Choosing A Ca; Generating A Public/Private Key; Generating And Storing A Csr - HP A7533A - Brocade 4Gb SAN Switch Base Administrator's Manual

Table 18 SSL certificate files (continued)
Certificate file
nameRoot.crt
nameCA.crt
4. On each switch, install and then activate the certificate.
5. If necessary, install the root certificate to the browser on the management workstation.
6. Add the root certificate to the Java Plug-in keystore on the management workstation.

Choosing a CA

To ease maintenance and allow secure out-of-band communication between switches, consider using one
CA to sign all management certificates for a fabric. If you use different CAs, management services operate
correctly, but the Web Tools Fabric Events button is unable to retrieve events for the entire fabric.
Each CA (for example, Verisign or GeoTrust) has slightly different requirements; for example, some
generate certificates based on IP address, while others require an FQDN, and most require a 1024-bit
public/private key while some may accept a 2048-bit key. Consider your fabric configuration, check CA
websites for requirements, and gather all the information that the CA requires.

Generating a public/private key

Perform this procedure on each switch.
1. Connect to the switch and log in as admin.
2. Enter this command to generate a public/private key pair:
switch:admin>
The system reports that this process will disable secure protocols, delete any existing CSR, and delete
any existing certificates.
3. Respond to the prompts to continue and select the key size:
Continue (yes, y, no, n): [no]
Select key size [1024 or 2048]:
Generating new rsa public/private key pair
Done.
IMPORTANT:
limited.

Generating and storing a CSR

After generating a public/private key, perform this procedure on each switch.
1. Connect to the switch and log in as admin.
2. Enter this command:
switch:admin>
3. Enter the requested information:
Country Name (2 letter code, eg, US):
State or Province Name (full name, eg, California):
Locality Name (eg, city name):
Organization Name (eg, company name):
Organizational Unit Name (eg, department name):
Common Name (Fully qualified Domain Name, or IP address):
Generating CSR, file name is: 192.1.2.3.csr
Done.
94 Configuring standard security features
Description
The root certificate. Typically, this certificate is already installed in the
browser, but if not, you must install it.
The CA certificate. It needs to be installed in the browser to verify the
validity of the server certificate or server validation fails.
seccertutil genkey
HP recommends selecting 1024 in most cases. CA support for the 2048-bit key size is
seccertutil gencsr
y
1024
US
San Jose
Brocade
Eng
California
192.1.2.3