How Pki Operates; Configuring Pki; Recommended Configuration Procedure For Manual Request - HP 1910 User Manual

Secure email
Emails require confidentiality, integrity, authentication, and non-repudiation. PKI can address these
needs. The secure email protocol that is developing rapidly is Secure/Multipurpose Internet Mail
Extensions (S/MIME), which is based on PKI and allows for transfer of encrypted mails with signature.
Web security
For Web security, two peers can establish a Secure Sockets Layer (SSL) connection first for transparent
and secure communications at the application layer. With PKI, SSL enables encrypted communications
between a browser and a server. Both the communication parties can verify the identity of each other
through digital certificates.

How PKI operates

In a PKI-enabled network, an entity can request a local certificate from the CA and the device can check
the validity of certificate. The following describes how it operates:
An entity submits a certificate request to the CA.
1.
The RA verifies the identity of the entity and then sends the identity information and the public key
2.
with a digital signature to the CA.
The CA verifies the digital signature, approves the application, and issues a certificate.
3.
The RA receives the certificate from the CA, sends it to the LDAP server to provide directory
4.
navigation service, and notifies the entity that the certificate is successfully issued.
The entity retrieves the certificate. With the certificate, the entity can communicate with other
5.
entities safely through encryption and digital signature.
The entity makes a request to the CA when it needs to revoke its certificate. The CA approves the
6.
request, updates the CRLs and publishes the CRLs on the LDAP server.

Configuring PKI

The device supports the following PKI certificate request modes:
Manual—In manual mode, you need to retrieve a CA certificate, generate a local RSA key pair,
•
and submit a local certificate request for an entity.
• Auto—In auto mode, an entity automatically requests a certificate through the Simple Certification
Enrollment Protocol (SCEP) when it has no local certificate or the present certificate is about to
expire.
You can specify the PKI certificate request mode for a PKI domain. Different PKI certificate request modes
require different configurations.

Recommended configuration procedure for manual request

397