Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Digital Certificates

Learn about the digital certificates. Find out how to configure digital certificates.

A digital certificate is an electronic means for verifying your identity through a trusted third party, known as a certificate authority (CA). Alternatively, you can use a self-signed certificate to attest to your identity.

Manual certificate processing includes generation of a PKCS10 request, submission to the CA, retrieval of the signed certificate, and manually loading the certificate into the Juniper Networks device. Based on your deployment environment, you can use either SCEP or CMPv2 for online certificate enrollment.

To use a digital certificate to authenticate your identity when establishing a secure VPN connection, you must first do the following:

  • Obtain a CA certificate from which you intend to obtain a local certificate, and then load the CA certificate onto the device. The CA certificate can contain a CRL to identify invalid certificates.

  • Obtain a local certificate from the CA whose CA certificate you have previously loaded, and then load the local certificate in the device. The local certificate establishes the identity of the Juniper Networks device with each tunnel connection.

Generate Digital Certificates Manually: Configuration Overview

To obtain digital certificates manually:

  1. Generate a key pair on the device. See Self-Signed Digital Certificates.

  2. Create a CA profile or profiles containing information specific to a CA. See Example: Configure a CA Profile.

  3. Generate the CSR for the local certificate and send it to the CA server. See Example: Manually Generate a CSR for the Local Certificate and Send it to the CA Server .

  4. Load the certificate onto the device. See Example: Load CA and Local Certificates Manually.

  5. Configure automatic reenrollment. See Example: Using SCEP to Automatically Renew a Local Certificate.

  6. If necessary, load the certificate's CRL on the device. See Example: Manually Load a CRL onto the Device.

  7. If necessary, configure the CA profile with CRL locations. See Example: Configure a Certificate Authority Profile with CRL Locations