Enroll a Device with a CA

The basic process for enrolling an IPSec peer with a CA includes the following steps. Most of these steps have been automated using the SCEP protocol supported by many CA server providers. Each CA vender determines how long certificates are valid.

• Step 1 Configure the router for CA support.

• Step 2 Generate a public and private key pair on the router.

• Step 3 The router authenticates the CA server.

• Step 4 The router sends a certificate request to the CA.

• Step 5 The CA creates and signs an identity (ID) and root certificate and, optionally, an RA certificate.

• Step 6 The CA sends the certificates to the router and posts the certificates in its public repository (directory).

The configuration commands are covered under Task 2 “Configure CA support” activities.