O'Reilly logo

JUNOS Cookbook by Aviva Garrett

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

3.4. Using Digital Certificates to Create Dynamic IPSec SAs

Problem

You want an outside certificate authority (CA) to provide a digital certificate that sets the shared keys instead of using internal preshared keys.

Solution

Before you can configure IPSec, you must request a digital certificate from a trusted CA and put a copy of it on your router. First, configure a CA profile:

	[edit security]
	aviva@RouterA# set pki ca-profile entrust ca-identity entrust
	aviva@RouterA# set pki ca-profile entrust enrollment url 
http://server.ca.com/cgi-bin/pkiclient.exe
	aviva@RouterA# commit and-quit

Then, use the CA profile to request a CA certificate from the CA and load it onto the router:

	aviva@RouterA> request security pki ca-certificate enroll ca-profile entrust
	Received following certificates:
	  Certificate: C=us, O=mycompany
	    Fingerprint: 00:8e:6f:58:dd:68:bf:25:0a:e3:f9:17:70:d6:61:f3:53:a7:79:10
	  Certificate: C=us, O=mycompany, CN=First Officer
	    Fingerprint: bc:78:87:9b:a7:91:13:20:71:db:ac:b5:56:71:42:ad:1a:b6:46:17
	  Certificate: C=us, O=mycompany, CN=First Officer
	    Fingerprint: 46:71:15:34:f0:a6:41:76:65:81:33:4f:68:47:c4:df:78:b8:e3:3f
	Do you want to load the above CA certificate ? [yes,no] (no) yes

Next, generate a public/private key pair, which is required to submit a request for a local certificate:

	aviva@RouterA> request security pki generate-key-pair certificate-id local-entrust
	Generated key pair local-entrust, key size 1024 bits

Then, send a request for a local certificate to the CA:

 aviva@RouterA> ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required