Creating certificate bundles

Certificate bundles are used to store a group of related certificate information. A certificate bundle contains zero or more certificates and zero or more certificate revocation lists (CRLs). When an IKEv2 negotiation uses a digital signature authentication method, this certificate information can be exchanged using a certificate bundle. When information is exchanged using a certificate bundle, a URL that identifies the certificate bundle and a hash of the data in the certificate bundle is sent to the remote security endpoint. The remote security endpoint then retrieves the certificate bundle from an HTTP server, and uses the bundle when it validates the digital signature.

A certificate bundle can hold in a single location all relevant information about an entire trust chain. The following types of information can be included in a certificate bundle:

The certificate that was used to create a digital signature
The certificates of certificate authorities in the trust chain
Certificate revocation lists (CRLs)

Although consolidating this information in one place has advantages, consolidation might cause the remote security endpoint to retrieve unneeded information. Often the remote security endpoint already has knowledge of most of the certificates in the trust chain and is capable of retrieving CRL information using another method. In such cases, it might be more efficient to use individual certificates, rather than a certificate bundle.

You can use the certbundle command to create one or more files, each of which contains one certificate bundle. A certificate bundle options file is required as input to the certbundle command. The certificate bundle options file identifies how many certificate bundles are created, as well as the contents of each certificate bundle.

Guidelines:

All certificate information in a certificate bundle file should be for the same trust chain.
You should not include CRL information in a certificate bundle except when there is no other way for the remote security endpoint to retrieve the CRL information. Because certificate authorities periodically issue new CRLs, CRL information that is stored in a certificate bundle must be constantly updated to contain the most recent CRL information.

Rule: Do not put the certificate for the root certificate authority in a certificate bundle. An IKE implementation cannot accept a certificate for the root certificate authority from an untrusted source and, because certificate bundles are considered an untrusted source, any root certificates they contain are unusable. In addition, putting this certificate in the certificate bundle needlessly increases the size of the certificate bundle.