Coyote Point Systems E350GX, Installation And Administration Manual

Page: 283 / 344

Using Certificates in HTTPS Clusters
Equalizer Installation and Administration Guide 279
About Client Certificates
Similarly, if you want to use client certificates with an HTTPS cluster, you’ll need to get a signed client certificate
from a CA, or create a self-signed certificate. A client certificate needs to be installed on each client that will access
the Equalizer cluster, as well as on Equalizer.
Just as with server certificates, you may need to install a client certificate and a chained root certificate, if you obtain
your certificates from a CA without its own Trusted Root CA certificate. Some sites prefer to use self-signed
certificates for clients, or set up their own local CA to issue client certificates.
Client certificates can be used in two ways with Equalizer:
1. Install the entire client certificate chain on Equalizer. This requires that every client passes the exact same
certificate to Equalizer for validation.
2. Install an intermediate CA certificate as the client certificate on Equalizer. This allows unique certificates
to be used on clients and a single client certificate to be uploaded to Equalizer. Following this method requires
some certificate processing on the servers behind Equalizer in order to prevent access by clients with revoked
certificates.
This method, therefore, should be used only under the following conditions :
a. If the site is able to use an intermediate CA, or multiple CAs, which signs all and only certificates
authorized for use with the cluster,
AND
b. If the application running on the servers behind Equalizer is able to perform Certificate Revocation List
(CRL) processing by matching the CSN (certificate serial number) to the intermediate CA's CRL, and does
so for
all requests,
THEN
c. The Equalizer can safely support the use of individual client certificates for different clients, by
appropriately setting the
verify depth
option for the HTTPS cluster and uploading the intermediate CA's
certificate to the cluster as the client certificate. If client certificates use different CAs, multiple
intermediate CAs can be uploaded to Equalizer in a single file.
This method ensures that only certificates that pass the CRL check on the server can be used to access the
cluster. Note that this method also assumes that validating the intermediate certificate only in (b) above is
sufficiently secure for the site.
General Certificate Guidelines
Whichever method you choose, follow these general guidelines for certificates you want to use with Equalizer:
• Equalizer accepts both the x509 PEM or PKCS12 certificate formats; PEM files usually have a .pem
extension; PKCS12 files usually have a .pfx extension. Most CA vendors provide certificates in PEM
format.
• Some older Equalizer models are equipped with an Xcel I Hardware SSL Acceleration, which requires a
private key length of 1024 bits. This key length restriction does not apply to the newer generation Xcel II
hardware, though a private key length of 1024 is recommended for best performance. (Note that all
Equalizer GX hardware models that have Xcel are equipped with Xcel II.)
• When uploading certificates to Equalizer in PEM format, the certificates and private key must be contained
in a single plain-text file, in the following order:
•
certificate
• private key
• chained root (intermediate) certificates (if any)