This article describes how to load and bind an intermediate CA certificate into SRX devices when trying to connect to a UAC device.

In normal scenarios, only the CA certificate and the local certificate are used for SRX-to-UAC connectivity. However, if there is any intermediate certificate involved, then we need to load and bind the intermediate certificate to the same UAC to bring the connectivity up.

This article describes how to link both the CA certificate (root certificate) and the intermediate certificate to the same UAC settings.

Perform the following steps:

1. Load both the root CA certificate and the intermediate CA certificate into the SRX device ( /var/tmp/ ).

For example:

root-ca.crt
Int-cert.crt

• Load the root CA certificate to the CA profile UAC-profile :

  root> request security pki ca-certificate load ca-profile UAC-profile filename /var/tmp/root-ca.crt

• Load the intermediate certificate to the CA profile UAC-profile-1 :

  root> request security pki ca-certificate load ca-profile UAC-profile-1 filename /var/tmp/Int-cert.crt

For more details on generating a key pair / loading the PKI certificate, see Junos OS IPsec VPN with PKI Certificates Primer .

2. Bind the two CA profiles to the UAC configuration.

root# show services unified-access-control
infranet-controller uac.lan {
address 192.168.1.11;
interface fe-0/0/0.0;
password "$ABC123"; ## SECRET-DATA
ca-profile [ UAC-profile UAC-profile-1 ]; <<<<<<<<< It should look like this.
}

2020-03-05: Minor non-technical edits

2020-03-05: Article edited and Published