test

IPsec and IKE Administration Guide

How to Configure IKE With Certificates Signed by a CA

  1. On the system console, become superuser or assume an equivalent role.

    Note –

    Logging in remotely exposes security-critical traffic to eavesdropping. Even if you somehow protect the remote login, the security of the system is reduced to the security of the remote login session.

  2. Use the ikecert certlocal -kc command to create a certificate request.

    For a description of the arguments to the command, see Step 2 in How to Configure IKE With Self-Signed Public Key Certificates.


    # ikecert certlocal -kc -m keysize -t keytype \
-D dname -A altname

    1. For example, the following command creates a certificate request on the partym system:


      # ikecert certlocal -kc -m 1024 -t rsa-md5 \
> -D "C=US, O=PartyCompany\, Inc., OU=US-Partym, CN=Partym" \
> -A "DN=C=US, O=PartyCompany\, Inc., OU=US-Partym"
Creating software private keys.
  Writing private key to file /etc/inet/secret/ike.privatekeys/2.
Enabling external key providers - done.
Certificate Request: 
  Proceeding with the signing operation.
  Certificate request generated successfully (…/publickeys/0)
Finished successfully.
-----BEGIN CERTIFICATE REQUEST-----
MIIByjCCATMCAQAwUzELMAkGA1UEBhMCVVMxHTAbBgNVBAoTFEV4YW1wbGVDb21w
…
lcM+tw0ThRrfuJX9t/Qa1R/KxRlMA3zckO80mO9X
-----END CERTIFICATE REQUEST-----

    2. The following command creates a certificate request on the enigma system:


      # ikecert certlocal -kc -m 1024 -t rsa-md5 \
> -D "C=JA, O=EnigmaCo\, Inc., OU=JA-Enigmax, CN=Enigmax" \
> -A "DN=C=JA, O=EnigmaCo\, Inc., OU=JA-Enigmax"
Creating software private keys.
…
Finished successfully.
-----BEGIN CERTIFICATE REQUEST-----
MIIBuDCCASECAQAwSTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDFBhcnR5Q29tcGFu
…
8qlqdjaStLGfhDOO
-----END CERTIFICATE REQUEST-----

  3. Submit the certificate request to a PKI organization.

    The PKI organization can tell you how to submit the certificate request. Most organizations have a web site with a submission form. The form requires proof that the submission is legitimate. Typically, you paste your certificate request into the form. When your request has been checked by the organization, the organization issues you the following two certificate objects and a list of revoked certificates:

    • Your public key certificate – This certificate is based on the request that you submitted to the organization. The request that you submitted is part of this public key certificate. The certificate uniquely identifies you.

    • A Certificate Authority – The organization's signature. The CA verifies that your public key certificate is legitimate.

    • A Certificate Revocation List (CRL) – The latest list of certificates that the organization has revoked. The CRL is not sent separately as a certificate object if access to the CRL is embedded in the public key certificate.

      When a URI for the CRL is embedded in the public key certificate, IKE can automatically retrieve the CRL for you. Similarly, when a DN (directory name on an LDAP server) entry is embedded in the public key certificate, IKE can retrieve and cache the CRL from an LDAP server that you specify.

      See How to Handle a Certificate Revocation List for an example of an embedded URI and an embedded DN entry in a public key certificate.

  4. Add each certificate to your system by using the ikecert certdb -a command.

    The -a option adds the pasted object to the appropriate certificate database on your system. For more information, see IKE With Public Key Certificates.

    1. On the system console, become superuser or assume an equivalent role.

    2. Add the public key certificate that you received from the PKI organization.


      # ikecert certdb -a
Press the Return key
Paste the certificate:
-----BEGIN X509 CERTIFICATE-----
…
-----END X509 CERTIFICATE----
Press the Return key
<Control>-D

    3. Add the CA from the PKI organization.


      # ikecert certdb -a
Press the Return key
Paste the CA:
-----BEGIN X509 CERTIFICATE-----
…
-----END X509 CERTIFICATE----
Press the Return key
<Control>-D

    4. If the PKI organization has sent a list of revoked certificates, add the CRL to the certrldb database:


      # ikecert certrldb -a
Press the Return key
Paste the CRL:
-----BEGIN CRL-----
…
-----END CRL----
Press the Return key
<Control>-D

  5. Edit the /etc/inet/ike/config file to recognize the PKI organization.

    Use the name that the PKI organization provides.

    1. For example, the ike/config file on the partym system might appear similar to the following:


      # Trusted root cert
# This certificate is from Example PKI
# This is the X.509 distinguished name for the CA that it issues.

cert_root "C=US, O=ExamplePKI\, Inc., OU=PKI-Example, CN=Example PKI"

## Parameters that may also show up in rules.

p1_xform 
 { auth_method rsa_sig oakley_group 1 auth_alg sha1 encr_alg des }
p2_pfs 2

{
 label "US-partym to JA-enigmax - Example PKI"
 local_id_type dn
 local_id  "C=US, O=PartyCompany, OU=US-Partym, CN=Partym"
 remote_id "C=JA, O=EnigmaCo, OU=JA-Enigmax, CN=Enigmax"

 local_addr  192.168.13.213
 remote_addr 192.168.116.16

 p1_xform
  {auth_method rsa_encrypt oakley_group 2 auth_alg md5 encr_alg 3des}
}
      Note –

      All arguments to the auth_method parameter must be on the same line.

    2. On the enigma system, use enigma values for local parameters and partym values for remote parameters.

      Ensure that the value for the label keyword is unique. The value must be different from the remote system's label value.


      …
{
 label "JA-enigmax to US-partym - Example PKI"
 local_id_type dn
 local_id   "C=JA, O=EnigmaCo, OU=JA-Enigmax, CN=Enigmax"
 remote_id  "C=US, O=PartyCompany, OU=US-Partym, CN=Partym"
 
 local_addr  192.168.116.16
 remote_addr 192.168.13.213
…

  6. If the PKI organization does not provide a CRL, add the keyword ignore_crls to the ike/config file. 


    # Trusted root cert
…
cert_root "C=US, O=ExamplePKI\, Inc., OU=PKI-Example, CN=Example PKI"
ignore_crls
…

    The ignore_crls keyword tells IKE not to search for CRLs.

  7. If the PKI organization provides a central distribution point for CRLs, you can modify the ike/config file to point to that location.

    See How to Handle a Certificate Revocation List for examples.

    Note –

    The following steps are necessary only if rsa_encrypt is the auth_method in the /etc/inet/ike/config file.

  8. Because the auth_method parameter is set to rsa_encrypt, add the peer's certificate to the publickeys database.

    1. Send the certificate to the remote system's administrator.

      You can paste the certificate into an email.

      1. For example, the partym administrator would send the following email:


        To: admin@ja.enigmaexample.com
From: admin@us.partyexample.com
Message: -----BEGIN X509 CERTIFICATE-----
MII…
----END X509 CERTIFICATE-----

      2. The enigma administrator would send the following email:


        To: admin@us.partyexample.com
From: admin@ja.enigmaexample.com
Message: -----BEGIN X509 CERTIFICATE-----
MII
…
-----END X509 CERTIFICATE-----

    2. On each system, add the emailed certificate to the local publickeys database. 


      # ikecert certdb -a
Press the Return key
-----BEGIN X509 CERTIFICATE-----
MII…
-----END X509 CERTIFICATE-----
Press the Return key
<Control>-D

    The authentication method for RSA encryption hides identities in IKE from eavesdroppers. Because the rsa_encrypt method hides identities, IKE does not know the peer. Therefore, IKE cannot retrieve the peer's certificate. As a result, this method requires that the IKE peers know each other's public keys. Therefore, when you use an auth_method of rsa_encrypt in the /etc/inet/ike/config file, you must add the peer's certificate to the publickeys database. So, the publickeys database then holds three certificates for each communicating pair of systems:

    • Your public key certificate

    • The CA certificate

    • The peer's public key certificate