Fcap Configuration Overview; Table 36 Fcap Certificate Files - HP StoreFabric SN6500B Administrator's Manual

FCAP configuration overview

Beginning with Fabric OS release 7.0.0, you must configure the switch to use third-party certificates
for authentication with the peer switch.
To perform authentication with FCAP protocol with certificates issued from third party, the user has
to perform following steps:
1. Choose a certificate authority (CA).
2. Generate a public, private key, passphrase and a CSR on each switch.
3. Store the CSR from each switch on a file server.
4. Obtain the certificates from the CA.
5. On each switch, install the CA certificate before installing switch certificate.
6. After the CA certificate is installed, install the switch certificate on each switch.
7.
8. Use the newly installed certificates by starting the authentication process.
Generating the key and CSR for FCAP
The public/private key and CSR has to be generated for the local and remote switches that will
participate in the authentication. In FCAP, one command is used to generate the public/private key
the CSR, and the passphrase.
1. Log in to the switch using an account with admin permissions, or an account associated with
2. Enter the secCertUtil generate -fcapall -keysize command on the local switch.
3. Repeat
Fabric OS Administrator's Guide
53-1002745-02
You can request a certificate from a CA through a Web browser. After you request a certificate,
the CA either sends certificate files by e-mail (public) or gives access to them on a remote host
(private). Typically, the CA provides the certificate files listed in
ATTENTION
Only the .pem file is supported for FCAP authentication.
TABLE 36
FCAP certificate files
Certificate file Description
nameCA.pem The CA certificate. It must be installed on the remote and local switch to verify the
validity of the switch certificate or switch validation fails.
name.pem The switch certificate.
Update the switch database for peer switches to use third-party certificates.
the chassis role and having OM permissions for the PKI RBAC class of commands.
switch:admin> seccertutil generate -fcapall -keysize 1024
WARNING!!!
About to create FCAP:
ARE YOU SURE (yes, y, no, n): [no] y
Installing Private Key and Csr...
Switch key pair and CSR generated...
step 2 on the remote switch.
Authentication policy for fabric elements
Table
7
36.
215