A-2
8 SERIES PROTECTIVE RELAY PLATFORM – COMMUNICATIONS GUIDE
SETTING UP A SIMPLE RADIUS SERVER
CHAPTER A: RADIUS SERVER AND CERTIFICATES
Authentication:
The user initiates the authentication process by providing user credentials. The 8 Series
unit then tries to establish a trust relationship with the RADIUS server. The RADIUS server
identifies itself via a certificate which it sends to the 8 Series unit. This certificate holds the
server’s information:
•
version
•
public key
•
subject
•
serial number
•
valid from
•
valid until
•
key-usage
•
signature algorithm
•
“issuer” (i.e. CA) etc.
The 8 Series unit then validates the server’s identity by verifying the server’s certificate
against the CA certificate that it has. If both the server and CA certificates are signed by
the same trusted authority (CA), a client side trust relationship is successfully established.
Setting Up a Simple RADIUS Server
The following example demonstrates how to set up a test bench RADIUS server. A proper
RADIUS server is only to be deployed by qualified IT professionals. The third party tools and
services mentioned below are only for demonstration purposes and do not imply
endorsement by GE.
This example uses FreeRADIUS as the RADIUS server.
Download and install FreeRADIUS.net (Windows™ version) from the following location:
http://freeradius.net/
Radius Server Certificate Management
The activities described here are required for certificate management.
Create a Private Key
for the Server
To create a private key by using the command:
openssl genrsa –out server.key 4096
The RSA based private key is generated.
NOTE
The RSA based private key is not a password protected key.
Create a Certificate
Request for the Server
To create a certificate request by using the command:
openssl req –new –key server.key –out server.csr
While using the command, you are asked to enter the following information that is
incorporated into the certificate request.
•
Country Name
•
State or Province Name