In this section:
The Public Key Infrastructure (PKI) provides a common set of infrastructure features supporting public key and certificate-based authentication based on the RSA public/private key pairs and X.509 digital certificates. In previous SBC versions, the RSA key pairs and Certificate Signing Request (CSR) for SBC platforms were generated on an external workstation. The CSR was then submitted to a Certificate Authority, and the resulting certificate was received back from the CA, copied onto the workstation, and combined with the private key in a PKCS#12 file which was used to install the key pair and certificate onto the SBC. The SBC application can now generate and install RSA key pairs and generate Certificate Signing Request (CSR) on the SBC system itself. The certificate request is sent to a CA, and the issued certificate is then installed on the SBC. The local-internal certificate option simplifies the certificates and keys managing process and also provides more security since the private key never leaves the SBC. For steps to configure local-internal certificates, see Generating PKI Certificates. Certificate file format: PEM Local certificates are credentials belonging to the local system itself, which it presents to peers in order to prove their identity. You must upload local certificate files in PKCS#12 format to the system before installing the certificates. For Cloud SBC plaftorms, you must upload the local certificate files to both the active and standby nodes. Certificate file format: PKCS#12 Remote certificates are credentials belonging to Certificate Authorities (CA). The copies of these certificates are installed in the SBC because they are either part of a chain of certificates the local system will present to peers, or because the corresponding CAs are trust anchors for the local system. You should also install certificates belonging to non-CA remote systems as trust anchors in this manner. You must upload remote certificate files in DER format to the system before installing the remote certificates. For Cloud SBC plaftorms, you must upload the remote certificate files to both the active and standby nodes. The Certificate Authority (CA) certificates and trusted remote certificates contain public key certificates; they do not contain the private keys. The CA certificates and remote certificates are Distinguished Encoding Rules (DER) format files; a method for encoding a data object (such as an X.509 certificate) which uses a digital signature to bind together a public key with an identity. Certificate file format: DERCertificate Types
Local-Internal Certificates
Local Certificates
Remote Certificates
The SBC supports a maximum of 4,096 TLS certificates/CAs (both local and remote).
The SBC allows importing of a single certificate in a single file only. If a CA provides a .p12 or a .pfx certificate bundle with multiple CA certificates in it, extract the certificates from the bundle, store them in separate files, and import them separately.
The DER content of the certificate being installed must be under 6400 Bytes.
% set system security pki certificate <certificate name> fileName <1-255 characters> passPhrase <pass phrase> state <disabled | enabled> type <local | local-internal | remote> % show system security pki % delete system security pki
% request system security eventLogValidation deleteUserPrivateKey generateDefaultKeys setUserPrivateKey <uniqueUserPrivateKeyName> <userPrivateKey> showPublicKey <default/user> generateSipHeaderEncryptionKeys pki certificate <certificate name> generateCSR csrSub (max 255 chars) keySize (keySize1K | keySize2K | keySizeEcDsaSecp521rl) subjectAlternativeDnsName (0-512 chars) importCert certContent (max 4096 chars) retrieveCertContent uploadCertificate
The subjectAlternativeDnsNames
field limit is 4096 characters.
Parameter | Description |
---|---|
|
|
| <
|
| Specifies the pass-phrase to decrypt RSA private key in PKCS#12 file. Note: The |
| Administration state of this certificate. Options are:
The certificate must first be installed on the SBC before enabling it. |
| Specifies the certificate type – CA (remote) certificate or local certificate. Options are:
|
Example configuration for local
and remote
certificate types:
% set system security pki certificate SBC_LOCAL fileName sbc_server.p12 passphrase CertPassSecret type local state enabled % set system security pki certificate COMPANY_CA filename company_ca.der type remote state enabled % commit % show system security pki certificate SBC_LOCAL state enabled; fileName sbc_server.p12; passPhrase $7$pedr0+bl4Mq95P0ITV/idUlmqRL4xUWR; type local; % show system security pki certificate COMPANY_CA state enabled; filename company_ca.der; type remote;
Example configuration for local-internal
certificate type:
% set system security pki certificate test3 type local-internal % commit % request system security pki certificate test3 generateCSR csrSub /C=US/ST=MA/L=Westford/O=Ribbon/CN=swe03.ribbon.com keySize keySize2K
After receiving the signed certificate from CA, you can configure the local-internal certificate from a PEM file, or copy-paste the PEM file content (importCert certContent).
% set system security pki certificate test3 fileName test3.pem state enabled % commit % request system security pki certificate test3 importCert certContent Value for 'certContent' (<string, min: 0 chars, max: 4096 chars>): [Multiline mode, exit with ctrl-D.] > -----BEGIN CERTIFICATE----- MIIDrzCCAxGgAwIBAgIJAOW6z3FjlVbjMAoGCCqGSM49BAMDMEsxCzAJBgNVBAYT ... Import certificate success. % set system security pki certificate test3 state enabled % commit