168 ServerIron ADX Security Guide
53-1002440-03
Advanced SSL profile configuration
6
•A certificate issued by a CA that is trusted by the server
•A key-pair for the certificate
The certificate and the key can be obtained from the CA in either PKCS or PEM format. For
client-authentication to work, these items must be uploaded to the ServerIronADX and then added
to the server profile.
For example, if you use si_client_cert.pem as the certificate and si_client_key.pem as the key for
the client certificate, you can add them to the profile using the following commands:
ServerIronADX(config)# ssl profile serverProfile
ServerIronADX(config-ssl-profile-serverProfile)# keypair-file si_client_key.pem
ServerIronADX(config-ssl-profile-serverProfile)# certificate-file
si_client_cert.pem
Configuring a CA certificate file
If you have enabled client certificate verification, you must configure a CA certificate under the SSL
profile. CA certificates are used by the ServerIronADX to verify the validity of certificates presented
by incoming clients.
CA certificates are typically imported from outside using SCP, in PEM format and are stored in the
flash memory, just like regular certificate files.
Up to four CA certificate files can be specified under each SSL profile. Each CA certificate file can
contain multiple CA certificates (although to keep configurations simple, We recommend that
different CA certificates be stored in different files).
You can include up to 32 DN names for all root or intermediate CA certificates. This allows clients to
select appropriate CA and intermediate CA certificates for communication with a ServerIronADX.
Unlike regular certificates, there is no need to load the corresponding key pair into the profile
before configuring a CA certificate since the CA certificate belongs to the Certificate Signing
Authority, meaning the key pair is private and not be publicly available. The following example
specifies the CA certificate file named "certfile1" for SSL profile "profile1".
ServerIronADX(config)# ssl profile profile1
ServerIronADX(config-ssl-profile-profile1)# ca-cert-file certfile1
Syntax: ca-cert-file <ca-certificate-filename>
The <ca-certificate-filename> variable specifies the name of the certificate file where a CA
certificate is stored.
NOTE
You can optionally disable certificate verification as described in “Disabling certificate verification”
on page 171.
Creating a certificate revocation list
Certificate revocation lists contain the list of certificates that have been revoked by a CA. A
certificate can be revoked by a CA for many reasons. A common reason is that the key pair that
corresponds to the issued certificate has been compromised.
Certificate revocation lists are typically maintained on the CA Web site and may be downloaded
using HTTP. The format of the list is usually DER or PEM.