Configuring a certificate authority (CA) in NCOS is helpful for confirming certificate functionality in a test or lab environment. However, in a production environment, leveraging a dedicated organizational CA is highly recommended.
Log into NetCloud Manager.
Select in the left-side navigation panel.
Select a router from the Routers page. Alternatively, to make configuration changes to a group, navigate to the Groups page and select a group.
Select and then .
Navigate to > > .
The Local Certificates page displays.
Create the CA certificate:
Select .
In the General Description section, enter a name for the CA certificate in the Name field.
In the Issuer section, select Set as CA certificate.
In the Subject section, enter values into the Country Code and State or Province Name fields. These fields are required.
(Optional) Enter values in the Local Name, Organization Name, Org. Unit, and Email Address fields. It is acceptable to leave any of these four fields blank.
In the Common Name field, enter a name that is unique among all of the device’s OpenVPN certificates.
In the Validity section, enter the number of days that the CA certificate will be valid for in the Days field.
In the Public Key Algorithm section, select the Type, Digest, and Bits that will be used for the certificate. These settings must match on all three OpenVPN certificates.
Select to save the CA certificate, and then select .
Create the Server certificate:
Select .
In the General Description section, enter a name for the Server certificate into the Name field.
In the Issuer section, select from the drop-down menu.
For the Certificate Name, select the CA certificate that you created in earlier steps.
In the Subject section, enter values into the Country Code and State or Province Name fields. These fields are required.
(Optional) Enter values into the Local Name, Organization Name, Org. Unit, and Email Address fields. It is acceptable to leave any of these four fields blank.
In the Common Name field, enter a name that is unique among all of the device's OpenVPN certificates. This must be a different Common Name than was used for Step 6.
In the Validity section under Days, enter the number of days that the Server certificate will be valid for. This value should be equal or lesser than the value used for the CA certificate in Step 6.
In the Public Key Algorithm section, select the Type, Digest, and Bits that will be used for the certificate. These settings must match on all three OpenVPN certificates.
Select to save the Server certificate, and then select .
Create the Client certificate:
Select .
In the General Description section, enter a name for the Client certificate into the Name field.
In the Issuer section, select from the drop-down menu.
For the Certificate Name, select the CA certificate that you created in earlier steps.
In the Subject section, enter values into the Country Code and State or Province Name fields. These fields are required.
(Optional) Enter values into the Local Name, Organization Name, Org. Unit, and Email Address fields. It is acceptable to leave any of these four fields blank.
In the Common Name field, enter a name that is unique among all of the device's OpenVPN certificates. This must be a different Common Name than was used for Step 6 and Step 7.
In the Validity section under Days, enter the number of days that the Server certificate will be valid for. This value should be equal or lesser than the value used for the CA certificate in Step 7.
In the Public Key Algorithm section, select the Type, Digest, and Bits that will be used for the certificate. These settings will need to match on all three OpenVPN certificates.
Select to save the Client certificate, and then select ,
All three created certificates should now be listed. You can begin configuring the OpenVPN server.