206
In the IPSec configuration it is possible to import a peer's public
key. So it is still possible to authenticate it, even though its
certificate has been issued by a different CA. There's no such
option for OpvenVPN based connections.
If you don't use the VPN server of SX-GATE or if you authenticate VPN connections
by preshared keys or specific public keys only, this area is not effective.
Delete second trusted CA certificate
After all peers were migrated to the new CA, you can delete the old CA here.
Set a new trusted CA
Here you can specify, which CA will be the trusted CA for the SX-GATE VPN server.
You can copy the public key of the local SX-GATE CA, import the public key of a CA
in PEM format or extract it from a PKCS#12 file.
Delete trusted CA certificate
You can terminate the trust relationship with the specified CA here. After the trusted
CA key has been deleted, VPN connections will no longer be accepted if the presented
X.509 certificate was issued by the formerly trusted CA. As an exception, a connection
will still be accepted if the public key of the peer was imported into SX-GATE for
authentication purposes.
Import certificate revocation list
Here you can install the recent certificate revocation list (CRL) of the trusted CA. A CRL
offer the possibility to invalidate a certificate already before it expires. This is useful if
for example an employee leaves the company and VPN access has to be denied. You
can copy the CRL of the local SX-GATE CA or import a CRL file in PEM format.
The CRL must have been issued by the trusted CA. Otherwise
it is not considered.
Copy local CA revocation list to VPN server
If SX-GATE's VPN server uses certificates issued by its own CA, you can transfer the
current certificate revocation list (CRL) into the VPN server here. A CRL offers the
possibility to invalidate a certificate before it expires. This is useful if for example an
employee leaves the company and VPN access has to be denied.
