HP 250m Print Server for Fast Ethernet, 250m Print Server - Fast Ethernet manual

Page 87

Figure 40 - OU

Here the Common Name is the FQDN of Jetdirect but there is additional information provided in the Organizational Units (OU). This same approach could be used for server farms where there would be several certificates with the same FQDN but differing in their OU values so that they will have separate public/private key pairs and provide better security over a single private key distributed to many servers. However, if the customer is cost sensitive to new SSL certificates, they may wish to take the risk on the private key being stored on multiple machines.

With Virtual Hosting, you have the opposite problem: Many names but only one IP address. This causes a lot of grief, especially for those customers that have problems with getting a valid IP address as well as those who are cost sensitive and require SSL certificates that can be used on the Internet. Here is an example: Let’s assume that you are running a garage sale site on the Internet that allows clients to sign up and sell the stuff they don’t need that is taking up space in their garage. Each user gets their own domain name. You want to use SSL to provide security. For instance, if the site is “example.com” at 192.168.0.250, each user would have something like this:

•hsimpson.example.com maps to 192.168.0.250

•msimpson.example.com maps to 192.168.0.250

•bsimpson.example.com maps to 192.168.0.250

Each person gets their own SSL certificate that has the SubjectAlternativeName set to their corresponding FQDN. Unfortunately, when “msimpson” and “bsimpson” try to use HTTPS,

87

Image 87

Contents Introduction WhitepaperHttp Application What is SSL/TLS?Application Changes Https DecodedHttp Session More Info Https Session Lock Icon Certificate Details IE6 Security Alert Digital CertificatesIE7 Certificate Error IE7 Certificate Error Certificate Information Public Key Infrastructure and Public Key Certificate BasicsSymmetric Cryptography Asymmetric Cryptography Digital Signature Digital Signature Verification Certificate Authority Public Key Certificates Self-Signed Certificate SSL/TLS Protocol Structures SSL/TLS Protocol BasicsClient Hello Server Hello Server Certificate Verification Keying Material Client Finished Server Finished Using Https with HP JetdirectCA Heirarchy Network Diagram Page Page Under the heading Jetdirect Certificate, press Configure… Page Page Page Page Page Page Page Page Page Page Page Save it Go to Tools and click Internet Options Click Certificates Click Import… Click Next Select the file Click Next Page Page Page Page Page Detailed Look at the SSL/TLS Connection Page Page Page Page Check for server certificate revocation is not selected Page Page SSL/TLS Server Settings HP Jetdirect as an SSL/TLS Client Page Page Page Page Select R2 and hit Export… Click Next Select DER. Click Next Save it Save it Click Finish Page Select the file. Click Finish Click OK Page Same message. What did we do wrong? Page Page We use the DNS name and try again Success Page CA Hierarchy SSL/TLS Client Understanding Certificate ChainsPage RootCA Incorrect HP Jetdirect CA Configuration Correct HP Jetdirect CA Configuration Walking the Chain SSL/TLS Client Certificates and Name Verification Subject SubjectAltName Page Page Page IPP over SSL/TLS Click Next Select a network printer… Page Page Print a test Yep we have our print data protected by SSL/TLS Embedded Devices and Digital Certificates HP Jetdirect Certificate GuidelinesSummary Which HP Jetdirect Products Support SSL/TLS?