Specifications

Manage Users, Authentication, and VPN Certificates
320
ProSAFE Gigabit Quad WAN SSL VPN Firewall SRX5308
Manage Digital Certificates for VPN Connections
• VPN Certificates Screen
• Manage VPN CA Certificates
• Manage VPN Self-Signed Certificates
• Manage the VPN Certificate Revocation List
The VPN firewall uses digital certificates (also known as X509 certificates) during the Internet
Key Exchange (IKE) authentication phase to authenticate connecting IPSec VPN gateways
or clients, or to be authenticated by remote entities:
• On the VPN firewall, you can enter a digital certificate on the IKE Policies screen, on
which the certificate is referred to as an RSA signature (see Figure 159 on page 233 and
Authentication Method on page 236).
• On the VPN Client, you can enter a digital certificate on the
Authentication pane in the
Configuration Panel screen (see
Figure 146 on page 222).
Digital certificates are extended for secure web access connections over HTTPS (that is, SSL
connections).
Digital certificates either can be self-signed or can be issued by certification authorities (CAs)
such as an internal Windows server or an external organization such as Verisign or Thawte.
However, if the digital certificate contains the extKeyUsage extension, the certificate needs to
be used for one of the purposes defined by the extension. For example, if the digital
certificate contains the extKeyUsage extension that is defined for SNMPv2, the same
certificate cannot be used for secure web management.
The extKeyUsage would govern the
certificate acceptance criteria on the VPN firewall when the same digital certificate is being
used for secure web management.
On the VPN firewall, the uploaded digital certificate is checked for validity and purpose. The
digital certificate is accepted when it passes the validity test and the purpose matches its use.
The check for the purpose needs to correspond to its use for IPSec VPN, SSL VPN, or both.
If the defined purpose is for IPSec VPN and SSL VPN, the digital certificate is uploaded to
both the IPSec VPN certificate repository and the SSL VPN certificate repository
. However
, if
the defined purpose is for IPSec VPN only, the certificate is uploaded only to the IPSec VPN
certificate repository.
The VPN firewall uses digital certificates to authenticate connecting VPN gateways or clients,
and to be authenticated by remote entities. A digital certificate that authenticates a server
, for
example, is a file that contains the following elements:
• A public encryption key to be used by clients for encrypting messages to the server.
• Information identifying the operator of the server.
• A digital signature confirming the identity of the operator of the server. Ideally
, the
signature is from a trusted third party whose identity can be verified.
You can obtain a digital certificate from a well-known commercial certification authority (CA)
such as Verisign or Thawte, or you can generate and sign your own digital certificate.