Cisco Secure VPN Exam Certification Guide - Cisco press

218 Chapter 5: Configuring Cisco VPN 3000 for Remote Access Using Digital Certificates

4What default algorithm type and key size does the VPN concentrator use on the certificate request?

5What entity is responsible for generating the Public Key Infrastructure (PKI) public/private key pair for a requesting host?

6When are Secure Sockets Layer (SSL) certificates required on a VPN concentrator?

7What is the first certificate that must be installed on a VPN concentrator before you can install any other certificates from a given CA?

8What two enrollment methods are available on a VPN concentrator?

9Where does a VPN concentrator obtain the root CA’s public key?

“Do I Know This Already?” Quiz 219

10During the authentication process, where does a VPN concentrator find the original hash that the CA calculated for an identity certificate?

11When you select to cache Certificate Revocation Lists (CRLs) on the VPN concentrator, where are they stored?

12With CRL caching disabled, how does a VPN concentrator check a certificate’s serial number against a CRL?

13Using the VPN Manager, where would you look to check the status of a certificate enrollment process?

14When configuring digital certificate support on a VPN concentrator, where do you identify which certificate to use for Internet Key Exchange (IKE) Phase 1 negotiations?

15What must be in place on a client’s PC before you can configure the VPN Client for certificate support?

220 Chapter 5: Configuring Cisco VPN 3000 for Remote Access Using Digital Certificates

16Which screen do you use to enable the use of digital certificates for device authentication during IKE Phase 1 negotiations?

The answers to this quiz are listed in Appendix A, “Answers to the “Do I Know This Already?” Quizzes and Q&A Sections.” The suggestions for your next steps, based on quiz results, are as follows:

•2 or less score on any quizlet—Review the appropriate sections of the “Foundation Topics” section of this chapter, based on Table 5-1. Proceed to the “Foundation Summary” section, the “Q&A” section, and then the scenarios at the end of the chapter.

•8 or less overall score—You should read the entire chapter, including the “Foundation Topics” and “Foundation Summary” sections, the “Q&A” section, and the scenarios at the end of the chapter.

•9 to 12 overall score—Begin with the “Foundation Summary” section, continue with the “Q&A” section, and then read the scenarios. If you are having difficulty with a particular subject area, read the appropriate section in the “Foundation Topics” section.

•13 or more overall score—If you feel you need more review on these topics, go to the “Foundation Summary” section, then to the “Q&A” section, then the scenarios. Otherwise, skip this chapter and go to the next chapter.

222Chapter 5: Configuring Cisco VPN 3000 for Remote Access Using Digital Certificates

—Identity—Required by every device, these are signed by either the root CA or by a subordinate CA. The root CA must self-sign its own identity certificate.

—Issuing (or subordinate)—Serves the same purpose as the root certificate but is issued by a subordinate CA instead of the root CA. Subordinate CAs do not self-sign their own identity certificate.

•Key generation—Most Cisco devices generate their own public/private key pairs. Some devices do not have that capability and depend on the CA to generate key pairs. The private key is returned to the requesting device through some secure method, possibly even through some manual process.

•Key recovery—An optional service provided by some CAs is the ability to store private keys for devices that can be used in case the original key is lost.

•Certificate revocation—Another service that CAs render is the publication of lists of identity certificates that have been revoked prior to their expiration date. Revocation can occur for a variety of reasons, such as a name change, removal from service, or change of organization, or because of a suspected or real security compromise.

•Cross-certification—CAs in one organization might need to authenticate certificates issued by a second CA organization. This can be accomplished by using cross-certifications, which are a type of subordinate certificate.

The following sections review certificate requests, the enrollment process, the authentication process, CA hierarchies, and certificate revocation.

Certificate Requests

When two hosts want to use digital certificates to secure communications between them, each host must contact the same CA and enroll its identity and public key with the CA. Enrollment is a multistep process on many systems. First, a host that wants to use digital certificates creates a pair of keys, one public and one private. Next, the host prepares a Public Key Cryptography Standards (PKCS) #10 certificate request. Finally, this PKCS #10 certificate request and the host’s public key are then sent to the CA.

On the Cisco VPN 3000 Concentrator, the process is combined into one operation. The administrator simply fills out the PKCS #10 certificate request form, which includes a field to select the size of the key to generate. When the form is submitted, the VPN concentrator generates the key pair and then sends the certificate request and public key to the CA. Table 5-2 describes the fields that are contained on a VPN concentrator PKCS #10 certificate request.

Digital Certificates and Certificate Authorities 223

224 Chapter 5: Configuring Cisco VPN 3000 for Remote Access Using Digital Certificates

Enrollment Process

The CA computes a hash code of the unsigned PKCS #10 certificate request. The CA then takes that hash and encrypts it using the CA’s private key. This encrypted hash is the digital signature, and the CA attaches it to the certificate and returns the signed certificate to the client. This certificate is called an identity certificate and is stored on the client device until it expires or is deleted. The CA also sends the client its own digital certificate, which becomes the root certificate for the client.

The client now has a signed digital certificate that it can send to any other peer partner. If the peer partner wants to authenticate the certificate, it decrypts the signature using the CAs public key.

The standard format for the identity and root certificates is the X.509 certificate.

The PKI is based on trust. In Figure 5-2, Alpha and Theta, a VPN concentrator and a VPN Client, for example, want to communicate, but they do not know or trust each other. However, they each know Omega, a CA, and trust its good judgment. Omega says that Alpha and Theta are okay and presents each of them with a certificate to that effect, the identity certificate. Additionally, Omega sends each of them a self-signed root certificate that Alpha and Theta can use to validate one another’s identity.

Figure 5-2 shows the process of enrolling with a CA using the PKCS #10 certificate request and receiving the identity and root certificates in return.