Teleorigin RBMTX-Lite, User Manual

Page: 39 / 70

The CA certificate is generated:
openssl req -new -x509 -days 365 -key private/cakey.pem -out cacert.pem
When creating a certificate user has to provide some information like country,
state/province, city, company name, e-mail address and common name. The last field is most
important, it has to be unique for every device.
After creating CA certificate generation of certificate for every device used is needed.
At first the private key is generated:
openssl genrsa -des3 -out private/device1key.pem
Then we generate certificate request:
openssl req -new -key private/device1key.pem -out device1req.pem
Here user has to enter country, state etc. again. They can be the same as before except
the common name.
Certificate authority signs the certificate:
openssl ca -notext -in device1req.pem -out device1cert.pem
If certificate will be used on RBMTX-Lite modem, password on private key has to be disabled:
openssl rsa -in private/device1key.pem -out private/device1key.pem_nopass
The whole process is repeated for every device (unique common names and filenames
have to be unique for different devices!).
If IPsec protocol will be used, certain fields in www configuration under Ipsec/Tunnels
tab have to be filled in. Content of
device1cert.pem
file should be pasted into the Certificate
field and contents of device1key
.
pem_nopass into the Key field. Peer Certificate field can be
filled with another device's certificate file or left empty. In this case the CA certificate has to be
provided under Keys and Certificates tab. Contents of
cacert.pem
file should be inserted
there.
If the OpenVPN protocol will be used, under OpenVPN tab content of
cacert.pem
has to
be pasted into CA cert field, content of device1cert.pem into Server/Client cert field and
device1key.pem_nopass into Server/Client private key field. The Diffie- Hellman parameters
file has to be created for VPN connection:
openssl dhparam -out dh1024.pem 1024
And its content should be copied into DH PEM field. This file is common for all devices
in VPN network.