Managing Key Pairs And Digital Certificates - Canon imageRUNNER 2545i System Settings Manual

Managing Key Pairs and Digital Certificates

The machine can take advantage of key pairs and digital certificates for security
purposes, such as IEEE802.1X port-based authentication and SSL communication.
After key pairs and digital certificates are installed in the machine, register them for
use as described below.
The key pairs and digital certificates registered in the machine are divided into the
following types:
3
■ Key and Certificate
In IEEE802.1X port-based authentication, a key pair (or a private key and
certificate) in PKCS#12 format is required for enabling the EAP-TLS method on
the client device. If you want to access the machine securely from a web browser
(Remote UI) or send/receive e-mails and I-faxes securely, generate a key pair
and set it for SSL communications. Up to three key pairs can be registered.
■ CA Certificate
CA certificates are used for verifying the digital certificates sent from other
devices, such as servers, client computers, etc. Up to 10 CA certificates
(including the pre-installed CA certificates) can be registered.
IMPORTANT
• Certificates must meet the following requirements:
- Format: X.509 version 1 or version 3 (DER encoded binary)
- Signature algorithm: SHA1-RSA, SHA256-RSA, SHA384-RSA*, SHA512-RSA*,
- Key length: 512, 1024, 2048, or 4096 bits (RSA)/2048 or 3072 bits (DSA)
- File extension: '.p12' or '.pfx' (for key pair files)/'.cer' or '.der' (for CA certificate files)
* SHA384-RSA and SHA512-RSA are supported only when the key length is 1024 bits or more.
• The machine does not use certificate revocation list (CRL) for verifying digital
certificates.
NOTE
• Key pairs and digital certificates can be installed from a web browser (Remote UI).
(See Chapter 2, "Managing Jobs and Machine Data," in the Remote UI Guide.)
• Key pairs and digital certificates can be registered both with the control panel and from
a web browser (Remote UI).
3-20

Managing Key Pairs and Digital Certificates

MD5-RSA, or MD2-RSA (For CA certificates, SHA1-DSA is also allowed.)