Digi Connect WAN Series User Manual page 149

Digi Connect WAN Family web interface
Security type
Secure Shell (SSHv2)
Behavior of SSH/SSL private keys on Digi device
Digi devices generate their SSH/SSL self-signed private keys automatically. While this automatic
generation is convenient for device users, as they are not required perform any actions regarding the
private keys, it presents some security loopholes.
With self-signed private keys, you must establish trust in a secure environment. That is, if you
n
cannot guarantee that the environment is secure, you must pull the private keys off the Digi
device.
You must know about the certificate before you connect, as opposed to third-party signed
n
certificates, where you only need the third-party certificate.
The length of a Digi device's self-signed private keys is 1024 bits. While this length is adequate
n
for 99.9% of all applications, some people or applications prefer a shorter or longer key.
Using TFTP to load and store certificate information
Use TFTP to load and store PEM-formatted certificates into the certificate and private key
management tables.
Using HTTP/HTTPS to transfer certificate and key data
You can use HTTP or HTTPS to transfer certificate and private key data on a web browser.
Data retained after factory reset
When you reset a Digi device to factory defaults, it retains certificates and private key data loaded
onto it.
Certificate management settings
There are separate pages of settings for the certificate databases and key management for
certificates and key data for the different types of security implementations.
Certificate Authorities (CAs) / Certificate Revocation Lists (CRLs)
Upload CAs and CRLs
Use this section to upload and manage certificate authority (CA) certificates, or certificate revocation
list (CRL) files. You can install up to 8 CA certificates and up to 8 CA revocations. You can also obtain CA
certificates from a SCEP server. You can install up to 8 SCEP CA certificates.
You an use files in ASN.1 DER or PEM Base64 encoded formats. Click Choose File and type or browse to
the name of the file to upload. Click the Upload button to upload the file.
Digi Connect WAN Family User Guide
Table Used to load
SSH Host Keys SSHv2 identity private keys. Used for
Table authentication with SSHv2 clients and secure
key exchange. A default 1024-bit DSA key is
generated automatically if none exists when the
device boots. There is no certificate for SSHv2,
just private key data.
Administration
149