7
IPsec VPN
131
Association with tunnels
The
association
between
a
tunnel
and
certificates
is
created
using
the
LocalID
property
of
the
IPsec
tunnel.
The
tunnel’s
LocalAuthMethod
property
should
be
set
to
Certificate
(by
default,
this
also
becomes
the
value
for
RemoteAuthMethod
,
although
the
two
could
be
set
differently).
The
LocalID
value
specified
for
a
tunnel
is
matched
with
the
Subject
or
Subject
Alternative
Name
fields
in
the
available
certificates.
If
more
than
one
certificate
provide
a
LocalID
match,
the
first
matching
certificate
is
used.
Manually creating Windows CA server requests
To
request
certificates
from
a
CA
server
or
CA
company,
the
best
method
is
to
send
a
CA
Certificate
Request
which
is
a
file
that
contains
a
request
for
a
certificate
in
a
well
known,
predefined
format.
It
is
possible
to
manually
create
the
required
files
for
a
Windows
CA
server
using
the
following
stages.
•
Create
a
gateway
certificate
on
the
Windows
CA
server
and
export
it
as
a
file
in
the
.pfx
format.
•
Convert
the
.pfx
file
into
the
.pem
format.
•
Take
out
the
relevant
parts
of
the
.pem
file
to
form
the
required
.cer
and
.key
files.
The
detailed
steps
for
the
above
stages
are
as
follows:
1. Create
the
gateway
certificate
on
the
Windows
CA
server
and
export
it
to
a
.pfx
file
on
the
local
SEG
management
workstation
disk.
2. Now
convert
the
local
.pfx
file
to
a
.pem
file.
This
can
be
done
with
the
OpenSSL
utility
using
the
CLI:
>
openssl
pkcs12
‐
in
gateway.pfx
‐
out
gateway.pem
‐
nodes
In
this
command
line
example,
the
file
exported
from
the
CA
server
is
assumed
to
be
called
gateway.pfx
and
it
is
assumed
to
be
in
the
same
local
directory
as
the
OpenSSL
executable.
The
original
gateway.pfx
file
contained
3
certificates:
CA
root
certificate,
a
personal
certificate
and
a
private
key
certificate.
The
gateway.pem
file
now
contains
these
in
format
that
can
be
cut
and
pasted
with
a
text
editor.
Note:
OpenSSL
is
being
used
here
as
a
conversion
utility
and
not
in
its
normal
role
as
a
communication
utility.
3. Create
two
blank
text
files
with
a
text
editor,
such
as
Windows
Notepad.
Give
the
files
the
same
filename
but
use
the
extension
.cer
for
one
and
.key
for
the
other.
For
example,
gateway.cer
and
gateway.key
might
be
the
names.
4. Start
a
text
editor
and
open
the
downloaded
.pem
file
and
locate
the
line
that
begins:
‐‐‐‐‐
BEGIN
RSA
PRIVATE
KEY
‐‐‐‐
