There is a small confusion related to CA certificate and Local certificate. I had asked a similar question before. This time, its a little specific.
For authentication using PKI, below are the steps.
--> Get the CA certificate and load it onto the device.
-->Generate a private and public key pair
-->Request for a local/EE certificate.
Now, the steps followed for those are:
Step1:request security pki ca-certificate enroll ca-profile entrust
Received following certificates: Certificate: C=us, O=juniper, CN=First Officer Fingerprint: 46:71:15:34:f0:a6:41:76:65:81:33:4f:68:47:c4:df:78:b8:e3:3f Certificate: C=us, O=juniper, CN=First Officer Fingerprint: bc:78:87:9b:a7:91:13:20:71:db:ac:b5:56:71:42:ad:1a:b6:46:17 Certificate: C=us, O=juniper Fingerprint: 00:8e:6f:58:dd:68:bf:25:0a:e3:f9:17:70:d6:61:f3:53:a7:79:10 Do you want to load the above CA certificate ?
[yes,no] (no) yes
Question: Once the device gets the CA certificate from the CA server, how does the device verify that its the right server from the fingerprint?
Does saying yes on prompt automatically means that Im trusting the certificate and Ive verified the fingerprint through some OOB means?
And also, the Hashing and encryption is done for the whole certificate content or just the public key of the CA server?
Step2: user@host> request security pki local-certificate enroll certificate-id
In this step, we request for the local-certificate after we generate the key-pair.
Question: Once we obtain the local-certificate from the server, how do we verify that its from the right source or server and authenticity of it?
Is there any signature decryption done? Or does it trust it because we have configured that server under the ca-profile?
Even if it decrypts it, does the device do it that quick? And also, does all the decryption and comparison has to be done manually by a human?
Step3: Lets say a tunnel has to be formed between A and B. A sends the local-certificate to B and B sends it to A.
If Im not wrong, the local-certs contains their respective public keys.
user@host> show security pki local-certificate certificate-id hello detail
Certificate identifier: hello
..... Issuer: Common name: Example-CA, Domain component: local, Domain component: demo Subject: Organization: o1, Organization: o2, Organizational unit: ou1, Organizational unit: ou2, Country: US, State: CA, Locality: Sunnyvale, Common name: cn1, Common name: cn2, Domain component: dc1, Domain component: dc2 Subject string: C=Example, DC=dc1, DC=dc2, ST=CA, L=Sunnyvale, O=o1, O=o2, OU=ou1, OU=ou2, CN=cn1, CN=cn2 Alternate subject: "firstname.lastname@example.org", user.example.net, 192.0.2.1
Public key algorithm: rsaEncryption(1024 bits) 30:81:89:02:81:81:00:b4:14:01:d5:4f:79:87:d5:bb:e6:5e:c1:14
Signature algorithm: sha1WithRSAEncryption
Use for key: Key encipherment, Digital signature, 22.214.171.124.126.96.36.199.2, 188.8.131.52.184.108.40.206.2
Fingerprint: 76:a8:5f:65:b4:bf:bd:10:d8:56:82:65:ff:0d:04:3a:a5:e9:41:dd (sha1) 8f:99:a4:15:98:10:4b:b6:1a:3d:81:13:93:2a:ac:e7 (md5)
Above example shows a local-certificate, and lets say B receives it from A.
How does, B authenticate the certificate? Or how does it know that it has come from A?
I know there is a signature verification done, but what is decrypted and what is compared to prove that the peer authentiicity.
I have gone through documents, but it has not provided me with a clear picture, so I have come here for the answers.