HP VPN Firewall Appliances VPN Configuration Guide

261
Ste
p
Remarks
4. Retrieving the CA certificate
Required.
Obtain the CA certificate and save it locally. For more information, see
"Retrieving and displaying a certificate."
Certificate retrieval serves the following purposes:
• Locally store the certificates associated with the local security domain
for improved query efficiency and reduced query count,
• Prepare for certificate verification.
IMPORTANT:
If a local CA certificate already exists, you cannot perform the CA
certificate retrieval operation. This helps avoid possible mismatch between
certificates and registration information resulting from relevant changes. To
retrieve the CA certificate, you must remove the CA certificate and local
certificate first.
5. Requesting a local certificate
Required.
When requesting a certificate, an entity introduces itself to the CA by
providing its identity information and public key, which will be the major
components of the certificate.
A certificate request can be submitted to a CA in online mode or offline
mode.
• In online mode, if the request is granted, the local certificate will be
retrieved to the local system automatically.
• In offline mode, you must retrieve the local certificate by an
out-of-band means.
IMPORTANT:
If a local certificate already exists, you cannot perform the local certificate
retrieval operation. This helps avoid possible mismatch between the local
certificate and registration information resulting from relevant changes. To
retrieve a new local certificate, you must remove the CA certificate and
local certificate first.
6. Destroying the RSA key pair
Optional.
If the certificate to be retrieved contains an RSA key pair, you must
destroy the existing RSA key pair on the device. Otherwise, the certificate
cannot be retrieved.
Destroying the RSA key pair also destroys the proper local certificate.
7. Retrieving and displaying a
certificate
Required for certificate request in offline mode.
Retrieve an existing certificate and display its information.
IMPORTANT:
Before retrieving a local certificate in online mode, be sure to complete
LDAP server configuration.
If you request a certificate in offline mode, you must retrieve the
downloaded CA certificate and local certificate and save them locally.
8. Retrieving and displaying a
CRL
Optional.
Retrieve a CRL and display its contents.