Juniper NETWORK AND SECURITY MANAGER, Руководство пользователя

Страница: 204 / 340

Table 47: Secure Access Manual CA Certificate Configuration Details
Your Action Function Option
Settings tab
Enter a subject name for the certificate. Specifies the CA
certificate subject
name. Subject
Select one of the following options:
• None — Specifies that the device should not
validate this trusted client certificate.
• Use OCSP (Online Certificate Status
Protocol)
— Specifies that the device should
use the OCSP method, validating the client
certificate in real-time, as needed. After you
select this option, you can specify options
for OCSP.
• Use CRLs (Certificate Revocation Lists) —
Specifies that the device should use CRLs
to validate the client certificate. After you
select this option, you can specify options
for CRL.
• Use OCSP with CRL fallback —Specifies that
the device should use the OCSP validation
method when possible, but attempt to
validate client certificates using CRLs should
the OCSP method fail (for example, if the
link to the OCSP Responder fails). After you
select this option, you can specify options
for both CRL and OCSP.
Specifies the method
the device uses to
verify client
certificate status. Client certificate status
checking
Select the check box. Specifies if you want
the device to
validate the CRL
from which the
certificate is issued. Verify Trusted Client CA
Select the check box.
NOTE: If you added this certificate for
nonauthentication purposes (such as for SAML
signature verification or machine certificate
validation), disable this option. This indicates
that the device must not trust any client
certificate issued by this CA.
Specifies if you want
the device to trust
this certificate when
authenticating client
certificates. Trusted for Client
Authentication?
Copyright © 2010, Juniper Networks, Inc. 186
Configuring Secure Access Devices Guide