iPECS SBG-1000 User Manual

iPECS SBG-1000 User Manual (DATA Features)
5.4.1.5.4 Gateway-to-Gateway with Certificate-based Peer Authentication
An additional authentication method for a gateway-to-gateway VPN is peer authentication of
certificates. Authentication is performed when each gateway presents a certificate, signed by a
mutually agreed upon Certificate Authority (CA), to the other gateway.
For testing purposes, Linux provides a mechanism for creating self-signed certificates, thus
eliminating the need to acquire them from the CA. This section provides a description for this
procedure, after which you will be able to use these certificates for authentication of the
gateway-to-gateway VPN connection.
To create a self-signed certificate, perform the following:
1. Running as root, install the OpenSSL Debian package:
# apt-get install openssl
2. Switch back to a regular user, and create a directory for the certificates:
$ cd ~
$ mkdir cert_create
$ cd cert_create/
3. Use the Linux ‘CA.sh’ utility. Note that only the required fields are listed below. For the rest,
you may simply press Enter.
$ /usr/lib/ssl/misc/CA.sh -newca
Enter PEM pass phrase:
Common Name:
Enter pass phrase for ./demoCA/private/./cakey.pem:
For more information about this script, run ‘man CA.pl’ (CA.pl and CA.sh are the same).
4. Copy the certificates from the /demoCA directory under which they were created, providing
them with your CA name.
$ cp demoCA/cacert.pem _cacert.pem
$ cp demoCA/careq.pem _careq.pem
5. Load the new certificates to both gateways:
a. Browse to the ‘Shortcut’ tab and click the ‘Certificates’ icon.
b. Select the ‘CA’s’ sub-tab and click ‘Upload Certificate’. The ‘Load CA’s Certificate’
screen appears.
c. Browse for the location of the certificate, which is ~/cert_create/_cacert.pem, and click ‘Upload’.
116