Alteon Application Switch Operating System Application Guide
Offloading SSL Encryption and Authentication
Document ID: RDWR-ALOS-V2900_AG1302
339
•
The identity of the Certificate Authority (CA) and its digital signature to affirm the digital
certificate was issued by a valid authority.
The certificate repository is a secured stronghold of all PKI-related components such as encryption
keys, certificates of different types, and Certificate Signing Requests (CSRs). Certificate components
are required for Alteon to supply SSL offloading services and client authentication. Alteon supports
the X.509 standard for PKIs.
For details on configuring the components of the certificate repository, see the section on the
/cfg/
slb/ssl/certs
menu in the Alteon Application Switch Operating System Command Reference.
Certificate Types in the Certificate Repository
The certificate repository may include the following certificate types:
•
•
Intermediate CA Certificates, page 339
•
Trusted CA Certificates, page 340
Server Certificates
A server certificate is a type of certificate used to identify servers during SSL handshake. For details
on associating server certificates to SSL-based virtual services, see
SSL Offloading Implementation,
. You either import a pre-existing server certificate using the
/cfg/slb/ssl/certs/
import
command, or you can generate your own in Alteon.
When you generate your own server certificate, if an underlying Certificate Signing Request (CSR)
and/or key pair do not already exist by the same name as the server certificate, they are generated
along with the server certificate. The resulting server certificate is a "self-signed" server certificate,
meaning it was issued by the server for itself. This kind of a certificate is good for testing purposes,
as real users will experience various warning messages if used for the real SSL service. In order to
be used in the real-life SSL environment, the server certificate must be issued (signed) by a
Certificate Authority (CA) which is trusted by the client's browsers.
To achieve this, once the certificate's CSR is generated, you must submit it to a trusted Certificate
Authority (CA) for signing. If the request is successful, the CA sends back a certificate that has been
digitally signed by its own key, which you import using the
/cfg/slb/ssl/certs/import
command, ensuring that it is not imported to the same entity name as the CSR.
Intermediate CA Certificates
Intermediate CA certificates are used when the CA providing the virtual service's server certificate is
not directly trusted by the end-user’s Web browsers. This is typical in an organization that has its
own CA server for generating server's certificates. In order to construct the trust chain from the
user’s browser list of trusted CAs to the organization's CA server, an intermediate CA certificate or
chain of certificates can be provided.
You can optionally bind an intermediate Certificate Authority (CA) certificate to the SSL policy (see
). These certificates are not created in Alteon—you must first import them.
You can also create a group of intermediate certificates (a complete CA chain) and bind it to the SSL
policy.
For details on associating an Intermediate CA certificate to an SSL policy, see the section on the
/
cfg/slb/ssl/sslpol
menu in the Alteon Application Switch Operating System Command
Reference.
