IKE Public Key Databases and Commands

The ikecert(1M) command manipulates the local host's public-key databases. You use this command when the ike/config file requires public key certificates. Because IKE uses these databases to authenticate the Phase 1 exchange, the databases must be populated before activating the in.iked daemon. Three subcommands handle each of the three databases: certlocal, certdb, and certrldb.

ikecert certlocal Command

The certlocal subcommand manages the private-key database in the /etc/inet/secret/ike.privatekeys directory. Options to the subcommand enable you to add, view, and remove private keys. The command also creates either a self-signed certificate or a certificate request. The -ks option creates a self-signed certificate, and the -kc option creates a certificate request.

When you create a private key, the certlocal subcommand relies on values in the ike/config file. The correspondences between certlocal options and ike/config entries are shown in the following table.

Table 3–2 Correspondences Between ike certlocal and ike/config Values

certlocal options	ike/config entry	Notes
-A Subject Alternate Name	cert_trust Subject Alternate Name	A nickname that uniquely identifies the certificate. Possible values are IP address, email address, and domain name.
-D X.509 Distinguished Name	X.509 Distinguished Name	The full name of the certificate authority that includes Country, Organization name, Organizational Unit, and Common Name.
-t dsa-sha1	auth_method dss_sig	Slightly slower than RSA. Is not patented.
-t rsa-md5 -t rsa-sha1	auth_method rsa_sig	Slightly faster than DSA. Patent expired in September 2000.  The RSA public key must be large enough to encrypt the biggest payload, Typically, an identity payload, such as Distinguished Name, is the biggest payload.
-t rsa-md5 -t rsa-sha1	auth_method rsa_encrypt	RSA encryption hides identities in IKE from eavesdroppers, but requires that the IKE peers know each other's public keys.

If you issue a certificate request with the ikecert certlocal –kc command, you send the output of the command to a PKI organization. If your company runs its own PKI, you send the output to your PKI administrator. The organization or your PKI administrator then creates keying material. You use the keying material that is returned to you as input to the certdb and certrldb subcommands.

ikecert certdb Command

The certdb subcommand manages the public-key database, /etc/inet/ike/publickeys. Options to the subcommand enable you to add, view, and remove certificates and public keys. The command accepts, as input, certificates that were generated by the ikecert certlocal –ks command on a communicating system. See How to Configure IKE With Self-Signed Public Certificates for the procedure. The command also accepts the certificate that you receive from a PKI or CA as input. See How to Configure IKE With Public Keys Signed by a Certificate Authority for the procedure.

ikecert certrldb Command

The certrldb subcommand manages the certificate revocation list (CRL) database, /etc/inet/ike/crls. The crls database maintains the revocation lists for public keys. Certificates that are no longer valid are on this list. When PKIs provide you with CRLs, you install the CRLs in the CRL database with the ikecert certrldb command. See How to Access a Certificate Revocation List for the procedure.

/etc/inet/ike/publickeys Directory

The /etc/inet/ike/publickeys directory contains the public part of a public-private key pair and its certificate in files, or “slots”. The /etc/inet/ike directory is protected at 0755. You use the ikecert certdb command to populate the directory.

The files contain, in encoded form, the X.509 distinguished name of a certificate that was generated on another system. If you are using self-signed certificates, you use the certificate that you receive from the administrator of the communicating system as input to the command. If you are using certificates from a PKI, you install two pieces of keying material from the PKI into this database. You install a certificate that is based on material that you sent to the PKI. You also install a CA from the PKI.

/etc/inet/secret/ike.privatekeys Directory

The ike.privatekeys directory holds private key files that are part of a public-private key pair, keying material for ISAKMP SAs. The directory is protected at 0700. The private key in this database must have a public key counterpart in the publickeys database.The ikecert certlocal command populates this directory. Private keys are not effective until their public key counterparts, self-signed certificates or CAs, are installed in the /etc/inet/ike/publickeys directory.

/etc/inet/ike/crls Directory

The /etc/inet/ike/crls directory contains certificate revocation list (CRL) files. Each file corresponds to a public certificate file in the /etc/inet/ike/publickeys/ directory. PKI organizations provide the CRLs for their certificates. You use the ikecert certrldb command to populate the database.