Nortel BSR252, Configuration - Basics

Page: 262 / 460

262 Chapter 14 Certificates
NN47923-500
The Business Secure Router uses certificates based on public-key cryptology to
authenticate users attempting to establish a connection, not to encrypt the data that
is sent after establishing a connection. The method used to secure the data that is
sent through an established connection depends on the type of connection. For
example, a VPN tunnel can use the triple DES encryption algorithm.
The certification authority uses its private key to sign certificates. Anyone can use
the certification authority’s public key to verify the certificates.
A certification path is the hierarchy of certification authority certificates that
validate a certificate. The Business Secure Router does not trust a certificate if any
certificate on its path has expired or been revoked.
Certification authorities maintain directory servers with databases of valid and
revoked certificates. A directory of certificates that have been revoked before the
scheduled expiration is called a CRL (Certificate Revocation List). The Business
Secure Router can check a peer’s certificate against a list of revoked certificates
on a directory server. The framework of servers, software, procedures, and
policies that handles keys is called PKI (public-key infrastructure).
Advantages of certificates
Certificates offer the following benefits:
• The Business Secure Router only has to store the certificates of the
certification authorities that you decide to trust, no matter how many devices
you need to authenticate.
• Key distribution is simple and very secure because you can freely distribute
public keys and you never need to transmit private keys.
Self-signed certificates
Until public-key infrastructure becomes more mature, it is not available in some
areas. You can have the Business Secure Router act as a certification authority
and sign its own certificates.