Dell Powerconnect W-ClearPass Virtual Appliances W-ClearPass Guest 6.0 Deploym - Page 108

l The "not valid before" time is set to the current time, less the clock skew allowance. l The "not valid after" time is first calculated as the earliest of the following: l The current time, plus the maximum validity period. l The expiration time of the user account for whom the device certificate is being issued. l The "not valid after" time is then increased by the clock skew allowance. 5. The Key Type drop-down list specifies the type of private key that should be created when issuing a new certificate. You can select one of these options: l 1024-bit RSA - created by device: Lower security. Uses SCEP to provision the EAP-TLS certificate. l 2048-bit RSA - created by device: Recommended for general use. Uses SCEP to provision the EAP-TLS certificate. l 1024-bit RSA - created by server: Lower security. l 2048-bit RSA - created by server: Recommended for general use. l 4096-bit RSA - created by server: Higher security. NOTE: Using a private key containing more bits will increase security, but will also increase the processing time required to create the certificate and authenticate the device. The additional processing required will also affect the battery life of a mobile device. It is recommended to use the smallest private key size that is feasible for your organization. The "created by device" options use SCEP to provision the EAP-TLS device certificate, so the private key is known only to the device rather than also known by the user. When a "created by device" option is selected, the generated key is used instead of a username/password authentication defined in Network Settings. 6. Mark the Include device information in TLS client certificates check box to include additional fields in the TLS client certificate issued for a device. These fields are stored in the subject alternative name (subjectAltName) of the certificate. Refer to Table 18 for a list of the fields that are stored in the certificate when this option is enabled. Storing additional device information in the client certificate allows for additional authorization checks to be performed during device authentication. NOTE: If you are usinga W-Series Controller to perform EAP-TLS authentication using these client certificates, you must have Aruba OS 6.1 or later to enable this option. Table 18: Device Information Stored in TLS Client Certificates Name Description Device ICCID Integrated Circuit Card Identifier (ICCID) number from the Subscriber Identity Module (SIM) card present in the device. This is only available for devices with GSM (cellular network) capability, where a SIM card has been installed. Device IMEI International Mobile Equipment Identity (IMEI) number allocated to this device. This is only available for devices with GSM (cellular network) capability. Device Serial Serial number of the device. Device Type Type of device, such as "iOS", "Android", etc. Device UDID Unique device identifier (UDID) for this device. This is typically a 64-bit, 128-bit or 160-bit number represented in hexadecimal (16, 32, or 40 OID mdpsDeviceIccid (.4) mdpsDeviceImei (.3) mdpsDeviceSerial (.9) mdpsDeviceType (.1) mdpsDeviceUdid (.2) 108 | Configuring Certificate Properties for Device Provisioning Dell Networking W-ClearPass Guest 6.0 | Deployment Guide