Ca Certificate Requests - D-Link DFL-1660 User Manual

3.8.3. CA Certificate Requests

3.8.3. CA Certificate Requests
To request certificates from a CA server or CA company, the best method is to send a CA
Certificate Request which is a file that contains a request for a certificate in a well known,
predefined format.
Manually Creating Windows CA Server Requests
The NetDefendOS Web Interface (WebUI) does not currently include the ability to generate
certificate requests that can be sent to a CA server for generation of the .cer and .key files required
by NetDefendOS.
It is possible, however, to manually create the required files for a Windows CA server using the
following stages.
• Create a gateway certificate on the Windows CA server and export it as a file in the .pfx format.
• Convert the .pfx file into the .pem format.
• Take out the relevant parts of the .pem file to form the required .cer and .key files.
The detailed steps for the above stages are as follows:
1. Create the gateway certificate on the Windows CA server and export it to a .pfx file on the
local NetDefendOS management workstation disk.
2. Now convert the local .pfx file to a .pem file. This can be done with the OpenSSL utility using
the console command line:
> openssl pkcs12 -in gateway.pfx -out gateway.pem -nodes
In this command line example, the file exported from the CA server is assumed to be called
gateway.pfx and it is assumed to be in the same local directory as the OpenSSL executable.
The original gateway.pfx file contained 3 certificates: CA root certificate, a personal certificate
and a private key certificate. The gateway.pem file now contains these in format which can be
cut and pasted with a text editor.
3. Create two blank text files with a text editor, such as Windows Notepad. Give the files the
same filename but use the extension .cer for one and .key for the other. For example,
gateway.cer and gateway.key might be the names.
4. Start a text editor and open the downloaded .pem file and locate the line that begins:
-----BEGIN RSA PRIVATE KEY-----
5. Mark and copy into the system clipboard that line and everything under it, up to and including
the line:
-----END RSA PRIVATE KEY-----
6. Now paste the copied text into the .key file and save it.
Note
OpenSSL is being used here as a conversion utility and not in its normal role as a
communication utility.
154
Chapter 3. Fundamentals