Watchguard Firebox X20E, Руководство пользователя

Страница: 163 / 310

User Guide 151
Using Microsoft CA to Create a Certificate
4
When you are prompted for the x509 Common Name attribute information, type your fully-
qualified domain name (FQDN). Use other information as appropriate.
5
Follow the instructions from your certificate authority to send the CSR.
To create a temporary, self-signed certificate until the CA returns your signed certificate, type a the
command line:
openssl x509 -req -days 30 -in request.csr -key privkey.pem -out sscert.cert
This command creates a certificate inside your current directory that expires in 30 days.
You cannot use a self-signed certificate for VPN remote gateway authentication. We recommend that you
use certificates signed by a trusted third-party Certificate Authority.
Using Microsoft CA to Create a Certificate
Certification Authority is distributed with Windows Server 2003 as a component. If the Certification
Authority is not installed in the Administrative Tools folder of the Control Panel, follow the manufac-
turer’s instructions for installation.
When you use this procedure, you act as the certificate authority (CA) and digitally sign your own
request. For the final certificate to be useful, we recommend that you acquire other certificates that
connect your private CA to a widely trusted, third-party certificate authority. You can import these
additional certificates on the Firebox X Edge Certificates page.
Sending the certificate request
1
Open your web browser. In the location or address bar, type the IP address of the server where
the Certification Authority is installed, followed by
certsrv .
Example: http://10.0.2.80/certsrv
2
Click the Request a Certificate link.
3
Click the advanced certificate request link.
4
To submit a CSR you created using OpenSSL, click the Submit a certificate link.
5
Paste the contents of your CSR file into the Saved Request text box.
The CSR must be in Base-64 PKCS10 or PKCS7 format.
6
Close your web browser.
Issuing the certificate
1
Connect to the server where the Certification Authority is installed, if necessary.
2
From the Start Menu, select Control Panel > Administrative Tools > Certification Authority .
3
From the Certification Authority (Local) tree in the left navigation pane, select Your Domain
Name > Pending Requests .
4
Select the CSR in the right navigation pane.
5
From the Action menu, select All Tasks > Issue .
6
Close the Certification Authority window.