Configuring Certificates On The Mds Switch Using The Cli - Cisco 9134 - MDS Multilayer Fabric Switch Troubleshooting Manual

Chapter 24 Troubleshooting Digital Certificates
S e n d d o c u m e n t a t i o n c o m m e n t s t o m d s f e e d b a c k - d o c @ c i s c o . c o m
Follow these steps to import the identity certificate:
Step 10
a.
b.
c.
d.
e.

Configuring Certificates on the MDS Switch Using the CLI

To configure certificates on an MDS switch using the CLI, follow these steps:
Configure the switch FQDN.
Step 1
switch# config t
Enter configuration commands, one per line.
switch(config)# switchname Vegas-1
Vegas-1(config)#
Step 2 Configure the DNS domain name for the switch.
Vegas-1(config)# ip domain-name cisco.com
Vegas-1(config)#
Create a trust point.
Step 3
Vegas-1(config)# crypto ca trustpoint myCA
Vegas-1(config-trustpoint)# exit
Vegas-1(config)# do show crypto ca trustpoints
trustpoint: myCA; key:
revokation methods:
Vegas-1(config)#
Create an RSA key pair for the switch.
Step 4
Vegas-1(config)# crypto key generate rsa label myKey exportable modulus 1024
Vegas-1(config)# do show crypto key mypubkey rsa
key label: myKey
key size: 1024
exportable: yes
Vegas-1(config)#
Associate the RSA key pair to the trust point.
Step 5
Vegas-1(config)# crypto ca trustpoint myCA
OL-9285-05
In Device Manager, choose Admin > Flash Files and select Copy, then select tftp from the Protocol
radio buttons to tftp copy the CA certificate to bootflash.
In Fabric Manager, choose Switches > Security > PKI and select the TrustPoint Actions tab.
Select the certimport option from the Command drop-down menu to import an identity certificate
in this trust point.
The identity certificate should be available in PEM format in a file in bootflash.
Note
Enter the name of the certificate file that was copied to bootflash in the URL field in the
bootflash:filename format.
Click Apply Changes to save your changes.
If successful, the values of the identity certificate and its related objects, like the certificate file
name, are automatically updated with the appropriate values as per the corresponding attributes in
the identity certificate.
crl
End with CNTL/Z.
Cisco MDS 9000 Family Troubleshooting Guide, Release 3.x
Digital Certificate Issues
24-7