Administrator Guide

NOTE: A CA certicate can also be
revoked.
Verifying Server certicates
Verifying that server certicates are mandatory in the TLS protocol.
As a result, all TLS-enabled applications require certicate verication, including Syslog servers. The system checks the Server certicates
against installed CA certicates.
Verifying client certicates
Verifying that client certicates are optional in the TLS protocol and is not explicitly required by Common Criteria.
However, TLS-protected Syslog and RADIUS protocols mandate that certicate-based mutual authentication be performed.
Event logging
The system logs the following events:
• A CA certicate is installed or deleted.
• A self-signed certicate and private key are generated.
• An existing host certicate, a private key, or both are deleted.
• A host certicate is installed successfully.
• An installed certicate (host certicate or CA certicate) is within seven days of expiration. This alert is repeated periodically.
• An OCSP request is not answered with an OCSP response.
• A secure session negotiation fails due to invalid, expired, or revoked certicate.
X.509v3
1127