Managing Certificates - NETGEAR FVS336Gv1 - ProSafe Dual WAN Gigabit Firewall Reference Manual

ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN FVS336G Reference Manual
4. Click Apply to save your settings or Cancel to return to your previous settings.
Note: The password and time-out value you enter will be changed back to password
and 10 minutes, respectively, after a factory defaults reset.

Managing Certificates

The VPN firewall uses Digital Certificates (also known as X509 Certificates) during the Internet
Key Exchange (IKE) authentication phase to authenticate connecting VPN gateways or clients, or
to be authenticated by remote entities. The same Digital Certificates are extended for secure web
access connections over HTTPS.
Digital Certificates can be either self signed or can be issued by Certification Authorities (CA)
such as via an in-house Windows server, or by an external organization such as Verisign or
Thawte.
However, if the Digital Certificates contain the extKeyUsage extension then the certificate must be
used for one of the purposes defined by the extension. For example, if the Digital Certificate
contains the extKeyUsage extension defined to SNMPV2 then the same certificate cannot be used
for secure web management.
The extKeyUsage would govern the certificate acceptance criteria in the VPN firewall when the
same digital certificate is being used for secure web management.
In the VPN firewall, the uploaded digital certificate is checked for validity and also the purpose of
the certificate is verified. Upon passing the validity test and the purpose matches its use (has to be
SSL and VPN) the digital certificate is accepted. The additional check for the purpose of the
uploaded digital certificate must correspond to use for VPN and secure web remote management
via HTTPS. If the purpose defined is for VPN and HTTPS then the certificate is uploaded to the
HTTPS certificate repository and as well in the VPN certificate repository. If the purpose defined
is only for VPN then the certificate is only uploaded to the VPN certificate repository. Thus,
certificates used by HTTPS and IPSec will be different if their purpose is not defined to be VPN
and HTTPS.
The VPN firewall uses digital certificates to authenticate connecting VPN gateways or clients, and
to be authenticated by remote entities. A certificate that authenticates a server, for example, is a
file that contains:
• A public encryption key to be used by clients for encrypting messages to the server.
• Information identifying the operator of the server.
Managing Users, Authentication, and Certificates
v1.0, January 2010
7-11