HP FlexNetwork NJ5000, Руководство пользователя

Страница: 339 / 475

327
6.
The entity makes a request to the CA when it needs to revoke its certificate. The CA approves
the request, updates the CRLs and publishes the CRLs on the LDAP server.
PKI applications
The PKI technology can satisfy the security requirements of online transactions. As an infrastructure,
PKI has a wide range of applications. Here are some application examples.
•
VPN
—A VPN is a private data communication network built on the public communication
infrastructure. A VPN can leverage network layer security protocols (for example, IPSec) in
conjunction with PKI-based encryption and digital signature technologies to achieve
confidentiality.
•
Secure email
—Emails require confidentiality, integrity, authentication, and non-repudiation.
PKI can address these needs. The secure email protocol that is developing rapidly is S/MIME,
which is based on PKI and allows for transfer of encrypted mails with signature.
•
Web security
—For Web security, two peers can establish an SSL connection first for
transparent and secure communications at the application layer. With PKI, SSL enables
encrypted communications between a browser and a server. Both the communication parties
can verify the identity of each other through digital certificates.
Recommended configuration procedures
The device supports the following PKI certificate request modes:
•
Manual
—In manual mode, you need to manually retrieve a CA certificate, generate a local RSA
key pair, and submit a local certificate request for an entity.
•
Auto
—In auto mode, an entity automatically requests a certificate through the SCEP when it
has no local certificate or the present certificate is about to expire.
You can specify the PKI certificate request mode for a PKI domain. Different PKI certificate request
modes require different configurations.
Recommended configuration procedure for manual request
Step Remarks
1.
Creating a PKI entity
Required.
Create a PKI entity and configure the identity information.
A certificate is the binding of a public key and the identity information of an
entity, where the distinguished name (DN) shows the identity information
of the entity. A CA identifies a certificate applicant uniquely by an entity
DN.
The DN settings of an entity must be compliant to the CA certificate issue
policy. Otherwise, the certificate request might be rejected. You must
know the policy to determine which entity parameters are mandatory or
optional.
2.
Creating a PKI domain
Required.
Create a PKI domain, setting the certificate request mode to
Manual
.
Before requesting a PKI certificate, an entity needs to be configured with
some enrollment information, which is called a PKI domain.
A PKI domain is intended only for convenience of reference by other
applications like IKE and SSL, and has only local significance.
3.
Generating an RSA key
pair
Required.
Generate a local RSA key pair.