Choosing A Certificate Authority; Generating A Public/Private Key - HP A7533A - Brocade 4Gb SAN Switch Base Administrator's Manual

3. Obtain the certificates from the CA.
You can request a certificate from a CA through a Web browser. After you request a certificate, the CA
either sends certificate files by email (public) or gives access to them on a remote host (private). Typically,
the CA provides the certificate files listed in
Table 22 SSL Certificate Files
Certificate File
name
.crt
name
Root.crt
name
CA.crt
4. On each switch:
a. Install the certificate.
b. Activate the certificate.
5. If necessary, install the root certificate to the browser on the management workstation.
6. Add the root certificate to the Java Plug-in keystore on the management workstation.

Choosing a certificate authority

To ease maintenance and allow secure out-of-band communication between switches, consider using one
certificate authority (CA) to sign all management certificates for a fabric. If you use different CAs,
management services operate correctly, but the Web Tools Fabric Events button is unable to retrieve events
for the entire fabric.
Each CA (for example, Verisign or GeoTrust) has slightly different requirements; for example, some
generate certificates based on IP address, while others require an FQDN, and most require a 1024-bit
public/private key while some might accept a 2048-bit key. Consider your fabric configuration, check CA
Web sites for requirements, and gather all the information that the CA requires.

Generating a public/private key

Perform this procedure on each switch:
1. Connect to the switch and log in as admin.
2. Enter this command to generate a public/private key pair:
switch:admin> seccertutil genkey
The system reports that this process will disable secure protocols, delete any existing CSR, and delete
any existing certificates.
3. Respond to the prompts to continue and select the key size:
Continue (yes, y, no, n): [no] y
Select key size [1024 or 2048]: 1024
Generating new rsa public/private key pair
Done.
Because CA support for the 2048-bit key size is limited, you should select 1024 in most cases.
Table 22.
Description
The switch certificate.
The root certificate. Typically, this certificate is already installed in
the browser, but if not, you must install it.
The CA certificate. It is not necessary to install this, but you can if
you want the CA name to be displayed in the browser window.
Fabric OS 5.3.0 administrator guide 95