To create a PKI certificate, use a predefined template or specify custom settings. Certificate templates can also be added and edited. You can also export and import certificates.
Before creating your Barracuda NextGen Control Center PKI certificates, you must create and configure the PKI service. For more information, see How to Configure the PKI Service.
Signing CA – Select the certificate authority that must sign the new certificate.
CA Sign Password – The password required for the CA signature. If you do not enter a password, a request is created instead of a certificate.
Template – Select a predefined template that you can edit to create the certificate.
From the General Settings, Subject, and V3 Extensions tabs, you can edit additional certificate settings. For more information about these settings, see PKI Certificate Settings.
You can add a new template or edit an existing template.
From the Select Template list, select the required template.
From the General Settings, Subject, and V3 Extensions tabs, edit the template settings. For more information about these settings, see PKI Certificate Settings.
Try to avoid deleting predefined templates. A predefined template can only be restored by deleting and recreating the PKI service. When you delete the PKI service, all PKI certificates are also deleted.
In the Import Certificate window, select the required certificate and enter the certificate password.
Click Import. The PKI reloads the certificates automatically. If available, an end-user certificate is added to the signing certificate.
Right-click the certificate and select Export Certificate.
In the Export Certificate window, select the export format and private key.
Valid – Contains all valid certificates that have not expired.
Pending – Contains all unsigned certificate requests.
Expired – Contains all expired certificates.
Revoked – Contains all certificates that have been revoked by the administrator.
Right-click the certificate and select View Certificate. In the View Certificate window, all of the certificate settings are displayed.
In the Valid folder, right-click the certificate and select Revoke Certificate. When prompted, enter the parent CAs Sign Password. The revoked certificate is moved to the Revoked folder.
In the Pending directory, right-click the request and select Delete Request. Click Yes.
Right-click the request and select Approve Request. A window opens and displays the values of the request. Enter the sign password of the CA.
Right-click the certificate and select Export Private Key. In the Export Private Key window, select an export format. You can save the private key to a file or the clipboard.
For exporting to clipboard only PEM format is allowed since DER is a binary format.
A Certificate Revokation List (CRL) is a list of client certificates that were revoked before they expired. To export a CRL, right-click the CA and select Export CRL. In the Export CRLwindow, select an export format. Enter the CA password and how many days the CRL is valid.You can save the CRL to a file, clipboard, or distribution points.
To grant access to the local http server, create a local redirect rule for the Barracuda NextGen Control Center.
Right-click the certificate and select Search Certificate. In the Search Certificate window, enter your search criteria. For example, if you enter lient in the Common Name field, all certificates containing this string in the common name will be found. Certificates that contain words such as Client, Client, or MILIENT are listed in your search results. To step through all the certificates in your search results, press F3.