NetModule NB2800 - Page 196

NB2800
User Manual for NRSW version 4.5.0.100
Parameter Certificate Configuration
Country (C) The certificate owner’s country (usually a TLD abbreviation)
Common Name (CN) The certificate owner’s common name, mainly used to identify a host
E-Mail The certificate owner’s email address
Expiry period The number of days a certificate will be valid from now on
Key size The length of the private key in bits
DH primes The number of bits for custom Diffie-Hellman primes
Signature The signature algorithm when signing certificates
Passphrase The passphrase for accessing/opening a private key
Please be aware of the fact, that the local random number generator (RNG) provides pretty good
randomness for most applications. If stronger cryptography is mandatory, we suggest to create the
keys at an external RNG device or manage all certificates completely on a remote certification server.
Nevertheless, using a local certificate authority can issue and manage all required certificates and also
run a certificate revokation list (CRL).
When importing keys, the certificate and key file can be uploaded individually encoded in PEM/DER
or PKCS7 format. All files (CA certificate, certificate and private key) can also be uploaded in one
stroke by using the container format PKCS12. RSA/DSS keys can be converted from OpenSSH or
Dropbear formats. It is possible to specify the passphrase for opening the private key. Please note
that the system will generally apply the system-wide certificate passphrase on a key when installing
the certificate. Thus, changing the general passphrase will result in all local keys getting equipped with
the new one.
SCEP Configuration
If certificates are getting enrolled by using the Simple Certificate Enrollment Protocol (SCEP) the
following settings can be configured:
Parameter SCEP Configuration
SCEP status Specifies whether SCEP is enabled or not
URL The SCEP URL, usually in the form
http://<host>/<path>/pkiclient.exe
CA fingerprint The fingerprint of the certificate used to identify the remote authority.
If left empty, any CA will be trusted.
Fingerprint algorithm The fingerprint algorithm for identifying the CA (MD5 or SHA1)
Poll interval The polling interval in seconds for a certificate request
Request timeout The max. polling time in seconds for a certificate request
ID type Can be IP, Email or DNS
Password The password for the scep server.
196