Certificate Management; Host Key Type; Combination Of Key And Certificate - ABB EDS500 Series Function Manual

Certificate Management

2.36 Certificate Management
For secure webserver (HTTPS) functionality the EDS500 managed switches requires a
compatible combination of EC key (Eliptic Curve key) and certificate.
In delivery state each EDS500 managed switches has stored its EC key (device key) and its
certificate (device certificate - self-signed) generated from the EC key. This combination is
valid and can be used for the HTTPS functionality.
The usage of the devices' EC key and the devices' certificate (self-signed) is the easiest
way for a HTTPS connection. However, the certificate of each individual device must be
downloaded and integrated into the browser. That can be very complex when managing a
large number of browsers and workstations.
The EC key and certificate can also be generated externally and loaded onto the device. This
enables the use of customer generated keys (external key) and/or certificates (external
certificates).
Every combination of device and external keys and certificates have their advantages.
• Device EC key and device certificate (default state)
• Device EC key and external certificate (CSR)
• External EC key and device certificate
• External EC key and external certificate (CSR or external generated)
The latter combination allows two possibilities. The following chapter describes the
combinations and list.
Generally it should be noted that the activation of certificates takes place directly after the
upload via the web interface. A restart of the device is not necessary.
2.36.1

Host Key Type

The EDS500 managed switches supports only EC (Elliptic curve) keys.
This key is standarized by the name:
• Secp256r1 (SEC 2)
• prime256v1 (X9.62/SECG)
• NIST P-256 (NIST)
The key length has to be 256 bit.
2.36.2

Combination of Key and Certificate

From a technical point of view, the device allows five different ways of using or generating
keys and certificates. Depending on requirements of cyber security and the operating
comfort, the following options are available.
112
Functions
1KGT151021 V000 1