At first we need to create folder, in which all our keys and certificates will be stored.
Let's say it will be ~/keys. We create two files in it: list of certificates and file enumerating
them:
touch index.txt
echo 00 > serial
and subdirectories, where the certificates and keys will be stored:
mkdir private certs newcerts crl
In order to create certificates, the certificate authority (CA) is needed . It is ,,main''
certificate used to create other certificates. After creating private CA key:
openssl genrsa -des3 -out private/cakey.pem 1024
Warning:
please remember the CA password!
The CA certificate is generated:
openssl req -new -x509 -days 365 -key private/cakey.pem -out cacert.pem
When creating a certificate user has to provide some information like country,
state/province, city, company name, e-mail address and common name. The last field is most
important, it has to be unique for every device.
After creating CA certificate generation of certificate for every device used is needed.
At first the private key is generated:
openssl genrsa -des3 -out private/device1key.pem
Then we generate certificate request:
openssl req -new -key private/device1key.pem -out device1req.pem
Here user has to enter country, state etc. again. They can be the same as before except
the common name.
Certificate authority signs the certificate:
openssl ca -notext -in device1req.pem -out device1cert.pem
If certificate will be used on MTX modem, password on private key has to be disabled:
openssl rsa -in private/device1key.pem -out private/device1key.pem_nopass
The whole process is repeated for every device (unique common names and filenames
have to be unique for different devices!).
If IPsec protocol will be used, certain fields in www configuration under Ipsec/Tunnels
tab have to be filled in. Content of
device1cert.pem
file should be pasted into the Certificate
field and contents of
device1key
.
pem_nopass
into the Key field. Peer Certificate field can be
filled with another device's certificate file or left empty. In this case the CA certificate has to be
provided under Keys and Certificates tab. Contents of
cacert.pem
file should be inserted
there.
If the OpenVPN protocol will be used, under OpenVPN tab content of
cacert.pem
has to
be pasted into CA cert field, content of
device1cert.pem
into Server/Client cert field and
device1key.pem_nopass
into Server/Client private key field. The Diffie- Hellman parameters
file has to be created for VPN connection:
openssl dhparam -out dh1024.pem 1024
And its content should be copied into DH PEM field. This file is common for all devices
in VPN network.
29
Summary of Contents for RB-MTX
Page 1: ...1...
Page 7: ...2 General presentation 2 1 Front panel 2 2 Back panel 7...
Page 25: ...25...
Page 54: ...FME SMA converter FMA connector male 54...
Page 56: ...9 2 4 IO cable 9 2 5 RS232 486 cable 56...
