Page 91 of 226
Version: 3.3.5
– DR05 – 23.03.2017
As your client is to be authenticated by the client certificate, it also needs
the private key for this certificate. As shown in Figure 112, export the client certificate using export format
PKCS #12 with Certificate chain. When you click OK,
the client certificate will save to the location that you specified above. The client certificate then has the file
extension .p12.
You must use the PEM (file extension .crt) format when exporting the root certificate.
These certificates can then be imported to the
mbNET
router via the web interface (cf. section
For an explanation of how to set up these certificates for a Windows client, see
Generating CRL-Files (Certificate Revocation Lists)
13.3
If you wish to withdraw a team member
’s rights to use the
VPN tunnel, please read this section and create a certificate
revocation list.
To do this, re-open XCA. Open the database containing
your team member
’s certificate. To confirm a certificate as in-
valid, right-click on it and the dialog box below will appear:
Clicking on
“Revoke”
flags the relevant certificate
with a red X, and it is no longer valid. To remove the
flag and make the certificate entry valid again, click
on
“Unrevoke” as shown in the screenshot.
Next, right-click on the associated root certificate.
The following dialog box will appear:
You can create a revocation list here using
“CA
Generate CRL
”,
as shown in the screenshot above. Please ensure that
under
“hash algorithm”, you also select MD5. There are
no check boxes to enable for extensions. The CRL must
now be exported, and then imported to the
mbNET
.
