Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

TechLibrary
Navigation
Table of Contents
Guide That Contains This Content
[+] Expand All
[-] Collapse All

    Digital Certificates Configuration Overview

    You can obtain CA and local certificates manually, or online using the Simple Certificate Enrollment Protocol (SCEP). Certificates are verifiable and renewable, and you can delete them when they are no longer needed.

    Junos OS Release 8.5 and earlier support only manual certificate requests. This process includes generation of a PKCS10 request, submission to the CA, retrieval of the signed certificate, and manually loading of the certificate into the Juniper Networks device.

    Automatic sending of certificate requests through SCEP is supported only in Junos OS Release 9.0 or later.

    To use a digital certificate to authenticate your identity when establishing a secure VPN connection, you must first do the following:

    • Obtain a CA certificate from which you intend to obtain a local certificate, and then load the CA certificate onto the device. The CA certificate can contain a CRL to identify invalid certificates.
    • Obtain a local certificate from the CA whose CA certificate you have previously loaded, and then load the local certificate in the device. The local certificate establishes the identity of the Juniper Networks device with each tunnel connection.

    This topic includes the following sections:

    Enabling Digital Certificates Online: Configuration Overview

    SCEP uses the online method to request digital certificates. To obtain a certificate online:

    1. Generate a key pair on the device. See Example: Generating a Public-Private Key Pair.
    2. Create a CA profile or profiles containing information specific to a CA. See Example: Configuring a CA Profile.
    3. Enroll the CA certificate. See Enrolling a CA Certificate Online Using SCEP.
    4. Enroll the local certificate from the CA whose CA certificate you have previously loaded. See Example: Enrolling a Local Certificate Online Using SCEP.
    5. Configure automatic reenrollment. See Example: Using SCEP to Automatically Renew a Local Certificate.

    Manually Generating Digital Certificates: Configuration Overview

    To obtain digital certificates manually:

    1. Generate a key pair on the device. See Example: Generating a Public-Private Key Pair.
    2. Create a CA profile or profiles containing information specific to a CA. See Example: Configuring a CA Profile.
    3. Generate the CSR for the local certificate and send it to the CA server. See Example: Manually Generating a CSR for the Local Certificate and Sending it to the CA Server.
    4. Load the certificate onto the device. See Example: Loading CA and Local Certificates Manually.
    5. Configure automatic reenrollment. See Example: Using SCEP to Automatically Renew a Local Certificate.
    6. If necessary, load the certificate's CRL on the device. See Example: Manually Loading a CRL onto the Device.
    7. If necessary, configure the CA profile with CRL locations. See Example: Configuring a Certificate Authority Profile with CRL Locations
     

    Related Documentation

     

    Published: 2012-06-29

    Previous Page Next Page