Define additional VPN certificate authorities

You can configure the CA as trusted by importing its root certificate or a valid certificate signed by the CA. The certificates must be X.509 certificates in PEM format (Base64 encoding). It might be possible to convert between formats using, for example, OpenSSL or the certificate tools included in Windows.

The CAs you use can be either private (for self-signed certificates) or public (commercial certificate issuers). When you define a CA as trusted, all certificates signed by that CA are valid until their expiration date (or until the CA certificate expires). Optionally, you can also set up the Security Engine to check the certificate revocation status from certificate revocation lists (CRLs) or through the OCSP protocol. The CA can cancel a certificate, for example, because it is compromised.

Forcepoint Network Security Platform supports OCSP and CRL revocations for X.509v3 certificate validation during negotiation of IPsec VPN.

Forcepoint Network Security Platform constructs the certificate path to a trusted certificate, and then verifies the signature, checks the revocation status, validity period, issuer’s name, extended key usage and basic constraints for each certificate starting from the trusted certificate.

• Revocation status checks using OCSP and CRLs can be enabled independently for each trusted CA.
• The settings are applied to the whole certificate chain excluding the trust anchor.
• When OCSP is enabled but the certificate is not bearing OCSP responder information, or Forcepoint Network Security Platform cannot establish a connection with the OCSP responder, revocation status cannot be determined using OCSP.
• When CRLs are enabled but the certificate is not bearing CRL information, or Forcepoint Network Security Platform cannot establish a connection to the CRL Distribution Point location, revocation status cannot be determined using a CRL.
• When both OCSP and CRLs are enabled but Forcepoint Network Security Platform cannot determine revocation status using OCSP, revocation status is checked using a CRL.
• When either OCSP or CRLs are enabled and Forcepoint Network Security Platform cannot determine the revocation status, Forcepoint Network Security Platform will not accept the certificate as valid.

By default, all CAs you have defined are trusted by all gateways and in all VPNs. If necessary, you can limit trust to a subset of the defined CAs when you configure the VPN Gateway and VPN Profile elements. The trust relationships can be changed at the gateway level and in the VPN Profiles.

To obtain a certificate from an external certificate authority, first create a certificate request.

For more details about the product and how to configure features, click Help or press F1.