X.509
An X.509 certificate is a digital certificate that uses the widely accepted
international X.509 public key infrastructure (PKI) standard to verify that a
public key belongs to the user, computer or service identity contained within
the certificate. Universal Hub uses X.509 certificates as its OpenVPN
authentication method. A set of X.509 certificates must be set up correctly
for the OpenVPN service to be working properly.
All the necessary certificate and key files must be generated in advance.
The easiest way to achieve this is to use Easy-RSA software tool, which is
available in both Linux and Windows OS (users can search online or refer to
relevant RFI/Maxon Application Notes for more details).
The files request by an OpenVPN server include:
ca.crt
dh2048.pem
server.crt,
server.key
ta.key
- only required if TLS protocol is in use
The certificates for an OpenVPN client must be created based on the server
CA and the files include:
ca.crt
client.crt,
client.key
ta.key
- only required for TLS protocol is in use
Certificate Revocation Lists (CRL) can also be part of certificates but not
critical.
Once all the files are generated properly, they can be imported into the
device via the X.509 set up page. Maximum 10 set of certificates can be
imported into the router and each of them can be used by one of the
OpenVPN tunnel depending on its VPN type (server or client).
