Importing Ca Certificate; Porting The Certificate Onto Another Switch; Create A Keypair And Associate It To A Trustpoint - Motorola WS5100 Series Migration Giude

2. Generate Certificate Request for the trustpoint external.
WS5100(config)#crypto pki enroll external request
This generates a Certificate Request.
3. Send the request to the ftp server specified.Get the request signed by Appropriate CA.( Windows 2003
Server will also do).
WS5100(config)#crypto pki export external request ftp://<user:password>@ IP/
Path/File
4. Import the Signed Certificate on to the WS5100 Switch through either ftp or tftp
WS5100(config)#crypto pki import external certificate ftp://<user:password>@
IP/ Path/servcert.pem
If the certificate is valid and matches the key then it is successfully imported. This allows import of
certificate in either PEM or DER format from the specified URL.

8.2.3 Importing CA Certificate

CA certificate can be associated with an existing trustpoint which already has server certificate associated
with it or a new trustpoint.
CA Certificate can be imported to a trustpoint 'external'.
WS5100(config)#crypto pki authenticate external ftp://<user:password>@ IP/
Path/cacert.pem
Where cacert.pem is a Ca Certificate. This allows import of ca certificate in either PEM or DER format from
the specified URL.

8.2.4 Porting the Certificate Onto Another Switch

A key pair can be generated seperated and can be exported, imported and assigned to a trustpoint. The
following usecase explains how a certificate is ported to another switch.

8.2.4.1 Create a Keypair and Associate it to a Trustpoint

Create key pair key1 and associate it to trustpoint tpt1. Generate a certificate request for the trustpoint and
get the request signed by a certificate authority. Next import the signed server certificate and export the key
that is associated to the trustpoint tpt1.
To port the same server certificate on to another switch, import the key and certificate onto another switch
specified in Importing the Certificate to Another
1. Generate an rsa key pair
WS5100(config)#crypto key generate rsa key1 1024
WS5100(config)#show crypto key mypubkey rsa
Keypair <name> Configured
************************************************
key1
Switch.
8-3
Certificate Management