13: Security Settings
PremierWave® XN Intelligent Gateway User Guide
114
OpenSSL
OpenSSL is a widely used open source set of SSL related command line utilities. It can act as
server or client. It can also generate or sign certificate requests, and can convert from and to
several different of formats.
OpenSSL is available in binary form for Linux and Windows.
To generate a self-signed RSA certificate/key combo:
openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout mp_key.pem -
out mp_cert.pem
See
www.openssl.org
or
www.madboa.com/geek/openssl
for more information.
Note:
Signing other certificate requests is also possible with OpenSSL but the details of
this process are outside the scope of this document.
Steel Belted RADIUS
Steel Belted RADIUS is a commercial RADIUS server from Juniper Networks that provides a GUI
administration interface. It also provides a certificate request and self-signed certificate generator.
The self-signed certificate has extension .sbrpvk and is in the PKCS12 format. OpenSSL can
convert this into a PEM format certificate and key:
openssl pkcs12 -in sbr_certkey.sbrpvk -nodes -out sbr_certkey.pem
The sbr_certkey.pem file contains both certificate and key. If loading the SBR certificate into an
PremierWave XN intelligent gateway as an authority, you will need to edit it:
1. Open the file in any plain text editor.
2. Delete all info before
"----- BEGIN CERTIFICATE-----" and after "----- END
CERTIFICATE-----"
, and then save as
sbr_cert.pem
.
SBR accepts trusted-root certificates in the DER format. Again, OpenSSL can convert any format
into DER:
openssl x509 -inform pem -in mp_cert.pem -outform der -out mp_cert.der
Note:
With SBR, when the identity information includes special characters such as
dashes and periods, SBR changes the format it uses to store these strings and becomes
incompatible with the current PremierWave XN intelligent gateway release. Support may
be added for this and other formats in future releases.
Free RADIUS
Free RADIUS is another versatile Linux open-source RADIUS server.
