On a Juniper Firewall, the command show security pki local-certificate will give all sorts of detail for a local certificate. (The sort of certificate you would use to stand up an IKE connection)
My question is, is there an equivalent command for the certificate being used by the remote peer to validate themselves?
Or, is the remote peer's certificate also considered by Juniper to be a 'local certificate', even though it's for the remote peer?
I can see that there is a command 'show security ike active-peer' that can be used to get the security associate details.
And that there's a command show security ipsec security-associations that gives a lot of details, but not, it appears, the details of the remote certificate (I don't have access to enough equipment to check for myself, I'm afraid)
The page IKE Policy for Digital Certificates on an ES PIC suggests that it's possible to assign a name to the remote certificate.
To define the remote certificate name, include the identity statement at the [edit security ike policy ike-peer-address] hierarchy level:
[edit security ike policy ike-peer-address]
identity identity-name;
It's not clear to me if that name can then be used in the same way that the name of a locally stored certificate can be.
Juniper's introduction to PKI does talk about a "Remote server local certificate", which suggests that maybe for some purposes, local doesn't strictly mean local but also includes "remote local certificates". (Odd concept.)
