Versions Compared

Old Version 2

changes.mady.by.user Ribbon Communications

Saved on

compared with

New Version Current

changes.mady.by.user Ribbon Communications

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.


Panel

In this section:

Table of Contents
maxLevel3



Multiexcerpt
MultiExcerptNameCertificate Types

The Public Key Infrastructure (PKI) provides a common set of infrastructure features supporting public key and certificate-based authentication based on the RSA public/private key pairs and X.509 digital certificates.

Certificate Types

Local-Internal Certificates

In previous 

Spacevars
0product
versions, the RSA key pairs and Certificate Signing Request (CSR) for
Spacevars
0product
platforms were generated on an external workstation. The CSR was then submitted to a Certificate Authority, and the resulting certificate was received back from the CA, copied onto the workstation, and combined with the private key in a PKCS#12 file which was used to install the key pair and certificate onto the
Spacevars
0product
.

The 

Spacevars
0product
application can now generate and install RSA key pairs and generate Certificate Signing Request (CSR) on the 
Spacevars
0product
system itself. The certificate request is sent to a CA, and the issued certificate is then installed on the
Spacevars
0product
. The local-internal certificate option simplifies the certificates and keys managing process and also provides more security since the private key never leaves the
Spacevars
0product
. For steps to configure local-internal certificates, see Generating PKI Certificates.

Certificate file format: PEM

Local Certificates

Local certificates are credentials belonging to the local system itself, which it presents to peers in order to prove their identity. You must upload local certificate files in PKCS#12 format to the system before installing the certificates. For Cloud

Spacevars
0product
 plaftorms, you must upload the local certificate files to both the active and standby nodes.

Certificate file format: PKCS#12

Remote Certificates

Remote certificates are credentials belonging to Certificate Authorities (CA). The copies of these certificates are installed in the

Spacevars
0product
 because they are either part of a chain of certificates the local system will present to peers, or because the corresponding CAs are trust anchors for the local system. You should also install certificates belonging to non-CA remote systems as trust anchors in this manner. You must upload remote certificate files in DER format to the system before installing the remote certificates. For Cloud
Spacevars
0product
 plaftorms, you must upload the remote certificate files to both the active and standby nodes.

The Certificate Authority (CA) certificates and trusted remote certificates contain public key certificates; they do not contain the private keys. The CA certificates and remote certificates are Distinguished Encoding Rules (DER) format files; a method for encoding a data object (such as an X.509 certificate) which uses a digital signature to bind together a public key with an identity.

Certificate file format: DER


Include Page
Max_Nbr_TLS_Certs
Max_Nbr_TLS_Certs

Info
titleNote

Ensure that the DER content of the certificate you install is less than 6400 bytes.

Command Syntax

Set Command Syntax

Code Block
languagenone
% set system security pki certificate <certificate name>
	fileName <1-255 characters>
	passPhrase <pass phrase>
	state <disabled | enabled>
	type <local | local-internal | remote>

% show system security pki
 
% delete system security pki

Request Command Syntax

Multiexcerpt include
MultiExcerptNamesecurity_syntax
nopaneltrue
PageWithExcerptRequest System - CLI

Command Parameters

Info
titleNote

The subjectAlternativeDnsNames field limit is 4096 characters.

Set Parameters

Caption
0Table
1set system security Parameters


Parameter

Description

certificate

<certificate name> – The collection of certificates configured on the SBC.

fileName

<filename> – Certificate content filename in the format:

  • Local-Internal: PEM
  • Local: PKCS#12
  • Remote: DER

passPhrase

Specifies the pass-phrase to decrypt RSA private key in PKCS#12 file.

Note: The passPhrase is limited to 23 characters.

state

Administration state of this certificate. Options are:

  • disabled – Prohibits the PKI certificate from being used by the 
    Spacevars
    0product
     for authenticating remote peers (when this is a remote certificate) OR presenting its own identity (in case of a local or local-internal certificate).
  • enabled – Certificate can be used by 
    Spacevars
    0product
     for authentication purposes.
Note

The certificate must first be installed on the 

Spacevars
0product
before enabling it.


type

Specifies the certificate type – CA (remote) certificate or local certificate. Options are:

  • local – Certificate belongs to (has as its subject) the local system itself; the key pair and CSR were generated elsewhere.
  • local-internal – Certificate belongs to (has as its subject) the local system itself; the key pair and CSR were generated on this machine.
  • remote – Certificate belongs to (has as its subject) a remote entity such as a  CA or peer device.

Request Parameters

Multiexcerpt include
MultiExcerptNamesecurity_parameters
nopaneltrue
PageWithExcerptRequest System - CLI

Command Examples

Example configuration for local and remote certificate types:

Code Block
% set system security pki certificate SBC_LOCAL fileName sbc_server.p12 passphrase CertPassSecret type local state enabled
% set system security pki certificate COMPANY_CA filename company_ca.der type remote state enabled
% commit

% show system security pki certificate SBC_LOCAL
state      enabled;
fileName   sbc_server.p12;
passPhrase $7$pedr0+bl4Mq95P0ITV/idUlmqRL4xUWR;
type       local;

% show system security pki certificate COMPANY_CA
state    enabled;
filename company_ca.der;
type     remote;


Example configuration for local-internal certificate type:

Code Block
% set system security pki certificate test3 type local-internal
% commit

% request system security pki certificate test3 generateCSR csrSub /C=US/ST=MA/L=Westford/O=Ribbon/CN=swe03.ribbon.com keySize keySize2K

After receiving the signed certificate from CA, you can configure the local-internal certificate from a PEM file, or copy-paste the PEM file content (importCert certContent).


Code Block
% set system security pki certificate test3 fileName test3.pem state enabled
% commit
 
% request system security pki certificate test3 importCert certContent

Value for 'certContent' (<string, min: 0 chars, max: 4096 chars>):

[Multiline mode, exit with ctrl-D.]

> -----BEGIN CERTIFICATE-----

MIIDrzCCAxGgAwIBAgIJAOW6z3FjlVbjMAoGCCqGSM49BAMDMEsxCzAJBgNVBAYT

...

Import certificate success.

% set system security pki certificate test3 state enabled
% commit


Pagebreak