Zyxel ZyWALL-USG50 Router Manual PDF (Setup & Configuration Guide)

Home

Manuals

Zyxel

ZyWALL-USG50

Page 641 / 944 Scroll up to view Page 636 - 640

Chapter 41 Certificates

ZyWALL USG 50 User’s Guide

641

Create a

certification

request and save it

locally for later

manual enrollment

Select this to have the ZyWALL generate and store a request for a

certificate. Use the

My Certificate Details

screen to view the

certification request and copy it to send to the certification authority.

Copy the certification request from the

My Certificate Details

screen (see

Section 41.2.2 on page 643

) and then send it to the

certification authority.

Create a

certification

request and enroll

for a certificate

immediately online

Select this to have the ZyWALL generate a request for a certificate

and apply to a certification authority for a certificate.

You must have the certification authority’s certificate already

imported in the

Trusted Certificates

screen.

When you select this option, you must select the certification

authority’s enrollment protocol and the certification authority’s

certificate from the drop-down list boxes and enter the certification

authority’s server address. You also need to fill in the

Reference

Number

and

Key

if the certification authority requires them.

Enrollment

Protocol

This field applies when you select

Create a certification request

and enroll for a certificate immediately online

. Select the

certification authority’s enrollment protocol from the drop-down list

box.

Simple Certificate Enrollment Protocol (SCEP)

is a TCP-based

enrollment protocol that was developed by VeriSign and Cisco.

Certificate Management Protocol (CMP)

is a TCP-based

enrollment protocol that was developed by the Public Key

Infrastructure X.509 working group of the Internet Engineering Task

Force (IETF) and is specified in RFC 2510.

CA Server Address

This field applies when you select

Create a certification request

and enroll for a certificate immediately online

. Enter the IP

address (or URL) of the certification authority server.

For a URL, you can use up to 511 of the following characters. a-zA-

Z0-9'()+,/:.=?;!*#@$_%-

CA Certificate

This field applies when you select

Create a certification request

and enroll for a certificate immediately online

. Select the

certification authority’s certificate from the

CA Certificate

drop-

down list box.

You must have the certification authority’s certificate already

imported in the

Trusted Certificates

screen. Click

Trusted CAs

go to the

Trusted Certificates

screen where you can view (and

manage) the ZyWALL's list of certificates of trusted certification

authorities.

Table 197

Configuration > Object > Certificate > My Certificates > Add (continued)

LABEL

DESCRIPTION

Page 642 / 944

Chapter 41 Certificates

ZyWALL USG 50 User’s Guide

642

If you configured the

My Certificate Create

screen to have the ZyWALL enroll a

certificate and the certificate enrollment is not successful, you see a screen with a

Return

button that takes you back to the

My Certificate Create

screen. Click

Return

and check your information in the

My Certificate Create

screen. Make

sure that the certification authority information is correct and that your Internet

connection is working properly if you want the ZyWALL to enroll a certificate

online.

Request

Authentication

When you select

Create a certification request and enroll for a

certificate immediately online

, the certification authority may

want you to include a reference number and key to identify you

when you send a certification request.

Fill in both the

Reference Number

and the

Key

fields if your

certification authority uses the CMP enrollment protocol. Just the

Key

field displays if your certification authority uses the SCEP

enrollment protocol.

For the reference number, use 0 to 99999999.

For the key, use up to 31 of the following characters. a-zA-Z0-

9;|`~!@#$%^&*()_+\{}':,./<>=-

Click

to begin certificate or certification request generation.

Cancel

Click

Cancel

to quit and return to the

My Certificates

screen.

Table 197

Configuration > Object > Certificate > My Certificates > Add (continued)

LABEL

DESCRIPTION

Page 643 / 944

Chapter 41 Certificates

ZyWALL USG 50 User’s Guide

643

41.2.2

The My Certificates Edit Screen

Click

Configuration > Object > Certificate > My Certificates

and then the

Edit

icon

to open the

My Certificate Edit

screen. You can use this screen to view

in-depth certificate information and change the certificate’s name.

Figure 368

Configuration > Object > Certificate > My Certificates > Edit

Page 644 / 944

Chapter 41 Certificates

ZyWALL USG 50 User’s Guide

644

The following table describes the labels in this screen.

Table 198

Configuration > Object > Certificate > My Certificates > Edit

LABEL

DESCRIPTION

Name

This field displays the identifying name of this certificate. You can use

up to 31 alphanumeric and ;‘~!@#$%^&()_+[]{}’,.=-

characters.

Certification Path

This field displays for a certificate, not a certification request.

Click the

Refresh

button to have this read-only text box display the

hierarchy of certification authorities that validate the certificate (and

the certificate itself).

If the issuing certification authority is one that you have imported as

a trusted certification authority, it may be the only certification

authority in the list (along with the certificate itself). If the certificate

is a self-signed certificate, the certificate itself is the only one in the

list. The ZyWALL does not trust the certificate and displays “Not

trusted” in this field if any certificate on the path has expired or been

revoked.

Refresh

Click

Refresh

to display the certification path.

Certificate

Information

These read-only fields display detailed information about the

certificate.

Type

This field displays general information about the certificate. CA-signed

means that a Certification Authority signed the certificate. Self-signed

means that the certificate’s owner signed the certificate (not a

certification authority).

“X.509” means that this certificate was

created and signed according to the ITU-T X.509 recommendation

that defines the formats for public-key certificates.

Version

This field displays the X.509 version number. “

Serial Number

This field displays the certificate’s identification number given by the

certification authority or generated by the ZyWALL.

Subject

This field displays information that identifies the owner of the

certificate, such as Common Name (CN), Organizational Unit (OU),

Organization (O), State (ST), and Country (C).

Issuer

This field displays identifying information about the certificate’s

issuing certification authority, such as Common Name, Organizational

Unit, Organization and Country.

With self-signed certificates, this is the same as the

Subject Name

field.

“none” displays for a certification request.

Signature

Algorithm

This field displays the type of algorithm that was used to sign the

certificate. The ZyWALL uses rsa-pkcs1-sha1 (RSA public-private key

encryption algorithm and the SHA1 hash algorithm). Some

certification authorities may use rsa-pkcs1-md5 (RSA public-private

key encryption algorithm and the MD5 hash algorithm).

Valid From

This field displays the date that the certificate becomes applicable.

“none” displays for a certification request.

Valid To

This field displays the date that the certificate expires. The text

displays in red and includes an Expired! message if the certificate has

expired. “none” displays for a certification request.

Page 645 / 944

Chapter 41 Certificates

ZyWALL USG 50 User’s Guide

645

Key Algorithm

This field displays the type of algorithm that was used to generate the

certificate’s key pair (the ZyWALL uses RSA encryption) and the

length of the key set in bits (1024 bits for example).

Subject

Alternative Name

This field displays the certificate owner‘s IP address (IP), domain

name (DNS) or e-mail address (EMAIL).

Key Usage

This field displays for what functions the certificate’s key can be used.

For example, “DigitalSignature” means that the key can be used to

sign certificates and “KeyEncipherment” means that the key can be

used to encrypt text.

Basic Constraint

This field displays general information about the certificate. For

example, Subject Type=CA means that this is a certification

authority’s certificate and

“Path Length Constraint=1” means that

there can only be one certification authority in the certificate’s path.

This field does not display for a certification request.

MD5 Fingerprint

This is the certificate’s message digest that the ZyWALL calculated

using the MD5 algorithm.

SHA1 Fingerprint

This is the certificate’s message digest that the ZyWALL calculated

using the SHA1 algorithm.

Certificate in PEM

(Base-64)

Encoded Format

This read-only text box displays the certificate or certification request

in Privacy Enhanced Mail (PEM) format. PEM uses lowercase letters,

uppercase letters and numerals to convert a binary certificate into a

printable form.

You can copy and paste a certification request into a certification

authority’s web page, an e-mail that you send to the certification

authority or a text editor and save the file on a management

computer for later manual enrollment.

You can copy and paste a certificate into an e-mail to send to friends

or colleagues or you can copy and paste a certificate into a text editor

and save the file on a management computer for later distribution

(via floppy disk for example).

Export

This button displays for a certification request. Use this button to save

a copy of the request without its private key. Click this button and

then

Save

in the

File Download

screen. The

Save As

screen opens,

browse to the location that you want to use and click

Save

Export Certificate

Only

Use this button to save a copy of the certificate without its private

key. Click this button and then

Save

in the

File Download

screen.

The

Save As

screen opens, browse to the location that you want to

use and click

Save

Password

If you want to export the certificate with its private key, create a

password and type it here. Make sure you keep this password in a

safe place. You will need to use it if you import the certificate to

another device.

Export Certificate

with Private Key

Use this button to save a copy of the certificate with its private key.

Type the certificate’s password and click this button. Click

Save

in the

File Download

screen. The

Save As

screen opens, browse to the

location that you want to use and click

Save

Table 198

Configuration > Object > Certificate > My Certificates > Edit

LABEL

DESCRIPTION

Rate

Popular Zyxel Models

Famous Router IPs

Famous Router Companies

Bookmark Our Site

Share