70
MDS Orbit MCR-4G Technical Manual
MDS 05-6628A01, Rev. B
Certificate Management
Understanding
The unit uses X.509 public certificates and private keys for the following services:
·
Secure Reprogramming
·
Syslog over TLS
·
IPsec VPN/IMA (when using pub-key, EAP-TLS or EAP-TTLS based authentication)
·
WiFi (when doing EAP-TLS authentication in station mode)
Certificates can be loaded into the device using one of two methods: manual or SCEP. Note that
certificates for secure reprogramming can only be loaded using the manual method.
The unit can load certificates that are in DER, PEM, or Encrypted PEM format. The unit can load private
keys that are in DER, PEM, Encrypted PEM, or PKCS#8 format.
Configuring
From either operational or configuration mode, requests can be made on the device related to
certificate management. Using the Tab character after entering 'request pki' shows a list of the
available requests.
admin@(none) 05:04:37> request pki
Possible completions:
cancel-scep-operation - Cancel the last SCEP operation initiated.
delete-cacert
- Delete identified CA certificate
delete-clientcert
- Delete identified Client certificate
delete-firmware-cert - Delete identified certificate
delete-priv-key
- Delete identified Private Key
generate-priv-key
-
get-ca-cert
- Request the certmgr to retrieve a CA cert from store.
get-client-cert
- Request the certmgr to retrieve a client cert from
store.
get-firmware-cert
- Install a certificate to be used for firmware
validation
get-priv-key
- Retrieve private key file from network or local file
system.
show-cert-info
- Dump identified certificate as text to display
Manual Download of Security Material
The ‘get’ series of requests allow security material to be downloaded from the network. The specifics
of the communication can either be defined in the request or a server can be preconfigured
separately (see section on “File Servers”) and used in the request.
To manually load certificates from a file server, the following requests must be used:
·
get-cacert – To load CA certificates
·
get-clientcert – To load device/client certificates
·
get-firmware-certificate – To load firmware verification certificates
·
get-priv-key – To load device/client private key
