Managing Certificates

This chapter describes how to enroll and manage digital certificates for the VPN client for Mac OS X.

Certificate Stores

The VPN client uses the notion of store to convey a location in your local file system to store personal certificates. The main store for the VPN client is the Cisco store.

The Certificates tab on the VPN client window displays the list of certificates in your certificate store (Figure 6-1).

The Cisco store contains certificates enrolled through the Simple Certificate Enrollment Protocol (SCEP) and certificates that have been imported from a file.

Enrolling Certificates

Your system administrator may have already set up your VPN client with digital certificates. If not, or if you want to add certificates, you can obtain a certificate by enrolling with a Certificate Authority (CA).

To enroll a digital certificate you must enroll using the PKI Framework standards, receive approval from the CA, and have the certificate installed on your system.

Step 2 Click Enroll at the top of the VPN client window. The Certificate Enrollment dialog box appears (Figure 6-2).

Step 4 Enter the certificate enrollment parameters. All fields are required unless they are grayed out. Table 6-1 describes the entry fields.

Table 6-1 Certificate Enrollment Parameters

Entry Field	Description
Filename	The full path name for the file request. For example, /Users/Anna/Documents/Certificates/mycert.p10. This field is only available when you select a File enrollment type.
Name	The common name for the certificate. The common name can be the name of a person, system, or other entity. It is the most specific level in the identification hierarchy. The common name becomes the name of the certificate. For example, Fred Flinstone.
Domain	The Fully Qualified Domain Name (FQDN) of the host for your system. For example, Dialin_Server.
Email	The user e-mail address for the certificate. email@company.com
IP Address	The IP address of the user's system. For example, 192.168.23.9
Department	The VPN group that this user belongs to. This field correlates to the Organizational Unit (OU). The OU is the same as the Group Name configured in a VPN 3000 Series Concentrator, for example.
Company	The company name for the certificate.
State	The state for the certificate.
Country	The 2-letter country code for your country. For example, US. This two-letter country code must conform to ISO 3166 country abbreviations.
Challenge Phrase	Some CAs require that you enter a password to access their site. Enter this password in the Challenge Phrase field. You can obtain the challenge phrase from your administrator or from the CA.
CA URL	The URL or network address of the CA. For example, http://198.162.41.9/certsrv/mcep/mcep.dll.
CA Domain	The CA's domain name. For example, qa2000.com.
New Password	The password for this certificate. Each digital certificate is protected by a password. If you create a connection entry that requires a digital certificate for authentication, you must enter the certificate password each time you attempt a connection.

Step 5 Click Enroll to enroll a certificate from a CA. A prompt indicates whether the certificate enrollment is successful (Figure 6-3).

If the certificate enrollment is not successful, contact your network administrator.

Importing a Certificate

A network administrator might place a certificate in a file. This certificate must be imported in to the certificate store before you can use it for authenticating the VPN client to a VPN device.

Step 2 Click Import at the top of the VPN client window. The Import Certificate dialog box appears (Figure 6-4).

Step 3 Enter the path to the certificate you want to import. If you do not know the location, browse to the folder in which the certificate is located and click Open on the browser window. The import path is automatically entered in the Import Certificate dialog box.

Step 5 Enter a password to protect the certificate while it is in the VPN client certificate store.

Step 7 Click Import. The certificate is installed in the VPN client certificate store.

Viewing a Certificate

Step 3 Click View at the top of the VPN client window or double-click the certificate. The Certificate Properties window appears (Figure 6-5).

Common name—Name of the owner, usually both the first and last names. This field identifies the owner within the Public Key Infrastructure (PKI organization).
Department—Name of the owner's department. This is the same as the organizational unit in the Subject field.
Company—Company in which the owner is using the certificate. This is the same as the organization in the Subject field.
State—State in which the owner is using the certificate.
Country—2-character country code in which the owner's system is located.
Email—E-mail address of the owner of the certificate.
Thumbprint—An MD5 hash of the certificate's complete contents. This provides a means for validating the authenticity of the certificate. For example, if you contact the issuing CA, you can use this identifier to verify that this certificate is the correct one to use.
Key size—Size of the signing key pair in bits.
Subject—Fully qualified distinguished name (FQDN) of the certificate's owner. This field uniquely identifies the owner of the certificate in a format that can be used for LDAP and X.500 directory queries. A typical subject includes the following fields:

common name (cn)
organizational unit, or department (ou)
organization or company (o)
locality, city, or town (l)
state or province (st)
country (c)
e-mail address (e)

Exporting a Certificate

Step 2 Click Export at the top of the VPN client window. The Export Certificate dialog box appears (Figure 6-6).

Step 3 Enter the path for the export certificate. If you do not know the export path, browse to the export directory and click Open on the browser window. The export path is automatically entered in the Export Certificate dialog box.

Step 4 To export the entire certificate chain, check the box next to this parameter.

Step 5 Enter a password to protect the exported certificate file. We recommend that you always enter a password to protect your certificates.

Step 7 Click Export. The certificate is copied to the selected directory and a prompt (Figure 6-7) indicates whether the export is successful.

Deleting a Certificate

Step 2 Click Delete at the top of the VPN client window. A warning prompt appears (Figure 6-8).

Step 3 Verify the name of the certificate and click Delete. The selected certificate is deleted from the certificate store.

Click Do not Delete to return to the VPN client window without deleting the selected certificate.

Verifying a Certificate

Step 2 Click Verify at the top of the VPN client window. A prompt appears (Figure 6-9) to indicate the validity of the certificate.

If your certificate is invalid, contact the network administrator for instructions.

Table of Contents