valid mGuard certificate you need to create a certificate request first and then sign it with
the CA certificate (explained in the next chapter).
Following is the syntax for creating a certificate request for the mGuard:
openssl req –new -config -keyout -out -days
Option
req
-new
-config
-keyout
-out
-days
Description
The req command primarily creates and processes certificate requests.
This option generates a new certificate request.
This allows an alternative configuration file to be specified.
Filename of the mGuard’s private key. Although it is protected with a pass phrase
you should restrict access to it, so that only authorized users can read it.
Filename of the mGuard certificate.
The number of days the certificate should be valid.
Example:
C:\CA>openssl req -new -config openssl.conf -keyout private/mGuard.key -out mGuard.csr -days 364
Loading 'screen' into random state - done
Generating a 1024 bit RSA private key
.......................................++++++
...++++++
writing new private key to 'private/mGuard.key'
Enter PEM pass phrase: - choose a memorable pass phrase to use for this key
Verifying - Enter PEM pass phrase: - type your pass phrase again for verification
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [DE]: - we have kept the default value
Organization Name (company) [Innominate Security Technologies AG]: - we have kept the default value
Organizational Unit Name (department, division) [Support]: - we have kept the default value
Common Name (hostname, IP, or your name) []:mGuard – enter the common name for the mGuard certificate
C:\CA>
Two files are created:
• mGuard.csr: This is the certificate request which needs to be signed by the CA certificate.
• private/mGuard.key: This is the private key, which is not protected with a pass phrase.
Document ID: AN201002907-004 Version: 1.00 Page 14 of 32

Application Note: How to obtain X.509 Certificates
3.2.5 Sign the mGuard’s Certificate Request with the CA
The mGuard’s certificate request needs to be signed by the CA to become a valid certificate.
Following is the syntax for signing the mGuard’s certificate request with the CA:
openssl ca –config -out -infiles
Option
ca
-config
-out
-infiles
Description
The ca command is a minimal CA application. It can be used to sign certificate
requests in a variety of forms and generate CRLs it also maintains a text database
of issued certificates and their status.
This allows an alternative configuration file to be specified.
Filename of the signed mGuard certificate.
Filename of the mGuard’s certificate request. This must be the last option.
Example:
C:\CA>openssl ca -config openssl.conf -out certs/mGuard.crt -infiles mGuard.csr
Using configuration from openssl.conf
Loading 'screen' into random state - done
Enter pass phrase for ./private/ca.key: - enter the pass phrase of the CA’s private key
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'DE'
organizationName :ASN.1 12:'Innominate Security Technologies AG'
organizationalUnitName:ASN.1 12:'Support'
commonName :ASN.1 12:'mGuard'
Certificate is to be certified until Feb 21 09:48:47 2008 GMT (365 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
C:\CA>
After all this is done two new files are created:
• certs/mGuard.crt: This is the mGuards’s certificate, which can be made available publicly.
• newcerts/01.pem: This is exactly the same certificate, but with the certificate’s serial number (hex
number) as filename. For subsequent requests the number is incremented. This file is not needed
anymore and can be removed.
Now you can delete the mGuard’s certificate request (mGuard.csr). It’s no longer needed.
Document ID: AN201002907-004 Version: 1.00 Page 15 of 32

Application Note: How to obtain X.509 Certificates
3.2.6 Creating the mGuard’s PKCS#12 File (Machine Certificate)
This file combines the private and public key and is the mGuard’s machine certificate which needs to be
imported through the menu IPsec VPN -> Global, tab Machine Certificate. You’ll be prompted to enter a
password which protects the PKCS#12 export of the certificate against unauthorized usage.
Following is the syntax to create the mGuard machine certificate:
openssl pkcs12 -export -in -inkey -out
Option
pkcs12
-export
-in
-inkey
-out
Description
The pkcs12 command allows PKCS#12 files to be created and parsed.
This option specifies that a PKCS#12 file will be created rather than parsed.
The filename to read the certificate from. The format of the file must be PEM. This
is the mGuard’s certificate you have created in the previous step.
File to read private key from. This is the file which contains the private key of the
mGuard’s certificate.
The filename to write certificates and private keys to. They are all written in PEM
format.
Example:
C:\ssl>openssl pkcs12 -export -in certs/mGuard.crt -inkey private/mGuard.key -out certs/mGuard.p12
Loading 'screen' into random state - done
Enter pass phrase for mGuard.key: - enter the password of the mGuard’s private key
Enter Export Password: - choose a memorable pass phrase to use for this machine certificate
Verifying - Enter Export Password: - type your pass phrase again for verification
C:\ssl>
This command will create a file called certs/mGuard.p12, containing the mGuard certificate public und
private key. The file is protected by the entered password.
Document ID: AN201002907-004 Version: 1.00 Page 16 of 32

Application Note: How to obtain X.509 Certificates
3.2.7 Example: Obtaining X.509 Certificates for a VPN Connection between two mGuards
We assume that you already have setup the CA environment, configured the openssl’s configuration file
and created the CA certificate and key as described in the previous chapters.
Step 1: Create a certificate request for each mGuard
mGuard 1:
openssl req -new -config openssl.conf -keyout private/mGuard1.key -out mGuard1.csr -days 364
mGuard 2:
openssl req -new -config openssl.conf -keyout private/mGuard2.key -out mGuard2.csr -days 364
Step 2: Sign each certificate request with the CA
mGuard 1:
openssl ca -config openssl.conf -out certs/mGuard1.crt -infiles mGuard1.csr
mGuard 2:
openssl ca -config openssl.conf -out certs/mGuard2.crt -infiles mGuard2.csr
The two certificates certs/mGuard1.crt and certs/mGuard2.crt are created. mGuard1.crt needs to
be imported on mGuard 2 as connection certificate through the menu IPsec VPN -> Connections, tab
Authentication. mGuard2.crt on mGuard 1 correspondingly.
Step 3: Obtain the machine certificate for each mGuard
mGuard 1:
openssl pkcs12 -export -in certs/mGuard1.crt -inkey private/mGuard1.key -out certs/mGuard1.p12
mGuard 2:
openssl pkcs12 -export -in certs/mGuard2.crt -inkey private/mGuard2.key -out certs/mGuard2.p12
The two certificates certs/mGuard1.p12 and certs/mGuard2.p12 are created. mGuard1.p12 needs
to be imported on mGuard 1 as machine certificate through the menu Authentication -> Certificates, tab
Machine Certificate. mGuard2.p12 on mGuard 2 correspondingly.
Document ID: AN201002907-004 Version: 1.00 Page 17 of 32

Application Note: How to obtain X.509 Certificates
4 XCA
This section explains briefly how to create X.509 certificates with the tool XCA. XCA provides much more
functionality than explained in this document. Please refer to the XCA documentation for further
information. You can download XCA from http://xca.sourceforge.net. The screenshots and descriptions in
this chapter are related to XCA v0.6.3.
After installing XCA you need to create a database. To do this:
• From the menu, select File -> New DataBase.
• Specify the storage location and filename of the database.
• Click Save.
⇒ You’ll be prompted to enter a password which protects the database against unauthorized usage.
When restarting XCA you need to reconnect to the database first through the menu File -> Open
DataBase.
4.1 Options
Before you start creating certificates you should set the default hash algorithm do SHA 1 because not all
appliances support SHA 2. If you don’t set the default hash algorithm do SHA 1 you’d need to do it every
time when creating a certificate.
• From the menu, select File -> Options.
• Set Default hash algorithm to SHA 1.
• Click OK.
Document ID: AN201002907-004 Version: 1.00 Page 18 of 32

Application Note: How to obtain X.509 Certificates
4.2 Create a Certificate Template
If you need to create a bunch of certificates it is useful to define a template for consistency reasons and
less typing and to use this template when creating the certificates.
• Switch to the tab Templates.
• Click New Template.
• In the tab Subject, use the entry fields from Internal
name to E-Mail address for entering the identifying
parameters which shall be common for all certificates. The
template will be stored in XCA under the Internal Name.
• Switch to the tab Extensions.
• Set Type to End Entity. In this case the template can be
used for creating client certificates. Set Type to
Certification Authority if the template should be used for
creating CA certificates.
• Select in the section Time Range the default lifetime of
the certificates and click Apply.
• Click OK.
⇒ The created template is displayed in the tab Templates.
Document ID: AN201002907-004 Version: 1.00 Page 19 of 32

Application Note: How to obtain X.509 Certificates
4.3 Create a Certification Authority (CA) Certificate
If you don’t use self signed client certificates, a client certificate must be signed by the CA certificate to
become a valid certificate. Therefore you need to create the CA certificate first before creating the client
certificates. The CA certificate is a self signed certificate.
• Switch to the tab Certificates.
• Click New Certificate.
• Ensure that Create a self signed certificate with the
serial is selected.
• You may enter a serial number for the certificate or leave
the default value.
• If you have created a template for creating CA
certificates, you may select it in the section Template and
click Apply.
• Switch to the tab Subject.
• Use the entry fields from Internal name to E-Mail
address for entering the identifying parameters of the
CA.
• Click Generate a new key for creating the private RSA
key for the CA.
• Enter a Name for the key, specify the desired Keysize
and click Create.
• Switch to the tab Extensions.
• Set Type to Certification Authority.
• Select in the section Time Range the lifetime of the CA
certificate. For a CA certificate you may want it to last
longer than the client certificates so that you do not have
to reissue the certificates so often. We have chosen a
lifetime of 10 years. Click Apply.
• Click OK.
⇒ The created CA certificate is displayed in the tab
Certificates.
Document ID: AN201002907-004 Version: 1.00 Page 20 of 32

Application Note: How to obtain X.509 Certificates
4.4 Create a Client Certificate
• Switch to the tab Certificates.
• Click New Certificate.
• Ensure that the correct CA is selected in the field Use this
certificate for signing.
• If you have created a client template, select it in the field
Template for the new certificate and click Apply.
• Switch to the tab Subject.
• Use the entry fields from Internal name to E-Mail
address for entering the identifying parameters of the
client certificate.
• Click Generate a new key for creating the private RSA
key.
• Enter a Name for the key, specify the desired Keysize
and click Create.
• Switch to the tab Extensions.
• Set Type to End Entity.
• Select in the section Time Range the lifetime of the
client certificates and click Apply.
• Note: The mGuard uses as default VPN identifier the
subject name of the certificate. If you want to use
another VPN identifier, as for example email address,
hostname or IP address, this identifier must be present in
the certificate as subject alternative name. To add
another identifier, click Edit in the line subject alternative
name, select the identifier type (email, DNS or IP), enter
its value, click Add and then Apply.
• Click OK.
⇒ The created client certificate is displayed in the tab
Certificates beneath the CA.
Document ID: AN201002907-004 Version: 1.00 Page 21 of 32

Application Note: How to obtain X.509 Certificates
4.5 Certificate Export
• Switch to the tab Certificates.
• Highlight the certificate you’d like to export.
• Click Export.
• Select the Export Format (PEM or PKCS#12).
• Specify the desired Filename and the location where the
export should be stored.
• Click OK.
• If you export the certificate as PKCS#12 then you’ll be
prompted to enter a password which protects the export
against unauthorized usage. Enter the Password and
click OK.
4.6 Signing a Certificate Request with the CA
• Switch to the tab Certificate signing requests.
• Click Import.
• Select the certificate request which should be signed by the CA and click Open.
⇒ The imported certificate request is displayed in the tab Certificate signing requests.
• Right click the certificate request and select Sign from the context menu.
• Ensure that Use this Certificate for signing and the
corresponding CA are selected.
• Switch to the tab Extensions.
• Leave Type as Not defined. Otherwise XCA would copy
the certificate extensions twice into the signed certificate.
• Select in the section Time Range the lifetime of the
certificates and click Apply.
• Click OK.
⇒ The signed certificate request is displayed in the tab
Certificates beneath the CA.
Document ID: AN201002907-004 Version: 1.00 Page 22 of 32

Application Note: How to obtain X.509 Certificates
4.7 Certificate Revocation List (CRL)
Revoke a certificate
• Switch to the tab Certificates.
• Right click the client certificate that should be revoked and select Revoke from the context menu.
⇒ The revoked certificate is marked with a red question mark and the Trust state is Not trusted.
Specify the CRL renewal period
• Switch to the tab Certificates.
• Right click the CA and select CA -> Properties from the context menu.
• Enter the desired renewal period into the field Days until next CRL issuing.
• Click OK.
Create the CRL
• Switch to the tab Certificates.
• Right click the CA and select CA -> Generate CRL from the context menu.
• Click OK.
⇒ The CRL is displayed in the tab Revocation lists.
Obtain information about a CRL
• Switch to the tab Revocation lists.
• Highlight the CRL and click Show Details.
Export of the CRL
• Switch to the tab Revocation lists.
• Highlight the CRL.
• Click Export.
• Specify the filename and location for storing the CRL.
• Chose the export format (DER or PEM).
• Click OK.
Document ID: AN201002907-004 Version: 1.00 Page 23 of 32

Application Note: How to obtain X.509 Certificates
4.8 Required Certificates - Examples
4.8.1 VPN between two mGuards
• Create the CA as described in chapter Create a Certification Authority (CA) Certificate.
• Create a client certificate for mGuard #1 and a client certificate for mGuard #2 as described in
chapter Create a Client Certificate.
• Export the certificates as described in chapter Certificate Export. The following exports are required:
o mGuard #1 as PKCS#12: This export needs to be imported on mGuard #1 as machine
certificate (menu: Authentication -> Certificates, tab Machine Certificates).
o mGuard #2 as PKCS#12: This export needs to be imported on mGuard #2 as machine
certificate (menu: Authentication -> Certificates, tab Machine Certificates).
o mGuard #1 as PEM: This export needs to be imported on mGuard #2 as connection
certificate (menu: IPSec VPN -> Connections, tab Authentication).
o mGuard #2 as PEM: This export needs to be imported on mGuard #1 as connection
certificate (menu: IPSec VPN -> Connections, tab Authentication).
For further information about how to setup a VPN connection between two mGuards refer to the
document mGuard Configuration Examples which can be downloaded from our homepage
(http://www.innominate.com, Downloads -> Documentation).
4.8.2 VPN between mGuard and Netscreen 5GT/204/5400
• Create a certificate request on the Netscreen (menu: Objects -> Certificates).
• Create the CA as described in chapter Create a Certification Authority (CA) Certificate.
• Import the certificate request of the Netscreen and sign it with the CA as described in chapter Signing
a Certificate Request with the CA.
• Create a client certificate for the mGuard as described in chapter Create a Client Certificate.
• Create the CRL as described in chapter Certificate Revocation List (CRL).
• Export the certificates as described in chapter Certificate Export. The following exports are required:
o CA as PEM: This export needs to be imported on the Netscreen (menu: Objects ->
Certificates).
o Signed Netscreen certificate as PEM: This export needs to be imported on the Netscreen
(menu: Objects -> Certificates) and on the mGuard as connection certificate (menu: IPSec
VPN -> Connections, tab Authentication).
o Certificate Revocation List (CRL) as PEM (refer to chapter 4.7 Certificate Revocation List
(CRL)): This export needs to be imported on the Netscreen (menu: Objects -> Certificates).
o mGuard certificate as PKCS#12: This export needs to be imported on the mGuard as machine
certificate (menu: Authentication -> Certificates, tab Machine Certificates).
For further information about how to setup a VPN connection between mGuard and Netscreen refer to the
interoperability document mGuard – Netscreen 5GT/204/5400 which can be downloaded from our
homepage (http://www.innominate.com, Downloads -> Application Notes).
Document ID: AN201002907-004 Version: 1.00 Page 24 of 32

Application Note: How to obtain X.509 Certificates
4.8.3 VPN between mGuard and Cisco VPN 3000 Concentrator Series
• Create the CA as described in chapter Create a Certification Authority (CA) Certificate.
• Export the CA as PEM. This export needs to be imported on the Cisco device (menu: Administration -
> Certificate Management -> Installation).
• Request a certificate on the Cisco device (menu: Administration -> Certificate Management ->
Enrollment).
• Import the certificate request of the Cisco device and sign it with the CA as described in chapter
Signing a Certificate Request with the CA.
• Export the signed Cisco certificate as PEM. This export needs to be imported on the Cisco device
(menu: Administration -> Certificate Management -> Installation) and on the mGuard as connection
certificate (menu: IPSec VPN -> Connections, tab Authentication).
• Create a client certificate for the mGuard as described in chapter Create a Client Certificate.
• Export the mGuard certificate as PKCS#12 as described in chapter Certificate Export. This export
needs to be imported on the mGuard as machine certificate (menu: Authentication -> Certificates,
tab Machine Certificates).
For further information about how to setup a VPN connection between mGuard and Cisco VPN 3000
Concentrator refer to the interoperability document mGuard – Cisco VPN3000 Concentrator which can be
downloaded from our homepage (http://www.innominate.com, Downloads -> Application Notes).
4.8.4 L2TP/IPsec connection between Windows client and mGuard
• Create the CA as described in chapter Create a Certification Authority (CA) Certificate.
• Create a client certificate for the Windows client and for the mGuard as described in chapter Create a
Client Certificate.
• Export the certificates as described in chapter Certificate Export. The following exports are required:
o CA as PEM: This export needs to be imported on the Windows client as Trusted Root Certification
Authorities.
o Windows certificate as PKCS#12: This export needs to be imported on the Windows client as
Personal certificate.
o Windows certificate as PEM: This export needs to be imported on the mGuard as connection
certificate (menu: IPSec VPN -> Connections, tab Authentication).
o mGuard certificate as PKCS#12: This export needs to be imported on the mGuard as machine
certificate (menu: Authentication -> Certificates, tab Machine Certificates).
For further information about how to setup a L2TP/IPsec connection between a Windows client and the
mGuard refer to the document mGuard Configuration Examples which can be downloaded from our
homepage (http://www.innominate.com, Downloads -> Documentation).
4.8.5 VPN between SafeNet SoftRemote and mGuard
Note: Ensure that you use different values for the certificate identifying parameters (CountryName
to CommonName) when creating the certificates. Otherwise, if you would use the same value more
than one, e.g. organizationName=Innominate and organizationUnitName=Innominate, SoftRemote
would complain about an invalid certificate ID.
• Create the CA as described in chapter Create a Certification Authority (CA) Certificate.
• Create a client certificate for the SoftRemote client and for the mGuard as described in chapter
Create a Client Certificate.
• Export the certificates as described in chapter Certificate Export. The following exports are required:
o CA as PEM: This export needs to be imported on the SoftRemote client through the Certificate
Manager, tab Root CA Certificates.
o SoftRemote certificate as PKCS#12: This export needs to be imported on the SoftRemote
client through the Certificate Manager, tab My Certificates.
o SoftRemote certificate as PEM: This export needs to be imported on the mGuard as
connection certificate (menu: IPSec VPN -> Connections, tab Authentication).
o mGuard certificate as PKCS#12: This export needs to be imported on the mGuard as machine
certificate (menu: Authentication -> Certificates, tab Machine Certificates).
Document ID: AN201002907-004 Version: 1.00 Page 25 of 32

Application Note: How to obtain X.509 Certificates
5 Microsoft Certification Authority (CA) Server
We have installed the Microsoft Certification Authority on a Windows 2000 Advanced Server (SP 4).
Details about how to install the Certification Authority are beyond the scope of this document. Please
refer to the documentation of your Windows Server. The CA certificate was created during the installation
of the Certification Authority.
You need to execute the described steps twice for obtaining the certificates for mGuard 1 and mGuard 2.
The PKCS#12 (*.PFX, *.P12) export of the mGuard certificate is the machine certificate. It needs to be
imported on the corresponding mGuard through the menu Authentication -> Certificates, tab Machine
Certificates.
The base-64 encoded (*.CER) export of the mGuard certificate is the connection certificate. It needs to
be imported on the remote mGuard through the menu IPsec VPN -> Connections, tab Authentication.
5.1 Request the mGuard Certificate from the Certification Authority
Start the Internet Explorer and access the Certification Authority by calling http:///certsrv.
• Select Request a certificate.
• Select submit an advanced certificate
request.
• Select Create and submit a request to
this CA.
Document ID: AN201002907-004 Version: 1.00 Page 26 of 32

Application Note: How to obtain X.509 Certificates
• In Identifying information, enter the
certificate identifying parameters (subject
name).
• In Type of Certificate Needed, select IPSec
Certificate.
• In Key Options, leave the CSP and Key
Usage fields as the default. Change the
Key Size to 1024, leave the Automatic
key container name selected, and select
Mark keys as exportable.
• In Additional Options, leave Request
Format as CMC, and the Hash Algorithm
as SHA-1. Do not select Save request to a
file. In Friendly Name, type a name.
• Click Submit.
• You will receive the following warning when
requesting the certificate.
• To continue, select Yes.
⇒ You should see the prompt Waiting for server response while the request is being submitted.
• Finally the following screen appears,
displaying the certificate Request ID.
Document ID: AN201002907-004 Version: 1.00 Page 27 of 32

Application Note: How to obtain X.509 Certificates
5.2 Issue the mGuard Certificate Request on the MS CA Server
• On the Windows Server, on which the Certification Authority is running, select Start->
Administration Tools -> Certification Authority (you can also use MMC with the Certification
Authority snap-in).
• Navigate to the Pending Requests node.
• Find the certificate request with the
corresponding Request ID.
• Right-click it, select All Tasks -> Issue.
⇒ The certificate should then move to the
Issued Certificates node.
5.3 Retrieve the issued mGuard Certificate
Start the Internet Explorer and access the Certification Authority by going to http:///certsrv.
• Select View the status of a pending
certificate request.
• Select IPSec Certificate.
Document ID: AN201002907-004 Version: 1.00 Page 28 of 32

Application Note: How to obtain X.509 Certificates
• Select Install this certificate.
• A Potential Scripting Violation warning
appears.
• After reading and understanding the
warning, select Yes to install the certificate.
• The following screen appears, letting you
know that the certificate was installed.
5.4 Export of the mGuard Machine Certificate
• From the Internet Explorer menu, select Tools -> Internet Options.
• Switch to the tab Content and click Certificates.
• Switch to the tab Personal.
• Highlight the mGuard certificate.
• Click Export.
⇒ The Certificate Export Wizard appears.
• Click Next.
Document ID: AN201002907-004 Version: 1.00 Page 29 of 32

Application Note: How to obtain X.509 Certificates
• Select Yes, export the private key.
• Click Next.
• Verify that Personal Information Exchange
– PKCS #12 (.PFX) is selected.
• Select Enable strong protection.
• Click Next.
• Enter a Password which protects the
certificate against unauthorized usage.
• Click Next.
Document ID: AN201002907-004 Version: 1.00 Page 30 of 32

Application Note: How to obtain X.509 Certificates
• Specify the filename and the location where
the export should be stored.
• Click Next.
• Review the settings in the summary screen,
click Finish to complete the export.
This certificate needs to be imported on the mGuard as machine certificate (menu Authentication ->
Certificates, tab Machine Certificates).
5.5 Export of the mGuard Certificate
• From the Internet Explorer menu, select Tools -> Internet Options.
• Switch to the tab Content and click Certificates.
• Switch to the tab Personal.
• Highlight the mGuard certificate.
• Click Export.
⇒ The Certificate Export Wizard appears.
• Click Next.
• Select No, do not export the private key.
• Click Next.
Document ID: AN201002907-004 Version: 1.00 Page 31 of 32

Application Note: How to obtain X.509 Certificates
• Select Base-64 encoded X.509 (.CER).
• Click Next.
• Specify the filename and the location where
the export should be stored.
• Click Next.
• Review the settings in the summary screen,
click Finish to complete the export.
This certificate needs to be imported on the remote mGuard as connection certificate (menu IPsec VPN -
> Connections, tab Authentication).
Document ID: AN201002907-004 Version: 1.00 Page 32 of 32