Users Guide

Certificate Expiration Alert
The certificate expiration alert sends alerts when installed certificates, which correspond to trust chains, OCSP
responder certificates, and any other certificates installed on the device. By default, the system sends this alert
60 days before the expiration of the installed credentials. This alert is then repeated periodically on a weekly or
biweekly basis. This alerts consist of two SNMP traps:
l wlsxCertExpiringSoon
l wlsxCertExpired
Chained Certificates on the RAP
Chained certificates on the RAP (that is, certificates from a multi-level PKI) need to be in a particular order inside
the file. The RAP’s certificate must be first, followed by the certificate chain in order, and then followed by the
private key for the certificate. For example, with a root CA, a single intermediate CA, and a root CA, the PEM or
PKCS12 file must contain the following parts, in this order:
1. RAP Certificate
2. Intermediate CA
3. Root CA
4. Private key
If this order is not followed, certificate validation errors occur. This order also applies to server certificates.
Support for Certificates on USB Flash Drives
This release now supports storing RAP certificates in a USB device. This ensures that the RAP certificate is
activated only when the USB with the corresponding certificate is connected to the RAP. If the USB is removed
from the RAP, the RAP certificate is deactivated and when the USB is connected to the RAP it acts a storage
device and not as a 3G/4G RAP.
The RAP supports only PKCS12-encoded certificates that are present in the USB. This certificate contains all the
information that is required for creating the tunnel including the private key, RAP certificate with the chain of
certificates, and the trusted CA certificate. There is a limit of three supported intermediate CAs.
Ensure you adhere to the following file naming guidelines when you are saving the certificate:
l The first twelve characters of the certificate file name should be the RAP's MAC address. For example, if
RAP’s eth0 MAC address is 00:0b:86:c2:00:6c, then the file name will be 000B86C2006C.P12 or
000B86C2006C_rap155.p12
l All alphabets of the MAC address in the file name should be in upper case.
l The file name can have additional characters after the MAC address separated by "_" for the purpose of
identification.
If this naming convention is not followed an error will occur during certificate validation.
Follow the steps below to configure the USB certificate store:
1. Copy the PKCS12 certificate bundle to a USB device.
2. Enter a name for the certificate using the correct naming convention as mentioned above.
In the USB connected to the RAP, delete any duplicate <mac-address>.p12 certificate file. Only one such file must be
present in the USB.
If you unplug the USB device the RAPwill become unresponsive. Reboot the RAP to bring it up with a custom
certificate, if the USB device was unplugged.
Dell Networking W-Series ArubaOS 6.5.x | User Guide Management Access | 850