8 SERIES PROTECTIVE RELAY PLATFORM – COMMUNICATIONS GUIDE
A-1
8 Series Protective Relay Platform
Appendix A: Radius Server and
Certificates
GE
Grid Solutions
Radius Server and Certificates
Appendix A includes information about the RADIUS server and certificates followed by an
example of how to set up a simple RADIUS server and certificate management.
Simple RADIUS Server and Certificate Management
The 8 Series unit can act as a RADIUS client and has the ability to authenticate users with a
RADIUS server using the EAP-TTLS protocol. Authentication is performed with the help of
certificates.
Any cryptography application such as OpenSSL etc. can be used to create certificates.
First, a private key and certificate request are created for the server. The certificate
request contains the public key, and the server’s information (name, email, organization
etc.) The certificate request is then sent to a certificate authority (CA) for the authority’s
digital signature. If the request is sent to a well-known CA, then upon receiving payment
from the RADIUS server’s administrator, the CA verifies the information and signs the
certificate. The administrator can choose not to use an external well-known CA’s services
and create a local CA instead.
The signed certificate of the server along with CA’s public certificate are then sent back to
the RADIUS server administrator. Finally, the CA’s public certificate is uploaded to the relay.
In this example, a local CA is created and used to sign the server’s certificate request.
Create a CA and
Server Certificates
-->
Transfer the server’s
private- public certificate pair
and the CA’s public certificate
to the RADIUS server
-->
Upload the CA’s public
certificate to the 8 Series
unit