WSM User Guide - WatchGuard Technologies

CHAPTER 17Managing Certificates and theCertificate AuthorityWhen you create a VPN tunnel, you can select from two types of tunnel authentication: shared secrets orcertificates. Shared secrets are an authentication method used to create trust between computers in aVPN. A shared secret is used with a passphrase. Certificates usually give more security than sharedsecrets during the authentication procedure.A certificate is an electronic document that contains a public key. A Certificate Authority (CA) is a trustedthird party that gives certificates to clients. In WatchGuard® System Manager, the workstation that isconfigured as the Management Server also operates as a CA. The CA can give certificates to managedFirebox® clients when they contact the Management Server to receive configuration updates.Certificate Authorities are a component of a system of key creation, key management and certificationwith the name Public Key Infrastructure (PKI). The PKI supplies certificate and directory services that cancreate, supply, keep, and when necessary revoke the certificates.Public Key Cryptography and Digital CertificatesPublic key cryptography is a central component of a PKI. This cryptographic system includes two mathematicallyrelated keys, known as an asymmetric key pair. The user keeps one key, the private key, secret.The user can supply the other key, known as the public key, to other users.The keys in the key pair go together. Only the owner of the private key can decrypt data encrypted withthe public key. Any person with the public key can decrypt data encrypted with the private key.Certificates are used to make sure public keys are valid. Certificates contain a digital signature createdwith the public key of a CA certificate. To make sure a certificate is legitimate, you can get the CA publickey. You can compute the digital signature of the certificate and compare it to the digital signature inthe certificate itself. If the signatures match, the key is legitimate.Certificates have a lifetime that is set when they are created. But certificates are occasionally revokedbefore the end date and time that was set for their lifetime. The CA keeps an online, current list ofrevoked certificates. This list is the certificate revocation list (CRL).User Guide 221