obtention de certificat ipsec pour l2tp en mode hors domaine

Bonjour

Il faut créer un modèle de certificat (IPSec L2TP Offline) dont la clé
privée est exportable.

Onglet RequestHandling, option Allow private key to be exported

Exemple:
1.1.1.1 Onglet: General
Propriété
Valeur

Template display name
L2TP IPSec (Offline)

Template name
L2TPIPSec(Offline)

Validity period
2 year

Renewal period
6 weeks

Publish certificate in Active Directory
uncheck

Do not automatically reenroll if a duplicate certificate exists in
Active Directory
uncheck


1.1.1.2 Onglet : Request Handling
Propriété
Valeur

Purpose
Signature and encryption

Archive subject's encryption private key
Uncheck

Include symmetric algorithms allowed by the subject
Uncheck

Delete revoked or expired certificates (do not archive)
Uncheck

Minimum key size
1024

Allow private key to be exported
Check

Enroll subject without requiring any user input
Check

Prompt the user during enrollment
Uncheck

Prompt the user during enrollment and require user input when private
key is used
Uncheck

CSPs.
F Défault value


1.1.1.3 Onglet : Subject Name
Propriété
Valeur

Supply in the request
Check

Build from this Active Directory information
Uncheck

Subject name format
None

Include e-mail name in subject name
Uncheck

Include this information in alternate subject name
None


1.1.1.4 Onglet : Issuance Requirements
Propriété
Valeur

CA certificate manager for enrollment
Check

This number of authorized signature
Uncheck

Policy type required in signature
None

Application policy
None

Issuance policy
None

Require the following for reenrollment
F Same criteria as for enrollment


1.1.1.5 Onglet : Superseded Templates
Propriété
Valeur

Certificate templates
None


1.1.1.6 Onglet : Extensions
Propriété
Valeur

Application policies
F Authentification du serveur

Certificate Template Information
Template name : L2TP IPSec

Subject type : Ordinateur

Issuance Policies
None

Key usage
F Digital signature

F Allow key exchange only with key encryption


1.1.1.7 Onglet : Security
Groupe / compte
Droits d'accès

Authenticated Users
Read

MACOMPAGNIE-PKISubCAEnrollAgts
Read, Enroll

MACOMPAGNIE-PKIEnterpriseAdmins
Read, Write






Cordialement
--
Stanislas Quastana, CISSP
Architecte Infrastructure
Division Développeurs et Plate-Forme d'Entreprise
Microsoft France



<ericl@ciminfo.fr> wrote in message
news:eqLy9UJ%23EHA.1452@TK2MSFTNGP11.phx.gbl...

Salut

Je n'arrive a savoir comment obtenir un certificat IPSEC pour réaliser du
L2TP quand le poste desiré ne fait pas partit du domaine et se certificat
n'est pas exportable

Merci