Using OpenSSL Certificates with HP-UX IPSec A.03.00

ManualsBrandsHP ManualsSoftwareHP-UX Identity Management Integration Software

Introduction......................................................................................................................................... 2

Related Documentation ..................................................................................................................... 2

Configuration Overview ....................................................................................................................... 2

Initializing the OpenSSL CA.................................................................................................................. 2

Creating the CRL ................................................................................................................................. 3

(Optional) Adding the CA Certificate and CRL to an LDAP Directory .......................................................... 4

Creating Host Certificates ..................................................................................................................... 4

Loading the Host Certificate, CA Certificate and CRL ............................................................................... 5

Configuring a cron job to retrieve the CRL........................................................................................... 7

Configuring IPSec Policies, IKE Policies and Authentication Records........................................................... 7

Verifying the Certificate Configuration.................................................................................................... 7

Summary of content (8 pages)

PAGE 1
Using OpenSSL Certificates with HP-UX IPSec A.03.00 Introduction......................................................................................................................................... 2 Related Documentation ..................................................................................................................... 2 Configuration Overview .......................................................................................................................
PAGE 2
Introduction This document provides information on using HP-UX IPSec versions A.03.00 and later with OpenSSL certificates for IKE primary authentication. This document also describes how to store and retrieve OpenSSL Certificate Revocation Lists (CRLs) using local files or an LDAP (Lightweight Directory Access Protocol) server. A CRL contains a list of revoked (invalid) certificates. HP-UX IPSec uses the CRL to verify that a remote system's certificate is valid during IKE primary authentication.
PAGE 3
o In the section [ policy_match ], configure the stateOrProvinceName and emailAddress parameters as follows: stateOrProvinceName = optional emailAddress = optional HP-UX IPSec does not support state names or mail addresses in the subject field of certificates or CSRs. The above configuration enables the OpenSSL server to accept CSRs without these attributes. 2. Initialize the environment for the CA.
PAGE 4
3. Transfer the CRL to the IPsec hosts or store the CRL in an LDAP directory as described in “(Optional) Adding the CA Certificate and CRL to an LDAP Directory.” Note: To revoke an OpenSSL certificate, use the command openssl –ca revoke cert_file. Refer to the ca(1) manpage for more information. (Optional) Adding the CA Certificate and CRL to an LDAP Directory You can add the CA certificate and CRL to an LDAP directory and use ipsec_config to retrieve them from the LDAP directory.
PAGE 5
TIP: The –alt-nnn arguments specify values for the certificate’s subjectAlternativeName field. The HP recommends that you specify the -alt-ipv4 argument for most topologies. HPUX IPSec uses IP addresses for IKE IDs by default, so if you specify -alt-ipv4 and the system has only one IP address (the system is not multihomed), you will not have to specify the local ID in authentication records on the local system, and you will not have to configure an authentication record for this system on remote systems.
PAGE 6
To load the CA certificate from a file, use the ipsec_config add cacert -file command. For example: ipsec_config add cacert –file cacert.pem To load the CA certificate from an LDAP directory, use the ipsec_config add cacert -ldap command. For example: ipsec_config add cacert –ldap myDirSrv \ –base ou=lab,o=example,c=us \ -filter cn=pki-ca 3. Load the CRL. To load the CRL from a file, use the ipsec_config add crl -file command. For example: ipsec_config add crl –file crl.
PAGE 7
To load the CRL from an LDAP directory, use the ipsec_config add crl -ldap command. For example: ipsec_config add crl –ldap myDirSrv \ –base ou=lab,o=example,c=us \ -filter cn=pki-ca Configuring a cron job to retrieve the CRL HP-UX IPSec provides the script /var/adm/ipsec/util/crl.cron to retrieve the CRL from an LDAP directory. You can configure a cron job to use this script to periodically retrieve the CRL from the LDAP directory. For more information, see the HP-UX IPSec A.03.00 Administrator’s Guide.
PAGE 8
Copyright  2009 Hewlett-Packard Development Company L.P. Confidential computer software. Valid license from HP required for possession, use or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license. The information contained herein is subject to change without notice.