Kerio Tech KERIO WINROUTE FIREWALL 6 User Manual download pdf (Page 144)

Chapter 11 Web Interface

144

SSL Certiﬁcate for the Web Interface

The principle of an encrypted WinRoute Web interface is based on the fact that all communi-

cation between the client and server is encrypted to protect it from wiretapping and misuse

of the transmitted data. The SSL protocol uses an asymmetric encryption ﬁrst to facilitate

exchange of the symmetric encryption key which will be later used to encrypt the transmitted

data.

The asymmetric cipher uses two keys: a public one for encrypting and a private one for de-

crypting. As their names suggest, the public (encrypting) key is available to anyone wishing to

establish a connection with the server, whereas the private (decrypting) key is available only

to the server and must remain secret. The client, however, also needs to be able to identify

the server (to ﬁnd out if it is truly the server and not an impostor). For this purpose there is

a certiﬁcate, which contains the public server key, the server name, expiration date and other

details. To ensure the authenticity of the certiﬁcate it must be certiﬁed and signed by a third

party, the certiﬁcation authority.

Communication between the client and server then follows this scheme: the client generates

a symmetric encryption key for and encrypts it with the public server key (obtained from the

server certiﬁcate). The server decrypts it with its private key (kept solely by the server). Thus

the symmetric key is known only to the server and client. This key is then used for encryption

and decipher any other traﬃc.

Generate or Import Certiﬁcate

During WinRoute installation, a testing certiﬁcate for the SSL-secured Web interface is created

automatically (it is stored in the sslcert subdirectory under the WinRoute’s installation di-

rectory, in the server.crt ﬁle; the private key for the certiﬁcate is saved as server.key).

The certiﬁcate created is unique. However, it is issued against a non-existing server name and

it is not issued by a trustworthy certiﬁcate authority. This certiﬁcate is intended to ensure

functionality of the secured Web interface (usually for testing purposes) until a new certiﬁcate

is created or a certiﬁcate issued by a public certiﬁcate authority is imported.

Click on the Change SSL certiﬁcate (in the dialog for advanced settings for the Web interface)

to view the dialog with the current server certiﬁcate. By selecting the Field (certiﬁcate en-

try) option you can view information either about the certiﬁcate issuer or about the subject

represented by your server.

You can obtain your own certiﬁcate, which veriﬁes your server’s identity, by two means.

You can create your own self-signed certiﬁcate. Click Generate Certiﬁcate in the dialog where

current server status is displayed. Insert required data about the server and your company

into the dialog entries. Only entries marked with an asterisk (

) are required.

Click on the OK button to view the Server SSL certiﬁcate dialog. The certiﬁcate will be started

automatically (you will not need to restart your operating system). When created, the certiﬁ-

cate is saved as server.crt and the corresponding private key as server.key.

1 2 ... 139 140 141 142 143 144 145 146 147 148 149 ... 367 368

No comments

Kerio Tech KERIO WINROUTE FIREWALL 6 User Manual Page 144