Management and detailed Information of certificates stored in this unit, including advanced functions for easy deployment of certificates.
Certificates are used for secure communication with remote peers, e.g. by the VPN/IPSEC function provided by this unit.

NOTE: CERTIFICATES ARE ERASED IF UNIT IS RESET TO FACTORY DEFAULTS! YOU MUST BACKUP ALL YOUR CERTIFICATES TO PC FILE!

Own certificates
Own certificates are certificates where this unit is the subject of the certificate. Most of all, they contain your "public key" which can be freely distributed. Inside this unit there is also a "private key" for each of these certificates, which must be kept secret and which - together with the public key - allows for secure communication with other peers.

List of own certificates
Here all own certificates are listed, for each of them you have the choice to view them, to delete them or to export them.
View - See more details about this certificate.
Delete - Delete this own certificate and the associated private key. Warning: Other than restoring from a backup file, there is no way to restore a deleted own certificate (except it was retrieved out of an imported client bundle file, and a backup copy of this client bundle is still available). Creating a self signed certificate (see below) will never produce the same private / public key pair again, and loosing your private key renders your deployed own certificates worthless!
Export - Export this own certificate into a file, which can be imported by your peers. For self signed own certificates this is the only way to become a trusted peer to someone else. Note that exported certificates do not contain a private key, so this file can be freely distributed.

Create new self signed certificate and private key   - Create a new self signed certificate (this includes adding a new private/public key pair). This self signed certificate can be exported to be imported by other peers, so that a secured connection can be set up. Clicking on Create will take you to another page where you have to enter the details for the creation of the self signed certificate.

Trusted certificates
Trusted certificates are certificates where your peers are the subject of the certificate. Most of all, they contain your peers "public keys".

List of trusted certificates
Here all certificates of your trusted peers are listed, for each of them you have the choice to view them, to delete them or to renew them.
View - See more details about this certificate.
Delete - Delete this trusted certificate. You can not delete certificates which are still used. This will disable a trusted communiction with this peer using certificates (unless your configuration, e.g. for VPN/IPSEC, even permits communication with all peers whose certificates are signed by someone you trust, and this peers certificate is of this kind).
Renew - Renew this certificate; this means to replace it by another certificate which you import from a file. This is especially usefull if one of your pears issues a new certificate (e.g. because the old one is about to expire), and you want to replace his certificate without having to set up the whole rest of the configuration for this peer again (Note that you can not delete certificates which are still used by e.g. your VPN/IPSEC configuration, but you can renew them). Before clicking on Renew you have to enter the file name of the new certificate in the text field below.

Import additional certificate - Import an additional, new certificate from a file, e.g. because you want to enable secured communication with a new peer. Before clicking on Import you have to enter the file name of the new certificate in the text field below.

Advanced
Avanced operations for certificate management.

Create Client Certificate Bundle
Creation and export of a PKCS12 client certificate bundle, which provides an easy way to give in one step to a new peer all the certificates it needs for secured communication with this peer. PKCS12 certificate bundles are usually imported by peers, such as the Windows VPN clients, that cannot create their own certificates. Clicking on Create will take you to another page where you have to enter the details for the creation of the certificate bundle.
Import client bundle
Provides an easy way to get in one step all the certificates and the key needed for secured communication with the peer which created the certificate bundle. The bundle contains a "private key / own certificate" pair plus the certificate of the device which generated the bundle (will be added as a trusted certificate). Before clicking on Import you have to enter the file name of the certificate bundle, and the password if the certificate bundle was created with password protection (strongly recommended). Note: Mind the security when transporting and storing the bundle (with the private key!).
In effect, importing a bundle replaces both creating an own certificate and importing a trusted certificate.
Restore certificates from backup file Restoring the certificates and private keys contained in an existing backup file, without restoring the rest of the backed up configuration. This function is provided because there is no way to manually "reconfigure" old certificates, as the key material is unique for every new creation. Before clicking on Import you have to enter the file name of the backup file in the text field.

Read more online:
Certificate Overview

Create Self-signed Certificate
Self-signed Certificates are generated and signed by this device, and is generally exported to the remote peer.
For each self signed certificate there is a (hidden) private key only known by this device.

Naming data
The contents of the certificate:
Subject name - (mandatory) unique, descriptive name of the person or purpose the certificate is for.
Organisation - (optional) organisation the certificate is for. (For example your company.)
Organisation unit - (optional) organisation unit the certificate is for. (For example your department.)
DNS name - (optional) DNS domain the certificate is for. (For example your dynDNS domain.)
E-mail - (optional) e-mail address of contact person for this certificate. (For example your e-mail address.)
IP Address - (optional) IP address this certificate is for. (For example your global IP address, if it is a static one.)

Crypto The way the certificate is encrypted:
Key length - The size (bits) of the public key. Larger size results in higher security but decreased performance, and longer time to create the certificate.
Signature algorithm - Algorithms used to digitally sign the certificate. RSA/SHA1 is the most commonly used.
NOTE: DSA/SHA1 must however be used if "DSS signatures" has been selected as IKE Authentication Mode on the peer settings page.
NOTE: DSA/SHA1 certificates may take several minutes to create.

Valid to - After this date the certificate is no longer trusted, can no longer be used.

Create certificate - NOTE: Creation of certificate takes several seconds, up to a few minutes, to complete.
Press button only once, then wait until next page appears.

Create Client Certificate Bundle
Creates a client certificate, bundles it with the Certificate authority certificate, and saves the resulting PKCS12-bundle to file. PKCS12 Certificate Bundles are generally imported to VPN clients, such as the Windows clients, that cannot generate its own self-signed certificates.
The PKCS12 file contains both the client's private key, the client's certificate, and our unit's own certificate (which is used as signing certificate authority).
The created client certificate, and the Certificate authority certificate, are automatically added to the Trusted certificates list, too.
NOTE: The certificate created here is not for your server, but for the clients connecting to it. Thus the below fields should be filled in with values describing the remote client - not this unit.

Naming data
The contents of the certificate:
Subject name - (mandatory) unique, descriptive name of the person or purpose the certificate is for.
Organisation - (optional) organisation the certificate is for. (For example the client's company.)
Organisation unit - (optional) organisation unit the certificate is for. (For example the client's department.)
DNS name - (optional) DNS domain the certificate is for. (For example the client's dynDNS domain.)
E-mail - (optional) e-mail address of contact person for this certificate. (For example the client's e-mail address.)
IP Address - (optional) IP address this certificate is for. (For example the client's global IP address, if it is a static one.)

Crypto The way the certificate is encrypted:
Key length - The size (bits) of the public key. Larger size results in higher security but decreased performance, and longer time to create the certificate.
Signature algorithm - Algorithms used to digitally sign the certificate. RSA/SHA1 is the most commonly used.
NOTE: DSA/SHA1 must however be used if "DSS signatures" has been selected as IKE Authentication Mode on the IPSec peer settings page.
NOTE: DSA/SHA1 certificates may take several minutes to create.

Valid to - After this date the certificate is no longer trusted, can no longer be used.
Certificate authority - The own certificate that is used to authorize the created certificate with. This certificate is also included into the PKCS12-file and added to the Trusted certificates list.

Password - Password to protect the PKCS12-file with. User needs to enter same password when importing to remote VPN peer. Can be left empty to disable password lock.

Create and save certificate - Create certificate bundle (takes several seconds, up to a few minutes, to complete) and save it to a PC file.
Press button only once, then wait until next page appears.