Obtaining Digital Certificates - HP 7102dl - ProCurve Secure Router Configuration Manual

Obtaining Digital Certificates

First, select a CA server.
If your CA server supports SCEP, you must complete three steps to load the
necessary certificates into the ProCurve Secure Router's operating system:
1. Create a CA profile.
2. Load the CA certificate.
3. Generate a self certificate request.
If your CA server does not support SCEP, you must complete four steps to
load the certificates manually:
1. Create a CA profile.
2. Load the CA certificate.
3. Generate a self certificate request.
4. Import a self certificate and CRL. The CRL, which lists certificates issued
to hosts and when they expire, allows the router to determine whether a
peer's certificate is still valid.
These are only the steps you need to complete on the ProCurve Secure Router.
For manual loading, you will also need to download the CA certificate from
your CA server, submit the request for a self certificate to the server, and
download the self certificate and CRL. This guide assumes that the certificates
necessary for each step are ready to be copied and pasted into the CLI.
Creating a CA Profile. You must configure a profile for a CA before you
can load its certificate into the system. Create a CA profile from the global
configuration mode context:
Syntax: crypto ca profile <profile name>
For example:
ProCurve(config)# crypto ca profile MyCA
ProCurve(ca-profile)#
In the CA's profile, you must configure the enrollment method.
If the ProCurve Secure Router will automatically load your certificates using
SCEP, you should input the URL for your CA server's Web site:
Syntax: enrollment url [http://<FQDN>]/[<client program name>]
Virtual Private Networks
Configuring a VPN Using IPSec
10-57