topic IPSec VPN - Multiple level chain of trust certificate in Firewall and Security Management

IPSec VPN - Multiple level chain of trust certificate

Benjamin133030 — Mon, 29 Sep 2025 09:33:23 GMT

Hello,
I’m looking to set up a VPN tunnel using certificate-based authentication, and I have a question regarding how to implement a multi-level trust chain on an SMS (R81-20).
Currently, each party shares its public certificate chain for authentication. For a two-level structure (Root CA > Sub CA), the Root CA certificate is registered in the SMS as a Trusted CA, and the Sub CA certificate is registered as a Subordinate CA:

Trusted Root CA > Subordinate Sub CA

However, what is the correct process when there is a third level or more (e.g., Root CA > Sub CA > Sub-Sub CA)?
Registering both the Sub CA and Sub-Sub CA as subordinate CAs in the SMS leads to incorrect interpretation:

Trusted Root CA > Subordinate Sub CA
Trusted Root CA > Subordinate Sub-Sub CA

Alternatively, registering the Sub CA as both a Trusted CA and a Subordinate CA results in this interpretation:

Trusted Root CA > Nothing
Trusted Sub CA > Subordinate Sub CA
Trusted Sub CA > Subordinate Sub-Sub CA

In both cases, the SMS does not correctly interpret the full chain as:

Root CA certifies for Sub CA which certifies for Sub-Sub CA

Would you have a clue on the correct procedure for configuring a multi-level certificate trust chain in the SMS?
Thank you in advance.

Re: IPSec VPN - Multiple level chain of trust certificate

_Val_ — Mon, 29 Sep 2025 11:28:41 GMT

Did you try setting the root CA as well?

Re: IPSec VPN - Multiple level chain of trust certificate

Benjamin133030 — Mon, 29 Sep 2025 11:59:46 GMT

Yes, for both tests, the root CA was registered as Trusted CA on the SMS.

Test 1: We have Root CA as Trusted CA, Sub CA and Sub-Sub CA registered as Subordinate.

Test 2: We have Root CA as Trusted CA, Sub CA both as Trusted CA and Subordinate CA and Sub-Sub CA only registered as Subordinate

Below is how the trust chain is perceived by the SMS afterward:

Test 1:
Trusted Root CA > Subordinate Sub CA
Trusted Root CA > Subordinate Sub-Sub CA

Test 2:
Trusted Root CA > Nothing
Trusted Sub CA > Subordinate Sub CA
Trusted Sub CA > Subordinate Sub-Sub CA

> : is Trusted CA for (chosen automatically by the SMS)

Re: IPSec VPN - Multiple level chain of trust certificate

PhoneBoy — Tue, 30 Sep 2025 00:20:49 GMT

If it's not a Root CA you're importing, you should put the entire certificate chain in there (root and all subordinates).
This applies if it's a Sub Sub CA as well, as far as I know.