HPE FlexNetwork 10500 Series Security Configuration Manual page 9

Displaying and maintaining keychain ············································································································· 277
Keychain configuration example ···················································································································· 277
Network requirements ···························································································································· 277
Configuration procedure ························································································································· 278
Verifying the configuration ······················································································································ 279
Managing public keys ················································································ 283
Overview ························································································································································ 283
FIPS compliance ············································································································································ 283
Creating a local key pair································································································································· 283
Distributing a local host public key ················································································································· 285
Exporting a host public key ···················································································································· 285
Displaying a host public key ··················································································································· 285
Destroying a local key pair ····························································································································· 286
Configuring a peer host public key ················································································································· 286
Importing a peer host public key from a public key file ·········································································· 286
Entering a peer host public key ·············································································································· 287
Displaying and maintaining public keys ········································································································· 287
Examples of public key management ············································································································ 287
Example for entering a peer host public key ·························································································· 287
Example for importing a public key from a public key file ······································································ 289
Configuring PKI ························································································· 292
Overview ························································································································································ 292
PKI terminology ······································································································································ 292
PKI architecture ······································································································································ 293
PKI operation ········································································································································· 293
PKI applications ····································································································································· 294
Support for MPLS L3VPN ······················································································································ 294
FIPS compliance ············································································································································ 295
PKI configuration task list ······························································································································· 295
Configuring a PKI entity ································································································································· 295
Configuring a PKI domain ······························································································································ 296
Requesting a certificate·································································································································· 298
Configuration guidelines ························································································································· 298
Configuring automatic certificate request ······························································································· 299
Manually requesting a certificate············································································································ 299
Aborting a certificate request ························································································································· 300
Obtaining certificates······································································································································ 300
Configuration prerequisites ···················································································································· 300
Configuration guidelines ························································································································· 301
Configuration procedure ························································································································· 301
Verifying PKI certificates ································································································································ 301
Verifying certificates with CRL checking ································································································ 302
Verifying certificates without CRL checking ··························································································· 302
Specifying the storage path for the certificates and CRLs ············································································· 303
Exporting certificates ······································································································································ 303
Removing a certificate···································································································································· 304
Configuring a certificate-based access control policy ···················································································· 304
Displaying and maintaining PKI ····················································································································· 305
PKI configuration examples ··························································································································· 306
Requesting a certificate from an RSA Keon CA server·········································································· 306
Requesting a certificate from a Windows Server 2003 CA server ························································· 309
Requesting a certificate from an OpenCA server··················································································· 312
IKE negotiation with RSA digital signature from a Windows Server 2003 CA server ···························· 315
Certificate-based access control policy configuration example······························································ 318
Certificate import and export configuration example ·············································································· 319
Troubleshooting PKI configuration ················································································································· 325
Failed to obtain the CA certificate ·········································································································· 325
Failed to obtain local certificates ············································································································ 325
Failed to request local certificates ·········································································································· 326
Failed to obtain CRLs ····························································································································· 327
vii