Avaya 3050-VM, Руководство пользователя, Страница: 93 / 274

Note:
When using an ASA 310-FIPS running in FIPS mode, the private key associated with a
certificate cannot be imported. All private keys must be generated on the HSM card itself
due to the FIPS security requirements.
There are two ways to install a key and certificate into the VPN Gateway :
• Copy-and-paste the key/certificate.
• Download the key/certificate from a TFTP/FTP/SCP/SFTP server.
The VPN Gateway supports importing certificates and keys in these formats:
• PEM
• NET
• DER
• PKCS7 (certificate only)
• PKCS8 (keys only, used in WebLogic)
• PKCS12 (also known as PFX)
Besides these formats, keys in the proprietary format used in MS IIS 4 can be imported by the
VPN Gateway, as wells as keys from Netscape Enterprise Server or iPlanet Server. Importing
keys from Netscape Enterprise Server or iPlanet Server however, require that you first use a
conversion tool. For more information about the conversion tool, contact Avaya. See Customer
service on page 16 for contact information.
When it comes to exporting certificates and keys from the VPN Gateway, you can specify to
save in the PEM, NET, DER, or PKCS12 format when using the
export
command. If you
choose to use the
display
command (which requires a copy-and-paste operation), you are
restricted to saving certificates and keys in the PEM format only.
Note:
When performing a copy-and-paste operation to add a certificate or key, you must always
use the PEM format.
Copy-and-Paste Certificates
The following steps demonstrate how to add a certificate using the copy-and-paste method.
Note:
If you connect to one of the VPN Gateways in the cluster by using a console connection,note
that HyperTerminal under Microsoft Windows may be slow to complete copy-and-paste
operations. If your security policy permits enabling Telnet or SSH access to the VPN
Gateway, use a Telnet or SSH client and connect to the Management IP address instead.
Adding Certificates to the AVG
User Guide April 2013 93