Managing Certificates For Authentication - Cisco Small Business Pro SA 520W Administration Manual

Administration

Managing Certificates for Authentication

Managing Certificates for Authentication
Cisco SA 500 Series Security Appliances Administration Guide
Digital Certificates (also known as X509 Certificates), are used to authenticate the
identity of users and systems, and are issued by Certification Authorities (CAs)
such as such as VeriSign, Thawte and other organizations. Digital Certificates are
used by this router during the Internet Key Exchange (IKE) authentication phase as
an alternative authentication method. Self certificates are issued to you by various
CAs. You create and manage certificates from the Authentication (Certificates)
page.
• Trusted Certificates (CA Certificate): Used to verify the validity of
certificates generated and signed by the CA. The Trusted Certificates table
contains the certificates for each CA and includes this information:
- CA Identity (Subject Name): The organization or person to whom the
certificate is issued.
- Issuer Name: The name of the CA that issued the certificate.
- Expiry Time: The date after which the certificate becomes invalid.
• Active Self Certificates: Lists the certificates issued to you by a trusted CA
and are available for use by the remote IKE servers. The remote IKE server
validates the router by using these certificates. To use a self certificate you
must first request a certificate from the CA and then download and activate
the certificate on your system. The Active Self Certificates table for each
certificate includes this information:
- Name. Name used to identify this certificate.
- Subject Name. Name which other organizations will see as the holder
(owner) of this certificate. Enter the registered business name or official
company name.
- Serial Number: Serial number maintained by the CA and used for
identification purposes.
- Issuer Name: Name of the CA that issued the certificate.
- Expiry Time: Date on which the certificate expires. It is advisable to
renew the certificate before it expires.
• Certification Signing Request (CSR): Contains all the information required
to create your digital certificate including the contact information, the
common name for which the signed certificate is issued, and the public key
of the server that will use the certificate. The Certificate Signing Request
table lists the name of the certificates you request and the certificate status.
9
206