| 14.8 |  | Scaling PIX Security Appliance VPNs |
| 14.8.1 |  | CA server fulfilling requests from IPSec peers |

| This section explains how to scale PIX VPNs using certificate authorities (CAs). The use of pre-shared keys for IKE authentication works well when only a few IPSec peers need to be configured. CAs enable scaling to a large number of IPSec peers, making CAs a good solution. The CA server enrollment process can be largely automated for use in large deployments. Each IPSec peer individually enrolls with the CA server and obtains public and private encryption keys compatible with other peers enrolled with the server.

Without digital certificates, each IPSec peer must be manually configured for every peer with which it communicates. Without certificates, every new peer added to the network requires the administrator to make a configuration change on every other peer it securely communicates with. However, when using digital certificates, each peer is enrolled with a CA. When two peers wish to communicate, they exchange certificates and digitally sign data to authenticate each other.

When a new peer is added to the network, that peer simply enrolls with a CA. None of the other peers need modification. When the new peer attempts to make an IPSec connection, certificates are automatically exchanged and the peer can be authenticated.

With a CA, a peer authenticates itself to the remote peer by sending a certificate to the remote peer and performing some public key cryptography. Each peer sends its own unique certificate, which is issued and validated by the CA. This is called IKE with an RSA signature. This process works because of the following:

- Each peer certificate encapsulates the public key of the peer.
- The CA authenticates each certificate.
- All participating peers recognize the CA as an authenticating authority.

The peer can continue sending its own certificate for multiple IPSec sessions, and to multiple IPSec peers, until the certificate expires. When its certificate expires, the peer administrator must obtain a new one from the CA.

CAs can also revoke certificates for peers that will no longer participate in IPSec. Other peers do not recognize revoked certificates as valid. Revoked certificates are listed in a certificate revocation list (CRL), which each peer checks before accepting the certificate of another peer.

Some CAs have a registration authority (RA) as part of their implementation. An RA is essentially a server that acts as a proxy for the CA. This allows the CA functions to continue when the CA is off line.