Page 182 of 226
Version: 3.3.5
– DR05 – 23.03.2017
Authentication with certificates
19.3.7
1. Each subscriber needs the same root CA and a personal certificate signed by the root CA.
2. Like 1, but with addition-
al username/password verification.
3. Like 2, but without a personal certificate. In other words, the stations only need a root CA and
username/password.
Authentication with CA certificate and own certificate
19.3.7.1
There are three different types of authentication with certificates:
Tab
Label
Description
X.509 authentication
CA Certificate
This is the root certificate (root CA). All other cer-
tificates must come from this certificate.
Own Certificate
You use this certificate to authenticate yourself to
your VPN peer.
Additional user and pass-
word verification
Additional user data may be required from a client
dialing in. Please note that this user data must be
entered in the VPN server under
System User
.
User
Enter the user data of the VPN server (from the
System User menu) here.
Use only CA and Us-
er/password for client verifi-
cation
With this option, you authenticate yourself using
the CA certificate and the user data of the VPN
server (from the System User menu) only.
Peer must be TLS Server
This is an additional security option. The
“server
certificate
” must include the extension
nsCert-
Type=server
