7
IPsec VPN
140
CA server access
Certificate
validation
can
be
performed
by
accessing
a
separate
Certificate
Server
(CA)
server.
For
example,
the
two
sides
of
an
IPsec
tunnel
exchange
their
certificates
during
the
tunnel
setup
negotiation
and
either
may
then
try
to
validate
the
received
certificate.
A
certificate
contains
a
Fully
Qualified
Domain
Name
(FQDN),
which
specifies
the
textual
address
of
the
validating
CA
server
as
well
as
the
protocol
used
for
accessing
the
server.
For
example,
server
access
could
require
an
HTTP
request
or
possibly
an
LDAP
request.
CA server types
CA
servers
are
of
two
types:
•
A
commercial
CA
server
operated
by
one
of
the
commercial
certificate
issuing
companies.
These
are
accessible
over
the
public
Internet
and
their
FQDNs
are
resolvable
through
the
public
Internet
DNS
server
system.
•
A
private
CA
server
operated
by
the
same
organization
setting
up
the
VPN
tunnels.
The
IPv4
address
of
a
private
server
will
not
be
known
to
the
public
DNS
system
unless
it
is
explicitly
registered.
It
also
will
not
be
known
to
an
internal
network
unless
it
is
registered
on
an
internal
DNS
server.
For
LTE
scenarios
in
a
telecom
environment,
a
private
CA
server
is
most
often
used
with
server
requests
sent
using
the
LDAP
protocol.
However,
the
protocol
used
is
determined
by
the
settings
within
the
certificate.
Access considerations
Consider
the
following
when
planning
for
successful
CA
server
access:
•
Either
side
of
a
VPN
tunnel
may
issue
a
validation
request
to
a
CA
server.
•
For
a
certificate
validation
request
to
be
issued,
the
FQDN
of
the
certificate's
CA
server
must
first
be
resolved
into
an
IP
address.
The
following
scenarios
are
possible:
1. The
CA
server
is
a
private
server
behind
the
SEG
and
the
tunnels
are
set
up
over
the
public
Internet
to
clients
that
will
not
try
to
validate
the
certificate
sent
by
the
SEG.
In
this
case,
the
IPv4
address
of
the
private
server
needs
to
be
registered
only
on
a
private
DNS
server
so
the
FQDN
can
be
resolved.
This
private
DNS
server
will
also
have
to
be
configured
in
the
SEG
so
it
can
be
found
when
the
SEG
issues
a
validation
request.
This
will
also
be
the
procedure
if
the
tunnels
are
being
set
up
entirely
internally
without
using
the
public
Internet.
