SRX

Hello,

How does an IKE peer validate another peer's certificate up the certificate chain to the root CA certificate? Does the SRX come preconfigured with some trusted root CA certs?

Thanks,

Alshan

You will need to load the CA Cert from the issuing authority along with the issued local cert and the CRL (if using) Junos currently supports cert issuance from:

Entrust

Microsoft

Verisign 

Hi,

Thanks for the response. Does that mean that both peers will need to have obtained their certs from the same CA?
Or is it possible for an IKE peer to load root certs from all three CAs so that  it can trust any cert signed by those vendors?

Thanks,

Alshan

I would think that the latter would function fine, however I don't have multple cert vendors so I have never tested that scenario. 

Alrighty, thanks for the help 🙂