Ssl Server Policy Configuration Example - HP 12500 Series Configuration Manual

SSL server policy configuration example

Network requirements
As shown in
For security of the switch and to protect data from being eavesdropped or tampered with, configure the
switch properly so that the users must use HTTPS (HTTP Secure, which uses SSL) to log in to the Web
interface of the device.
Configure the switch as follows:
Configure Switch to work as the HTTPS server and request a certificate for Switch.
•
Request a certificate for Host so that Switch can authenticate the identity of Host.
•
• Configure a CA server to issue certificates to Switch and Host.
Figure 108 Network diagram
Configuration procedure
In this example, the CA server runs Windows Server and has the SCEP plug-in installed.
Before performing the following configurations, make sure that the switch, the host, and the CA server
can reach each other.
Configure the HTTPS server (Switch):
1.
# Create a PKI entity named en, and configure the common name as http-server1 and the FQDN
as ssl.security.com.
< Switch> system-view
[Switch] pki entity en
[Switch-pki-entity-en] common-name http-server1
[Switch-pki-entity-en] fqdn ssl.security.com
[Switch-pki-entity-en] quit
# Create PKI domain 1, specify the trusted CA as ca server, the URL of the registration server as
http://10.1.2.2/certsrv/mscep/mscep.dll, the authority for certificate request as RA, and the
entity for certificate request as en.
[Switch] pki domain 1
[Switch-pki-domain-1] ca identifier ca server
[Switch-pki-domain-1] certificate request url
http://10.1.2.2/certsrv/mscep/mscep.dll
[Switch-pki-domain-1] certificate request from ra
[Switch-pki-domain-1] certificate request entity en
[Switch-pki-domain-1] quit
Figure 108, users can need to access and control the switch through webpages.
315