RACOM MG102i, Руководство по эксплуатации

Страница: 144 / 175

Signature The signature algorithm when signing certificates
Passphrase The passphrase for accessing/opening a private key
Please be aware of the fact, that the local random number generator (RNG) provides pretty good ran-
domness for most applications. If stronger cryptography is mandatory, we suggest to create the keys
at an external RNG device or manage all certificates completely on a remote certification server. Nev-
ertheless, using a local certificate authority can issue and manage all required certificates and also run
a certificate revokation list (CRL).
When importing keys, the certificate and key file can be uploaded individually encoded in PEM/DER
or PKCS7 format. All files (CA certificate, certificate and private key) can also be uploaded in one stroke
by using the container format PKCS12. RSA/DSS keys can be converted from OpenSSH or Dropbear
formats. It is possible to specify the passphrase for opening the private key. Please note that the system
will generally apply the system-wide certificate passphrase on a key when installing the certificate.
Thus, changing the general passphrase will result in all local keys getting equipped with the new one.
SCEP Configuration
If certificates are getting enrolled by using the Simple Certificate Enrollment Protocol (SCEP) the fol-
lowing settings can be configured:
SCEP status: Specifies whether SCEP is enabled or not.
URL: The SCEP URL, usually in the form http://<host>/<path>/pkiclient.exe.
CA fingerprint: The fingerprint of the certificate used to identify the remote authority.
If left empty, any CA will be trusted.
Fingerprint algorithm: The fingerprint algorithm for identifying the CA (MD5 or SHA1).
Poll interval: The polling interval in seconds for a certificate request.
MG102iGPRS/UMTS/HSPA+/LTE router – © RACOM s.r.o. 144
Web Configuration