1. Home
    2. /
  2. Manuals
    3. /
  3. Zyxel
    4. /
  4. P-660R-F1
    5. /
  5. 26
Page 126 / 268 Scroll up to view Page 121 - 125
Chapter 9 Certificates
P-660R-F1 Series User’s Guide
126
certificate that is signed by one of these certification authorities. Click
Security > Certificates >
Trusted CAs
to open the
Trusted CAs
screen.
Figure 75
Trusted CAs
The following table describes the labels in this screen.
Table 45
Trusted CAs
LABEL
DESCRIPTION
PKI Storage
Space in Use
This bar displays the percentage of the ZyXEL Device’s PKI storage space that is
currently in use. The bar turns from blue to red when the maximum is being
approached. When the bar is red, you should consider deleting expired or
unnecessary certificates before adding more certificates.
#
This field displays the certificate index number. The certificates are listed in
alphabetical order.
Name
This field displays the name used to identify this certificate.
Subject
This field displays identifying information about the certificate’s owner, such as
CN (Common Name), OU (Organizational Unit or department), O (Organization
or company) and C (Country). It is recommended that each certificate have
unique subject information.
Issuer
This field displays identifying information about the certificate’s issuing
certification authority, such as a common name, organizational unit or
department, organization or company and country. With self-signed certificates,
this is the same information as in the
Subject
field.
Valid From
This field displays the date that the certificate becomes applicable. The text
displays in red and includes a Not Yet Valid! message if the certificate has not yet
become applicable.
Valid To
This field displays the date that the certificate expires. The text displays in red
and includes an Expiring! or Expired! message if the certificate is about to expire
or has already expired.
Page 127 / 268
Chapter 9 Certificates
P-660R-F1 Series User’s Guide
127
9.3.1
Trusted CA Import
Follow the instructions in this screen to save a trusted certification authority’s certificate to the
ZyXEL Device. Click
Security > Certificates > Trusted CAs
to open the
Trusted CAs
screen and
then click Import to open the
Trusted CA Import
screen.
Note: You must remove any spaces from the certificate’s filename before you can import
the certificate.
Figure 76
Trusted CA Import
The following table describes the labels in this screen.
Table 46
Trusted CA Import
CRL Issuer
This field displays Yes if the certification authority issues Certificate Revocation
Lists for the certificates that it has issued and you have selected the
Issues
certificate revocation lists (CRL)
check box in the certificate’s details screen
to have the ZyXEL Device check the CRL before trusting any certificates issued
by the certification authority. Otherwise the field displays “No”.
Modify
Click the Edit
icon to open a screen with an in-depth list of information about the
certificate.
Click the Remove
icon to remove the certificate. A window displays asking you to
confirm that you want to delete the certificates. Note that subsequent certificates
move up by one when you take this action.
Import
Click this to open a screen where you can save the certificate of a certification
authority that you trust, from your computer to the ZyXEL Device.
Refresh
Click this to display the current validity status of the certificates.
LABEL
DESCRIPTION
LABEL
DESCRIPTION
File Path
Type in the location of the file you want to upload in this field or click
Browse
to find it.
Browse
Click this to find the certificate file you want to upload.
Back
Click this to return to the previous screen without saving.
Apply
Click this to save the certificate on the ZyXEL Device.
Cancel
Click this to restore your previously saved settings.
Page 128 / 268
Chapter 9 Certificates
P-660R-F1 Series User’s Guide
128
9.3.2
Trusted CA Details
Use this screen to view in-depth information about the certification authority’s certificate, change
the certificate’s name and set whether or not you want the ZyXEL Device to check a certification
authority’s list of revoked certificates before trusting a certificate issued by the certification
authority. Click
Security > Certificates > Trusted CAs
to open the
Trusted CAs
screen. Click
the details icon to open the
Trusted CA Details
screen.
Figure 77
Trusted CA Details
The following table describes the labels in this screen.
Table 47
Trusted CA Details
LABEL
DESCRIPTION
Certificate Name
This field displays the identifying name of this certificate. If you want to
change the name, type up to 31 characters to identify this key certificate. You
may use any character (not including spaces).
Property
Issues certificate
revocation lists
(CRLs)
Select this check box to have the ZyXEL Device check incoming certificates
that are issued by this certification authority against a Certificate Revocation
List (CRL).
Clear this check box to have the ZyXEL Device not check incoming certificates
that are issued by this certification authority against a Certificate Revocation
List (CRL).
Page 129 / 268
Chapter 9 Certificates
P-660R-F1 Series User’s Guide
129
Certificate Path
Click the
Refresh
button to have this read-only text box display the end
entity’s certificate and a list of certification authority certificates that shows
the hierarchy of certification authorities that validate the end entity’s
certificate. If the issuing certification authority is one that you have imported
as a trusted certification authority, it may be the only certification authority in
the list (along with the end entity’s own certificate). The ZyXEL Device does
not trust the end entity’s certificate and displays “Not trusted” in this field if
any certificate on the path has expired or been revoked.
Refresh
Click this to display the certification path.
Certificate
Information
These read-only fields display detailed information about the certificate.
Type
This field displays general information about the certificate. CA-signed means
that a Certification Authority signed the certificate. Self-signed means that the
certificate’s owner signed the certificate (not a certification authority).
X.509
means that this certificate was created and signed according to the ITU-T
X.509 recommendation that defines the formats for public-key certificates.
Version
This field displays the X.509 version number.
Serial Number
This field displays the certificate’s identification number given by the
certification authority.
Subject
This field displays information that identifies the owner of the certificate, such
as Common Name (CN), Organizational Unit (OU), Organization (O) and
Country (C).
Issuer
This field displays identifying information about the certificate’s issuing
certification authority, such as Common Name, Organizational Unit,
Organization and Country.
With self-signed certificates, this is the same information as in the
Subject
Name
field.
Signature Algorithm
This field displays the type of algorithm that was used to sign the certificate.
Some certification authorities use rsa-pkcs1-sha1 (RSA public-private key
encryption algorithm and the SHA1 hash algorithm). Other certification
authorities may use rsa-pkcs1-md5 (RSA public-private key encryption
algorithm and the MD5 hash algorithm).
Valid From
This field displays the date that the certificate becomes applicable. The text
displays in red and includes a Not Yet Valid! message if the certificate has not
yet become applicable.
Valid To
This field displays the date that the certificate expires. The text displays in red
and includes an Expiring! or Expired! message if the certificate is about to
expire or has already expired.
Key Algorithm
This field displays the type of algorithm that was used to generate the
certificate’s key pair (the ZyXEL Device uses RSA encryption) and the length of
the key set in bits (1024 bits for example).
Subject Alternative
Name
This field displays the certificate’s owner‘s IP address (IP), domain name
(DNS) or e-mail address (EMAIL).
Key Usage
This field displays for what functions the certificate’s key can be used. For
example, “DigitalSignature” means that the key can be used to sign
certificates and “KeyEncipherment” means that the key can be used to encrypt
text.
Basic Constraint
This field displays general information about the certificate. For example,
Subject Type=CA means that this is a certification authority’s certificate and
“Path Length Constraint=1” means that there can only be one certification
authority in the certificate’s path.
CRL Distribution
Points
This field displays how many directory servers with Lists of revoked certificates
the issuing certification authority of this certificate makes available. This field
also displays the domain names or IP addresses of the servers.
LABEL
DESCRIPTION
Page 130 / 268
Chapter 9 Certificates
P-660R-F1 Series User’s Guide
130
9.4
The Trusted Remote Hosts Screens
This screen displays a list of the certificates of peers that you trust but which are not signed by one
of the certification authorities on the
Trusted CAs
screen. Click
Security > Certificates >
Trusted Remote Hosts
to open the
Trusted Remote Hosts
screen.
You do not need to add any certificate that is signed by one of the certification authorities on the
Trusted CAs
screen since the ZyXEL Device automatically accepts any valid certificate signed by a
trusted certification authority as being trustworthy.
Figure 78
Trusted Remote Hosts
MD5 Fingerprint
This is the certificate’s message digest that the ZyXEL Device calculated using
the MD5 algorithm. You can use this value to verify with the certification
authority (over the phone for example) that this is actually their certificate.
SHA1 Fingerprint
This is the certificate’s message digest that the ZyXEL Device calculated using
the SHA1 algorithm. You can use this value to verify with the certification
authority (over the phone for example) that this is actually their certificate.
Certificate in PEM
(Base-64) Encoded
Format
This read-only text box displays the certificate or certification request in
Privacy Enhanced Mail (PEM) format. PEM uses 64 ASCII characters to convert
the binary certificate into a printable form.
You can copy and paste the certificate into an e-mail to send to friends or
colleagues or you can copy and paste the certificate into a text editor and save
the file on a management computer for later distribution (via floppy disk for
example).
Back
Click this to return to the previous screen without saving.
Export
Click this and then
Save
in the
File Download
screen. The
Save As
screen
opens, browse to the location that you want to use and click
Save
.
Apply
Click this to save your changes. You can only change the name and/or set
whether or not you want the ZyXEL Device to check the CRL that the
certification authority issues before trusting a certificate issued by the
certification authority.
Cancel
Click this to restore your previously saved settings.
LABEL
DESCRIPTION

Rate

4.5 / 5 based on 2 votes.

Popular Zyxel Models

Famous Router IPs
Famous Router Companies
Bookmark Our Site

Press Ctrl + D to add this site to your favorites!

Share
Top