31 lines
1.7 KiB
Markdown
31 lines
1.7 KiB
Markdown
# Certificates
|
|
|
|
The router's two-level CA: a root CA and issuing CAs that sign the certificates.
|
|
|
|
## Above the tabs
|
|
|
|
- **Issue:** a certificate from a CSR, saved with its chain, or with a key the router makes, saved
|
|
as a PFX file protected by a password; the router keeps no copy of the key.
|
|
- **Settings:** the names, lifetimes, key type, CRL validity and publishing endpoints.
|
|
- **Warnings:** what needs attention, such as a CRL about to expire.
|
|
|
|
## Tabs
|
|
|
|
- **Root:** the root CA's subject and expiry, whether its key is on the router (marked with a
|
|
warning sign) or offline, and its CRL. **Download root CA** gives its certificate; **Upload CRL**
|
|
takes a root CRL signed offline. Below, the certificates of the issuing CAs.
|
|
- **Templates:** key, lifetime, subject, usages, alternative names, certificate policies and the
|
|
CAs that issue each template. **Add template**, **Edit**, **Remove** for the router's own and
|
|
**Reset** for a changed built-in one.
|
|
- **Extended key usages:** the usages templates may give, with their OIDs; custom ones are added
|
|
with a name and an OID.
|
|
- **P2S Issuing CA** and **S2S Issuing CA:** the CAs of the VPN users and of site-to-site
|
|
connections. An active CA gives its CA bundle; a pending CA, waiting for the offline root, gives
|
|
its CSR and takes the certificate the root signed.
|
|
- **Issuing CAs:** general-purpose CAs, each with its templates and an optional ACME server.
|
|
**Add issuing CA**, **Edit** and **Remove**; a removed CA is retired and its certificate revoked.
|
|
- **Certificates:** each with its kind, template, names, expiry and state; one of another system
|
|
or of the router is revoked after a confirmation with a reason.
|
|
|
|
The root key is exported, removed and imported on the router with `vpn-router-ca`, never here.
|