| 15.5 |  | Using PDM to Create Site-to-Site VPNs |
| 15.5.4 |  | Configuring Certificate Support |

| PDM supports the configuration of Certificate Authority (CA) interoperability with IPSec. This enables the PIX Security Appliance and the CA to communicate, so that the PIX Security Appliance can obtain and use digital certificates from the CA.

The PIX Security Appliance currently supports CA servers from VeriSign, Entrust, Baltimore Technologies, and Microsoft. It is necessary to ensure that the PIX Security Appliance clock is set to the correct UTC month, day, and year before configuring the CA. If the clock is set incorrectly, the CA may reject certificates based on the incorrect timestamps. Also, the lifetime of the certificate and the Certificate Revocation List (CRL) is checked in UTC time.

The PDM window for configuring a CA is accessible from the IKE branch of the Categories tree. The following parameters can be configured in this window:

- Nickname - Name given to the CA.
- CA IP - The IP address of the CA server.
- LDAP IP - The IP address of the Lightweight Directory Access Protocol (LDAP) server.
- CA Script Location - The location of the CA script. The default location and script on the CA server is /cgi-bin/pkiclient.exe. If the CA administrator has not put the CGI script in this location, provide the location and the name of the script in the ca identity command. A PIX Security Appliance uses a subset of the HTTP protocol to contact the CA, so it must identify a particular cgi-bin script to handle CA requests.
- Retry I, Interval - The number of minutes the PIX Security Appliance waits before resending a certificate request to the CA when it does not receive a response from the previous request. It is necessary to specify the amount of time from one to 60 minutes. By default, the PIX Security Appliance retries every minute.
- Retry C, Count - Number of times the PIX Security Appliance will resend a certificate request when it does not receive a certificate from the CA from the previous request. It is necessary to specify a number from one to 100. The default is zero, which indicates it will keep retrying.
- Key M, Modulus - The size of the key modulus, which is between 512 and 2048 bits.
- Certificate Authority - Indicates whether to contact the CA or Registration Authority (RA). Some CA systems provide an RA, which the PIX Security Appliance contacts instead of the CA.