NeoAccel NeoAccel Management Console: Gateway Gateway Administration version version 2.3

Transcription

1 SSL VPN-Plus TM NeoAccel NeoAccel Management Console: Console: Gateway Gateway Administration version version Copyright NeoAccel Inc.

2 NeoAccel Inc. NMC - Volume II -SSL VPN-Plus-v2.33 SVP-UM NeoAccel makes no warranty of any kind with regard to this manual, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. NeoAccel shall not be held liable for errors contained herein or direct, indirect, special, incidental or consequential damages in connection with the furnishing, performance, or use of this material. The product and company names mentioned in this document may be the trademarks of their respective owners. Throughout this document NeoAccel has attempted to distinguish trademarks from descriptive terms by writing the name with the capitalization used by the manufacturer, or by writing the name with initial capital letters. NeoAccel cannot attest to the accuracy of this information. Use of a trademark in this document should not be regarded as affecting the validity of the trademark. Restrictions Information in this document is subject to change without notice and does not represent a commitment on the part of NeoAccel. The software described in this manual is furnished according to a license agreement with NeoAccel. The license agreement contains all of the terms and conditions governing your use of the software and documentation, including all warranty rights, limitations of liability, and disclaimers of warranty. Material contained in this document may describe NeoAccel products not available or features not available in your country. No part of this material may be reproduced in any form or by any means without permission in writing from the publisher. Printed in India. Edition history Edition 1: November 2007 Edition 2: July 2008 Edition 3: February 2009 Copyright All Rights Reserved. Copyright (C) 2009, NeoAccel Inc.

3 NeoAccel Inc. NMC - Volume II -SSL VPN-Plus-v2.33 SVP-UM Contents Contents... 3 Printing History... 4 Conventions... 5 In This Manual... 7 Audience... 7 Gateways... 8 Overview of the Gateways... 8 Add Gateway... 9 Modify Gateway Remove Gateway Active Clients View Active Clients Disconnect one or all the Active Clients License View License Information Update License Certificates Digital Certificate Certificate from NeoAccel View Certificates Add Certificate Remove Certificates CRL Certificate Revocation List Introduction Add CRL Open CRL Delete CRL Certificate Authorities (CA) Introduction Set CA Configurations... 32

4 Printing History The manual printing date and part number indicate its current edition. The printing date will change when a new edition is printed. Minor changes may be made at reprint without changing the printing date. The manual part number will change when extensive changes are made. Manual updates may be issued between editions to correct errors or document product changes. To ensure that you receive the updated or new editions, you should subscribe to the appropriate product support service. Table 1 Edition History Product number Revision Date Release V November 2007 NeoAccel SSL VPN-Plus TM Release v2.1 V July 2008 NeoAccel SSL VPN-Plus TM Release v2.2 V2.2 February 2009 NeoAccel SSL VPN-Plus TM Release v2.3 Printing History 4

5 Conventions Table 2 Following conventions are used in this document Convention Meaning Italic Document titles, and manual pages Provides emphasis Example Refer to NeoAccel SSL VPN-Plus User s Guide for more information You must install the NeoAccel kernel before installing other components Computer Specifies a variable that user should enter in a command Text and messages on computer screen Files and directory names Command names This is a note icon. Notes include helpful background information, as well as reminders that may simplify your process. This is a warning icon. Whenever you see this warning symbol, READ THE CONTENTS CAREFULLY. By doing so, you will avoid common pitfalls that many encounter. At command prompt, type./displaytunnel tunn_id Error message is displayed: Bridge utils Package is not installed Run./install.sh script Run./displayprodinfo command Conventions 5

6 Document Number Manuals SVP-UM SVP-UM SVP-UM SVP-UM SVP-UM SVP-UM SVP-UM SVP-UM NeoAccel Management Console System Administration NeoAccel Management Console Gateway Administration. NeoAccel Management Console Users/ Groups NeoAccel Management Console Authorization NeoAccel Management Console Network Extension NeoAccel Management Console Portal NeoAccel Management Console Firewall NeoAccel Management Console Tools Online Help NeoAccel SSL VPN-Plus Management Console provides context-sensitive (F1) help and help topics for various operations. In This Manual 6

7 In This Manual NeoAccel NMC Gateway Administration Manual describes how NeoAccel SSL VPN-Plus Management Console can be used as a tool to configure and use various NeoAccel NMC components like : Gateway Active Clients License Certificates Audience The manual is intended for administrators who are responsible for maintaining the NeoAccel SSL VPN-Plus solution. In This Manual 7

8 1 Gateways Overview of the Gateways SSL VPN-Plus TM Gateway can have multiple logical instances of the Gateway running on the same machine. Gateway Instances are the User Portal sites that the end-users log into. They provide the settings for layout, authentication methods, compression and EPS active or disabled. Utilizing multiple gateways allows for the separation of these settings for users or groups of users. Each Gateway instance must have a unique IP port or address. Only unique ports are setup in the NMC. If a separate address is desired, it must be manually setup in the CLI. Please contact NeoAccel support for help with this advanced setup. Gateway management can be used to view the number of instances that are currently up on the machine. SSL VPN-Plus TM Gateway supports multiple portal layouts. In dual authentication, a user first gets authenticated against an authenticating mechanism like RSA secure ID which is an OTP (One Time Password) primary authenticating mechanism. After successful primary authentication the user is again prompted and authenticated the second time against an authenticating mechanism such as AD (username-password) secondary authenticating mechanism. Figure 1.1: List of gateways The Info Screen displays the configuration details of the selected Gateway. Gateways 8

9 The sub-node: GGaat teewwaayyss performs the following tasks: Add New Gateway Modify Gateway Remove Gateway Add Gateway Perform the following steps to add a Gateway: 1. Click on the node: SSL VPN-Plus in the NMC; several sub-nodes are displayed. 2. Click on the sub-node: Gateways; the Content Panel displays a list of configured Gateways. Refer to Figure Click on the button: Add to display the dialog box: Add Gateway; the dialog box: Add Gateway consists of four respective tabs. Refer to Figure 1.2 Figure 1.2: Add Gateway In Tab: General 4. Enter a name for the Gateway in the field: GGaat teewwaayy NNaamee. The Gateway name entered is unique for all gateway instances. Gateways 9

10 5. Select the appropriate IP address for the Gateway instance, from the dropdown box: Gateway IP 6. Enter the (listening) port number of the Gateway in the field: Gateway Port. 7. Select the appropriate certificate for the Gateway from the drop-down box: Gateway Certificate. 8. Select the respective cipher from the list: Cipher List; multiple selections are possible. 9. Enter a notification message to be sent to all users, in the field: User notification. The port number entered should be unique for all gateway instances. Assure that the port number entered is not in use by standard services. Certificates should have a pair of both public key and the private key. In Tab: Authentication Figure 1.3: Tab Authentication Gateways 10

11 5. Select the option: Enable Authentication to enable authentication on the Gateway, this option allows users to get authenticated against the various (configured) authentication server(s); if the option is not selected then for user gains access without any authentication credentials. 6. Select the option: Prevent multiple logins using same username to prevent already logged in users to login again with the same User Id. 7. Click on the button: Add to add a primary authentication server that would authenticate user s primary credentials at the portal login page or PHAT client login window. 8. Set the Priority level for the multiple Authentication Servers added; set lower priority to have higher preference. 9. Select the secondary authentication server to authenticate user s secondary authentication credentials from the drop-down box: Secondary Authentication Server; this is an optional field, if selected then the following option: Terminate session if secondary authentication fails gets activated. 10. Select the option: Terminate session if secondary authentication fails to configure the Gateway to terminate the user session if the user s (secondary) credentials are not valid against the secondary authentication server (even if the user has been successfully authenticated at the primary level). 11. Select the Authorization Server from the field: Authorization Server;; the authorization server performs Group Extraction. If the option: Terminate session if secondary authentication fails is not selected then the user gains access on the basis of successful authentication credentials at the primary authentication level in spite of incorrect authentication credentials at the secondary authentication level. The administrator has to act responsible with the configurations accordingly. Gateways 11

12 Figure 1.4: Tab - Advanced In Tab: Advanced 9. Select the option: Enable Compression to enable TCP based intelligent data compression and to improve the speed of data transfer. 10. Select the option: Enable Client Auto Update Notification to enable the Gateway to inform the PHAT Client upon connection if a new version of the client is available. The end user then has the option to install the upgraded version of the PHAT Client. 11. Select the option: Enable Endpoint Security Scanning Agent to enable the host validation agent on the PHAT Client and the Web Portal. 12. Select the option: Force Virtual Keyboard to force the users to enter the login information to the Portal or PHAT Client via the virtual keyboard. 13. Select the option: Randomize keys in Virtual Keyboard to randomize the key positions of the virtual keyboard after every page refresh. 14. Select the option: Enable Single Sign-On (SSO) to enable a feature that allows portal users one time login for the entire session. Checking the box alone, enables NTLM (NT LAN Manager) SSO support; entering a FQDN for the realm will enable the Kerberos SSO support. 15. Select the option: Enable User Logs to enable the Gateway to maintain a Gateways 12

13 Figure 1.5: Tab X.509 Certificate Settings detailed user log. 16. Enter the log interval time in the field: Log Interval. The time value is set in minutes. 17. Enter the time value (in minutes) in the field: Session Idle Timeout to terminate any inactive user sessions. 18. Enter the time value in seconds in the field: Authentication Timeout to set the time limit for the Gateway to wait. The Gateway waits for a limited period after a new connection request has been initiated by the client and before the remote user provides the account credentials. 19. Enter a time value (in minutes) in the field: Enabled Force Timeout to forcibly disconnect a User from the Gateway. The User has to login again to get reconnected to the gateway. In Tab: X.509 Certificates 20. Select the option: Enable SSL Client Certificate Authentication to perform Client Authentication based on Signed Certificates. 21. Select the option: Enable Certification Revocation List (CRL) to enable the Gateway to perform authentication based on CRL. 22. Select the option: EExxt trraacct t uusseerr iinnf i foorrmaat ti iioonn frroom f ccl lli iieenn t cceerrt ti iif fi iicc aat tee and also, select user information from the options available, to enable the Gateway to search for the selected option, in the certificate provided by the User, during the authentication process. Refer to Figure 1.5 Gateways 13

14 In Tab: Portal 23. Select a portal layout for the particular Gateway instance from the dropdown box: Layout Name Select the default color scheme for the portal layout from the drop-down box: Color Name 25. Click on the button: OK to save and apply the configurations. Or Click on the button: Cancel to close the dialog box: Add Gateway without saving any changes. By default, the local database (locsrvr) used for authentication of client s username and password is configured. You can configure more than one external authentication server. Refer NMC- Volume 3: User/Group, for more information on configuring an external authentication server. Authentication servers are bound to the gateway and use a cascading mechanism based on the Priority of Authentication servers configured. It is possible to bind multiple external authentication servers other than the local database thus providing a system administrator, a very flexible authentication scheme. TCP based intelligent data compression is based on an algorithm that dynamically determines whether the traffic is compressible or not and then applies compression based on that inference. Endpoint Security Scanning allows the administrator to define policies that the connecting host must pass in order to gain access to private resources. For more configuration details on Portal layout and color, refer to the Portal Manual- Volume VI In case of dual authentication: Unless mentioned otherwise, by default the authorization server does group extraction from the primary authentication server. User name extraction from certificates is possible only from the primary authentication server. Logs are generated with primary authentication server details; the logs display username as extracted from the primary authentication server. In the Portal, the user name displayed comes from the primary authentication server. In portal, from the tab: Tools, a user changes his/her secondary authentication credentials (such as password). If a secondary authentication server has not been configured for a group by the administrator then the tab: Tools in portal is not displayed for the users belonging to the group. Gateways 14

15 Figure 1.5: Remove Gateway: Advanced Tab Modify Gateway Perform the following steps to modify Gateway configurations: 1. Click on the node: SSL VPN-Plus in the NMC; several sub-nodes are displayed. 2. Click on the sub-node: Gateways; the Content Panel displays a list of configured Gateways. Refer to Figure Select a Gateway configuration to be modified, from the list of Gateways displayed in the Content Panel. 3. Click on the button: Modify; a dialog box: Modify Gateway is displayed. 4. Do the required modifications. 5. Click on the button: OK to save and apply the modifications. Or Click on the button: Cancel to close the dialog box: Modify Gateway without saving any changes. The fields of the Tab: General and also Tab: X.509 Certificate Settings in the dialog box: Modify Gateway cannot be modified. You need to remove the Gateway and then re-configure the Gateway again. Remove Gateway Perform the following steps remove a Gateway: 1. Click on the node: SSL VPN-Plus in the NMC; several sub-nodes are displayed. 2. Click on the sub-node: Gateways; the Content Panel displays a list of configured Gateways. Refer to Figure Select a Gateway configuration to be removed, from the list of Gateways displayed in the Content Panel. 4. Click on the button: Remove; a confirmation box: Confirm Stop Gateway is displayed. Refer to Figure 1.5 Gateways 15

16 5. Click on the button: Yes to stop the existing Gateway and remove it. The resulting removal of a gateway will mean that no client will be able to establish a tunnel to the private network. 2 Active Clients View Active Clients Perform the following steps to view the active clients with details: 1. Click on the node: SSL VPN-Plus in the NMC; several sub-nodes are displayed. Figure 2.1: List of Active Clients 2. Click on the sub-node: Active Clients; the Content Panel displays a list of all the active Clients connected to the Gateway. Refer to Figure Select an existing record from the list displayed in the Contents Panel; the detailed information about the Client selected is displayed on the Info Screen. The displayed information also depends on the type of the client connected. For example: Additional information such as the NAT IP of the client, virtual IP assigned and traffic statistics can also be viewed. Disconnect one or all the Active Clients 1. Click on the node: SSL VPN-Plus in the NMC; several sub-nodes are displayed. Active Clients 16

17 2. Click on the sub-node: Active Clients; the Content Panel displays a list of all the active Clients connected to the Gateway. Refer to Figure Select the active client that has to be disconnected. Figure 2.2: Disconnect Active Clients 3. Click on the button: Disconnect to forcibly disconnect the selected active client connected to the Gateway; a confirmation prompt: Confirm Disconnect is displayed. Refer to Figure 2.2 Figure 2.3: Disconnect All the Active Clients Or Click on the button: Disconnect All to forcibly disconnect all the active clients connected to the Gateway; a confirmation prompt: Confirm Disconnect All is displayed. Refer to Figure Click on the button: Yes in the respective confirmation prompts to confirm the respective disconnections. Active Clients 17

18 License License Management can perform following tasks: View License Information Update License Figure 3.1: License Information View License Information 1. Click on the node: SSL VPN-Plus; several tasks are displayed. 2. Click on the sub-node: License; a detailed information on the license and the various software that are licensed with the gateway gets displayed in the Content Panel. Refer to Figure 3.1 Following information are displayed :- License file name Build number The Licensee Software Serial Name (SSN) The License Type (Evaluation/Registered) The maximum number of concurrent users allowed Availability of license for Client Authentication Availability of license for Hardware Acceleration License 18

19 Availability of license for Logging Availability of license for TCP Specialized Processing Availability of license for Policy Engine for VPN Traffic. Availability of license for Webified Remote Access. High Availability License. Availability of license for EPS Upgrade. Figure 3.2: License Request dialog box Update License License management has the provision to update the license of the gateway. Following are the steps to update the license. 1. Click on the button: Update License; displays a license request dialog box. 2. Enter a valid 10-digit SSN. It accepts only numerals (0-9), alphabets (A-Z) as valid inputs. Figure 3.3: License Key Window 3. Click on the button: OK the license request for the specified SSN is generated and the pop-up window: Update License gets invoked or displayed. 4. Paste the contents of the file license.req in the License Request panel of the SSL VPN-Plus License Key window Refer to Figure 3.3 License 19

20 Panel: License Request Figure 3.4: License Manage via URL 5. Click the button: Copy To Clipboard in order to copy the license request onto the clipboard; to utilize the information later. 6. Click the button: Open License Server; it will take you to the License Manager via an internet URL- Refer to Figure 3.4 URL Figure 3.5: Request for License window 7. Enter the same SSN and password provided to logon to the NeoAccel Licensing Server. Refer to Figure Click on the button: GO; the screen: Request for License is displayed in the Content Panel. Refer to Figure 3.5 License 20

21 9. Paste the License Request contents in the field: License; Use the option CTR+V option from your keyboard. The license request obtained via NMC or obtained via command /opt/sslvpnplus/license_req is pasted here. Figure 3.6: Dialog box: SSL VPN-Plus Key 11. Click on the button: Submit to send the license request information to the NeoAccel Licensing Server, the License Key is generated. 12. Select and copy the license text to the clipboard and Go back to the dialog box: SSL VPN-Plus TM License Key in the NMC. Refer to Figure Click either on the button: Paste from Clipboard in the Update License Window OR Use the option CTR + V from your keyboard to paste the contents in the license key panel. 12. Click the button: OK to update and save the configuration as license key file; the license gets updated. License 21

22 SSN number should be entered in UPPER case letters and the value should be numeric only. Your machine should have internet access and a web browser. Internet Explorer is a preferred browser. Make sure you have disabled the pop-up blocker in your web browser. License.req file is generated during NeoAccel Gateway installation and is typically stored in /opt/sslvpn-plus directory. License 22

23 4 Certificates Digital Certificate A digital certificate is an encrypted electronic file issued by a Certificate Authority (CA) that establishes a server s and client s credentials for client-server transactions. A digital certificate consists of two parts, a public key that establishes the server s (subject) identity and a private key which establishes the client's identity. The subject may then use the certificate to prove his identity before entering secure communications with another client or system. The subject merely sends the certificate to the client who then uses the Certificate Authority's (CA) public key to validate the signature made with the CA's private key. Certificate from NeoAccel The NeoAccel SSL VPN-Plus installation provides a self signed SSL certificate from NeoAccel. This certificate is primarily for testing purposes and is not recommended for production use as it is not signed by a Trusted Authority and use of this will create pop up messages for users. Perform the following functions via the sub-node: CCeerrt ti iif fi iicc aat tee.. View Certificates Add a Certificate Remove a Certificate View Certificates Perform the following steps to view details of the existing certificates: 1. Click on the node: SSL VPN-Plus in the Navigation Panel of the NMC; several sub-nodes are displayed. 2. Click on the sub-node: Certificates; the details of existing certificates are displayed in the Contents Panel. Refer to Figure 4.1 Certificates 23

24 Figure 4.1: List of existing certificates Figure 4.2: View Certificate 3. Select a certificate from the Content Panel to view its details. 4. Click on the button: View; a dialog box: View Certificate displaying the selected certificates details is displayed. Refer to Figure 4.2 The following details are displayed in the Content Panel when you Click on the sub-node: Certificates. Refer to Figure for easier understanding A. Name: is the name of the digital certificate (for identification) B. Subject: It is the name of the server to whom the digital certificate was issued to by the CA. For example: Consider subject s name appears as, /C=US/S=California/L=San Jose/O= neoaccel/cn=sslvpn-plus Certificates 24

25 C= US ;The 2 character name of the country S=California ;Name of the state L=San Jose ;Name of the city / location O=neoaccel; Organization s name. CN=sslvpn-plus; Common Name. C. Issuer: It is the name of the CA that issued the digital certificate. For example: Consider the issuer detail appearing as. /C=US/S=Arizona/L=Scottsdale/O=Starfield Technologies,Inc./OU= m/repository/cn=starfield Secure Certification Authority/E=practices@starfieldtech.com C= US; Country s 2 character name S= Arizona; Name of the State. O= Starfield Technologies, Inc; The organization s name. OU= Organization s Name. CN= Starfield Secure Certification Authority; (the common name). E= practices@starfieldtech.com; The id of the issuer D. Private Key: It determines whether the uploaded certificate is associated with a private key. Add Certificate Perform the following steps to add a new trusted certificate : 1. Click on the node: SSL VPN-Plus in the Navigation Panel of the NMC; several sub-nodes are displayed. 2. Click on the sub-node: Certificates; the details of existing certificates are displayed in the Contents Panel. Refer to Figure Click on the button: Add; a dialog box: Add Certificate gets displayed. Refer to Figure Enter a name for the digital certificate (for identification) in the field: Certificate Name.. Certificates 25

26 Figure 4.3: Add Certificate dialog box. 3. Browse and enter the file name where the signed digital certificate is present in your local system. 4. Check the option: Use Private Key and also browse to locate the private key to be uploaded. 5. Click on the button: Add to save and add the certificate. Or Click on the button: Cancel to close the dialog box: Add Certificate without adding any certificate. It is necessary to provide or upload the private key along with the certificate only then clients can accept any connections from the NeoAccel Gateway. Remove Certificates Perform the following steps to remove any trusted certificates : 1. Click on the node: SSL VPN-Plus in the Navigation Panel of the NMC; several sub-nodes are displayed. 2. Click on the sub-node: Certificates; the details of existing certificates are displayed in the Contents Panel. Refer to Figure Select a particular certificate to be removed. 4. Click on the button: Remove; a prompt: Confirm Remove Certificate is displayed. Refer to Figure 4.4 Certificates 26

27 Figure 4.4: Confirmation prompt to remove certificate 5. Click on the button: Yes to remove the selected Certificate. Or Click on the button: No to close the prompt: Confirm Remove Certificate without removing the selected certificate. Caution: You cannot remove a certificate that is bound to a gateway as in order to provide SSL capabilities the gateway requires one SSL certificate. Certificates 27

28 5 CRL Certificate Revocation List Introduction CRL is a list of certificates (actually the serial numbers) that have been revoked or are invalid. It is a list maintained by CA who issued these certificates in the first place. Refer to Figure 5.1 The reasons for revocation, before the expiry date of a certificate vary. It may be either due to the private key of the certificate being compromised or due to violation of certain policies being implemented by the CA or any customer. The CA maintains and publishes these CRL lists at periodic intervals. Any entity supporting X.509 based authentication and willing to do revocation verification needs to get these CRL s from the respective CA. SSL VPN-Plus TM Gateway supports X.509 certificates based authentication for connecting clients. Thus it becomes mandatory to maintain the latest CRL. These CRL s are normally available using HTTP URL or LDAP URL. Figure 5.1: Certificate Revocation List CRL Certificate Revocation List 28

29 Figure 5.2: Sub-node: CRL displayed Perform the following functions via the sub-node: CCRRLL Add new CRL Open/View CRL Delete CRL Add CRL 1. Click on the node: SSL VPN-Plus in the Navigation Panel of the NMC; several sub-nodes are displayed. 2. Click on the sub-node: CRL; the existing CRL with the Issuer details are displayed in the Contents Panel. Refer to Figure Click on the button: Add to display a dialog box: Add CRL. Refer to Figure 5.3 Figure 5.3: Add CRL 4. Enter a name for the CRL to be uploaded, in the field: CCRRLL NNaamee CRL Certificate Revocation List 29

30 5. Browse and Enter the CRL file name in the field: CRL Filename. 6. Click on the button: Add to upload and display the CRL in the Content Panel. Or Click on the button: Cancel to close the dialog box: Add CRL without saving any changes. Open CRL 1. Click on the node: SSL VPN-Plus in the Navigation Panel of the NMC; several sub-nodes are displayed. 2. Click on the sub-node: CRL; the existing CRL with the Issuer details are displayed in the Content Panel. Refer to Figure Select the CRL to view its details, from the list displayed in the Content Panel. 4. Click on the button: Open to open the selected CRL. Refer to Figure 5.4 Figure 5.4: View CRL 5. Click on the button: Ok to close the dialog box: VVi iieeww CCRRLL Delete CRL 1. Click on the node: SSL VPN-Plus in the Navigation Panel of the NMC; several sub-nodes are displayed. 2. Click on the sub-node: CRL; the existing CRL with the Issuer details are displayed in the Content Panel. Refer to Figure Select a CRL to be deleted, from the list displayed in the Content CRL Certificate Revocation List 30

31 Figure 5.5: Confirm CRL removal Panel. 4. Click on the button: Delete to remove the selected CRL; a confirmation prompt: Confirm Remove CRL is displayed. Refer to Figure Click on the button: Yes to remove the selected CRL. Or Click on the button: No to close the confirmation prompt: Confirm Remove CRL without any changes. CRL Certificate Revocation List 31

32 6 Certificate Authorities (CA) Figure 6.1: View Certificate Authorities list Introduction A digital certificate is a digital document that certifies that a certain public key is owned by a particular user. This document is signed by a third party called the certificate authority (or CA). Through NeoAccel Management Console (NMC) you can set CA configuration for individual CRL. Set CA Configurations Perform the following steps to set CA configurations via NMC: 1. Click on the node: SSL VPN-Plus in the Navigation Panel of the NMC; several sub-nodes are displayed. 2. Click on the sub-node: Certificate Authorities; the existing list of existing Certificate Authorities are displayed in the Contents Panel. Refer to Figure Click on the button: Add to display a dialog box: Set CA Configuration. Refer to Figure 6.2 Certificate Authorities (CA) 32

33 Figure 6.2: Set CA configurations Type Panel 4. Select the Certificate Authority to set the CA configuration details on, from the drop-down box: CA; the Subject details of the particular CA is displayed in the field: Subject. Refer to Figure Select the interval of time from the drop-down box: Refresh Interval;; it is the time value when the CRL list will be refreshed or fetched from the URL mentioned (if any). 6. Select the Tab: CRL File to fetch the CRL file manually. Figure 6.3: Tab: CRL File a. Select the particular (existing) CRL file from the drop-down box: CRL File; the Issuer details of the CRL file is displayed within the panel: CRL Type. Refer to Figure 6.3 b. Click on the button: Add; the newly added CRL file is displayed in the panel: Type-Details consisting of the buttons: UP, Down and Delete. Refer to Figure 6.2 Certificate Authorities (CA) 33

34 Figure 6.4: Tab: HTTP 7. Select the Tab: HTTP to fetch the CRL file via the HTTP URL. a. Enter the HTTP URL in the field: URL. Refer to Figure 6.4 b. Click on the button: Clear to reset the value entered in the field: URL c. Click on the button: Add to add the HTTP URL; the newly added CRL file is displayed in the panel: Type-Details consisting of the buttons: UP, Down and Delete. Refer to Figure Select the Tab: LDAP to fetch the CRL file via the LDAP URL. a. Enter the LDAP URL in the field: URL. Refer to Figure 6.5 Figure 6.5: Tab: LDAP b. Select the option: Anonymous to anonymously sign into the LDAP server Or a. Uncheck the option: Anonymous to manually enter the server bind password. b. Enter the Server bind password of the LDAP server in the field: Server bind password. c. Re-Enter the Server bind password for confirmation in the field: Retype bind password. d. Click on the button: Add to add the LDAP URL; the newly Certificate Authorities (CA) 34

35 added CRL file is displayed in the panel: Type-Details consisting of the buttons: UP, Down and DDeel lleet tee. Refer to Figure Select a type of URL from the panel: Type Panel to move it one position up and Click on the button: Up, Repeat till you attain the required position. 10. Select a type of URL from the panel: Type Panel to move it one position down and Click on the button: Down, Repeat till you attain the required position. 11. Select a type of URL for deletion from the panel: Type Panel and Click on the button: Delete Certificate Authorities (CA) 35