Table of Contents
Advertisement
260
C
12: M
HAPTER
Creating Keys and
Certificates
Choosing the
Appropriate
Certificate
Installation Method
for Your Network
K
C
ANAGING
EYS AND
ERTIFICATES
You must create a public-private key pair, and request, accept, or
generate a digital certificate to exchange with 3Com Wireless Switch
Manager or Web View for management access, or with 802.1X or
WebAAA users for network access. The digital certificates can be
self-signed or signed by a certificate authority (CA). If you use certificates
signed by a CA, you must also install a certificate from the CA to validate
the digital signatures of the certificates installed on the WX switch.
Each of the following types of access requires a separate key pair and
certificate:
Admin—Administrative access through 3Com Wireless Switch
Manager or Web View
EAP—802.1X access for network users who can access SSIDs
encrypted by WEP or WPA, and for users connected to wired
authentication ports
WebAAA—Web access for network users who can use a web page to
log onto an unencrypted SSID
Management access to the CLI through Secure Shell (SSH) also requires a
key pair, but does not use a certificate. (For more SSH information, see
"Managing SSH" on page 83.)
Depending on your network environment, you can use any of the
following methods to install certificates and their public-private key pairs.
The methods differ in terms of simplicity and security. The simplest
method is also the least secure, while the most secure method is slightly
more complex to use.
Self-signed certificate—The easiest method to use because a CA
server is not required. The WX switch generates and signs the
certificate itself. This method is the simplest but is also the least
secure, because the certificate is not validated (signed) by a CA.
PKCS #12 object file certificate—More secure than using
self-signed certificates, but slightly less secure than using a Certificate
Signing Request (CSR), because the private key is distributed in a file
from the CA instead of generated by the WX switch itself. The
PKCS #12 object file is more complex to deal with than self-signed
certificates. However, you can use 3Com Wireless Switch Manager,
Web View, or the CLI to distribute this certificate. The other two
methods can be performed only using the CLI.
Advertisement
Table of Contents
