A P P E N D I X C - Requesting a Certificate

A P P E N D I X C

Requesting a Certificate

Once you have generated a certificate request using the SSL proxy blade and also have exported the request to a file, it needs to be sent to a Certificate Authority (CA) so that a certificate will be issued. The process of obtaining a certificate is referred to as a certificate enrollment. Certificate enrollment procedures vary from CA to CA but in most cases, you either email the request or enter the information on the CA's web site. The CA ensures that the information you provided is accurate. Once the CA completes the issuance process, the certificate will be delivered to you by email.

Getting your certificate issued by a recognized CA is a guarantee that your server certificate will interoperate (be recognized and accepted) by well-known browsers such as Netscape.

Once the CA signed-certificate is available, it can be loaded into the SSL proxy blade. For SSL proxy blade commands on keys and certificates see Appendix A.

The following are well known certificate authorities:

Verisign (http://www.verisign.com)

Digital Signature Trust Company (http://www.digsigtrust.com/)

GlobalSign (http://www.globalsign.com/)

GTE Cybertrust (http://www.cybertrust.gte.com/)

Entrust (http://www.entrust.net)

Thawte (http://www.thawte.com/)

Managing Keys and Certificates

There are two main reasons why certificates require some management time.

Expiration date - Certificates have an expiration date, thus you need to remember to renew them.

Security issues - Certificates must correspond with their corresponding private key. Private keys are difficult to handle (transferred or backed-up) in a secure manner.

These issues become compounded with multiple certificates on multiple systems.

Key Management Features

Like for every other information system task, good organizational skills are the best recommendation to minimize certificate management time. Commercial key management systems are a good solution where tight security controls are required.

The SSL proxy blade supports key management in the following manners.

The high performance and capacity of the SSL proxy blade supports centralized management of many certificates in a single SSL proxy blade.

The export certificate command can be used to verify the expiration date of a certificate.

The SSL proxy blade is compatible with key management systems.