Configuring Digital Certificates Using The Offline Method - Juniper JUNOSE 11.2.X IP SERVICES Configuration Manual

Configuring Digital Certificates Using the Offline Method

Copyright © 2010, Juniper Networks, Inc.
The length of the public key can be 1024 bits or 2048 bits, and the format conforms to
the RSA standard defined in RFC 3447—Public-Key Cryptography Standards (PKCS) #1:
RSA Cryptography Specifications Version 2.1 (February 2003).
The public key consists of three components:
Abstract Syntax Notation 1 (ASN.1) header information
RSA public key modulus
RSA public key exponent
In the following example of a 1024-bit public key, the first portion of the key (shown in
bold typeface) represents the ASN.1 header information. The second portion of the key
(shown in regular typeface) represents the RSA public key modulus. The third portion of
the key (shown in bold typeface) represents the RSA public key exponent.
30819F30 0D06092A 864886F7 0D010101 05000381 8D003081 89028181 00A7E43C
3E2D399F 34EF6E16 F84464A9 8A145997 CC7F34C8 3DFF8216 57780FE9 D5CE2717
86239050 7A331044 EBA90120 EC13A78D C1B24285 333A9193 D94A59C8 492D8CB9
A46403A4 37461E00 768CF45C 580211AC 72793764 51E3AB3C F9A6665E 562E3681
F120405E 30235690 6FC093AA EB0FE956 51C38EE1 54D81E40 7687C387 07020301
0001
For more information about the format of an RSA public key and about ASN.1 syntax,
see RFC 3447—Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography
Specifications Version 2.1 (February 2003).
To use the offline method to set up digital certificates on the router:
Generate RSA key pairs.
1.
host1(config)#ipsec key generate rsa 2048
Please wait.................................................
..........................
IPsec Generate Keys complete
In your IKE policy, set the authentication method to RSA signatures.
2.
host1(config)#ipsec ike-policy-rule 1
host1(config-ike-policy)#authentication rsa-sig
host1(config-ike-policy)#exit
host1(config)#
NOTE: For more information about setting up IKE policies, see "Defining an IKE Policy"
on page 148 in "Configuring IPSec" on page 119.
Enter IPSec Identity Configuration mode.
3.
host1(config)#ipsec identity
host1(config-ipsec-identity)#
Specify the information that the router uses to generate a certificate request.
4.
a. Specify a country name.
Chapter 8: Configuring Digital Certificates
213