ZyXEL Communications ZyXEL ZyAIR NWA-3500 - Manual (Page 164)

Chapter 14 Certificates
ZyXEL NWA-3500 User’s Guide
164
Certification authorities maintain directory servers with databases of valid and revoked
certificates. A directory of certificates that have been revoked before the scheduled expiration
is called a CRL (Certificate Revocation List). The ZyXEL Device can check a peer’s
certificate against a directory server’s list of revoked certificates. The framework of servers,
software, procedures and policies that handles keys is called PKI (public-key infrastructure).
14.1.1 Advantages of Certificates
Certificates offer the following benefits.
• The ZyXEL Device only has to store the certificates of the certification authorities that
you decide to trust, no matter how many devices you need to authenticate.
• Key distribution is simple and very secure since you can freely distribute public keys and
you never need to transmit private keys.
14.2 Self-signed Certificates
You can have the ZyXEL Device act as a certification authority and sign its own certificates.
14.3 Verifying a Certificate
Before you import a trusted CA certificate into the ZyXEL Device, you should verify that you
have the actual certificate. This is especially important since the ZyXEL Device also trusts any
valid certificate signed by any of the imported trusted CA certificates.
14.3.1 Checking the Fingerprint of a Certificate on Your Computer
A certificate’s fingerprints are message digests calculated using the MD5 or SHA1 algorithms.
The following procedure describes how to check a certificate’s fingerprint to verify that you
have the actual certificate.
1 Browse to where you have the certificate saved on your computer.
2 Make sure that the certificate has a “.cer” or “.crt” file name extension.
Figure 96 Certificates on Your Computer
3 Double-click the certificate’s icon to open the Certificate window. Click the Details tab
and scroll down to the Thumbprint Algorithm and Thumbprint fields.