Concept Guide

Verifying Server certicates
Verifying server certicates is mandatory in the TLS protocol.
As a result, all TLS-enabled applications require certicate verication, including Syslog servers. The system checks the Server certicates
against installed CA certicates.
NOTE: As part of the certicate verication, the hostname or IP address of the server is veried against the hostname or IP
address specied in the application. For example, when using SYSLOG over TLS, the hostname or IP address specied in the
logging syslog-server secure port port-number command is compared against the SubjectAltName or Common
Name eld in the server certicate.
Verifying Client Certicates
Verifying client certicates is optional in the TLS protocol and is not explicitly required by Common Criteria.
However, TLS-protected Syslog and RADIUS protocols mandate that certicate-based mutual authentication be performed.
Event logging
The system logs the following events:
• A CA certicate is installed or deleted.
• A self-signed certicate and private key are generated.
• An existing host certicate, a private key, or both are deleted.
• A host certicate is installed successfully.
• An installed certicate (host certicate or CA certicate) is within seven days of expiration. This alert is repeated periodically.
• An OCSP request is not answered with an OCSP response.
• A secure session negotiation fails due to invalid, expired, or revoked certicate.
1106
X.509v3