IPsec PKI

Manage the X.509 certificate authority and certificates used for certificate-authenticated tunnels. Private keys stay in the router's PKI store; client bundles are retrieved out-of-band.

{{#ERROR}}
{{ERROR}}
{{/ERROR}} {{#FLASH}}
{{FLASH}}
{{/FLASH}} {{#APPLY_JOB}}
{{APPLY_JOB_TITLE}}

Working… this page updates automatically.

{{/APPLY_JOB}} {{#NO_WRITE}}
You have read-only access to the IPsec PKI. Creating a CA, issuing, installing, revoking, or exporting needs ipsec_cert:*:write (net-admin role).
{{/NO_WRITE}} {{#NO_SECRET}}
Creating a CA and exporting client bundles also need secret:*:write (they store a passphrase in the secret store).
{{/NO_SECRET}} {{#BUNDLE}}

Client bundle exported

The encrypted client bundle for {{BUNDLE_HOST}} (CA {{BUNDLE_CA}}) was written to the router's PKI store. For security it is not downloaded through this web interface — the bundle carries the client private key, which never transits the web tier.

Retrieve it out-of-band from a trusted shell on the router, e.g.:

doas ikectl ca {{BUNDLE_CA}} certificate {{BUNDLE_HOST}} export
# the bundle is written under the CA store; copy it off with scp, e.g.
scp root@this-router:/etc/ssl/{{BUNDLE_CA}}/<bundle> .

The bundle is encrypted with the export passphrase you just entered — relay that passphrase to the client by a separate secure channel.

{{/BUNDLE}}

Certificate authority

{{#HAS_CA}}{{CA_STATE}}{{/HAS_CA}}
{{#HAS_CA}}

Managed CA {{CA_NAME}}{{#CA_BADMODE}} — key file permissions need attention{{/CA_BADMODE}}.

{{/HAS_CA}} {{#NO_CA}}

No managed CA yet. Create one below to issue server and client certificates.

{{/NO_CA}} {{#CAN_WRITE}}

The CA passphrase is generated and stored on the router automatically; you never type or see it.

{{/CAN_WRITE}}
{{#CAN_WRITE}}

Certificates

Issue a certificate

Install into iked

Revoke a certificate

Export a client bundle

The bundle is encrypted with this passphrase and written to the router; retrieve it out-of-band (it is never downloaded through the web).

{{/CAN_WRITE}}

Inventory

{{#HAS_INVENTORY}} 
{{INVENTORY}}
{{/HAS_INVENTORY}} {{#NO_INVENTORY}}

No certificate inventory to show. Enter a CA name and refresh.

{{/NO_INVENTORY}}