65
•
CA
—Certification authority that issues and manages certificates. A CA issues certificates,
defines the certificate validity periods, and revokes certificates by publishing CRLs.
•
RA
—Registration authority, which offloads the CA by processing enrollment requests. The RA
accepts certificate requests, verifies user identity, and determines whether to forward the
certificate requests to the CA.
•
Certificate/CRL
repository
—A certificate distribution point that stores certificates and CRLs,
and distributes these certificates and CRLs to PKI entities. It also provides the query function. A
PKI repository can be a directory server using the LDAP or HTTP protocol, of which LDAP is
commonly used.
Managing certificates
The device manages certificates in PKI domains. A PKI domain contains enrollment information for a
PKI entity. It is locally significant and is intended only for reference by other applications like IKE and
SSL.
Importing certificates
You can import CA certificates and local certificates related to a PKI entity to a PKI domain. You must
import certificates in the following situations:
•
The CRL repository is not specified on the device.
•
The CA server does not support SCEP.
•
The CA server generates the key pair for the certificates.
Before you import certificates, perform the following tasks:
•
Use FTP or TFTP to upload the certificate files to the storage media of the device.
•
Obtain the CA certificate chain if it is neither available in the PKI domain nor contained in the
certificate to be imported.
When you import local certificates, follow these guidelines:
•
If the certificate to be imported contains the CA certificate chain, you also import the CA
certificate by importing the local certificate.
•
You can directly import the local certificate if its associated CA certificate already exists on the
device.
•
If the certificate file to be imported contains the root CA certificate, you must verify the
fingerprint of the root certificate during the import. Contact the CA administrator to obtain the
fingerprint of the root CA certificate.
•
To import a local certificate containing an encrypted key pair, you must provide the challenge
password. Contact the CA administrator to obtain the password. During the import, the system
searches the PKI domain for the key pair settings and saves the key pair accordingly. If the
domain already contains the key pair, the system prompts whether you want to overwrite the
existing key pair. If the PKI domain does not contain settings for the key pair, the system
generates the key pair locally based on the algorithm and usage of the key pair in the certificate.
You can import the following CA certificates:
•
Root CA certificate.
•
Non-root CA certificate that contains the complete certificate chain.
•
Non-root CA certificate that contains partial certificate chain and can form complete certificate
chain with existing CA certificates on the device.
Exporting certificates
You can export the CA certificate and the local certificates in a PKI domain to certificate files. The
exported certificate files can then be imported back to the device or other PKI applications.
