6.5.17 Juniper SRX

The Juniper SRX: IPsec VPN template imports the certificate, private key, and intermediate chain into the SRX PKI store and binds the certificate to the IKE policy behind an existing IPsec VPN.

Enable the Junos REST API

Enable REST over HTTPS on the SRX:

set system services rest https

The service defaults to TCP 3443. Include the port in Junos REST hostname or IP, for example srx.example.com:3443, when it is not 443.

Account permissions

The Junos account needs privileges for:

• PKI operations
• File operations
• Configuration changes
• VPN configuration

A super-user class login satisfies these requirements. The template uses HTTP Basic authentication, so the username cannot contain a colon.

Existing VPN requirement

Set IPsec VPN name to an existing security ipsec vpn object. Its gateway and IKE policy must already use certificate authentication. The template does not create the VPN or convert a preshared-key configuration.

CertKit creates missing CA profiles, imports the chain, assigns a deterministic CertKit certificate name, updates the IKE policy, and removes superseded CertKit certificates.

Shared IKE policies and existing SAs

The certificate is bound at the IKE policy. If several gateways or VPNs share that policy, all of them receive the new certificate selection.

Established IKE security associations continue using the prior certificate until rekey or reauthentication. A successful deployment therefore does not force existing tunnels to renegotiate immediately.

Common problems

• Connection refused: confirm REST HTTPS is enabled, the port is correct, and the agent can reach it.
• Authorization failure: confirm the user has PKI, file, configuration, and VPN privileges.
• VPN not found: use the IPsec VPN object name, not the IKE gateway or policy name.
• Unexpected additional VPNs change: check whether they share the same IKE policy.

For a product overview, see certificate automation for Juniper SRX.