User's Manual

4/1/05 Adding SSL to the Web User Interface
OL-7426-02
Configuration Saved!
• Reboot the Cisco Wireless LAN Controller:
>reset system
Are you sure you would like to reset the system? (y/n) y
System will now restart!
The Cisco Wireless LAN Controller completes the bootup process as described in Step 4:
Connecting and Using the CLI Console in the Cisco 4100 Series Wireless LAN Controller Quick
Start Guide.
• Be sure that operators using the Web User Interface know that they may securely log into the
Cisco Wireless LAN Controller using “https://<Cisco Wireless LAN Controller_IPaddress>.
Refer to the Transferring Files To and From a Cisco Wireless LAN Controller section for other file upload
and download instructions.
Externally Generated CertificateExternally Generated Certificate
Should you desire to use your own Web Administration SSL certificate, complete the following:
• Be sure you have a TFTP server available for the certificate download:
- If you are downloading through the Service port, the TFTP server MUST be on the same
subnet as the Service port, because the Service port is not routable.
- If you are downloading through the DS (Distribution System) network port, the TFTP
server can be on the same or a different subnet, because the DS port is routable.
• Buy or create your own Web Administration SSL key and certificate. If not already done, use a
password, <private_key_password>, to encrypt the key and certificate in a .PEM encoded file.
The PEM-encoded file is called a Web Administration Certificate file
(<webadmincert_name>.pem).
• Move the <webadmincert_name>.pem file to the default directory on your TFTP server.
• Refer to the Using the Cisco SWAN CLI section to connect and use the CLI.
• In the CLI, use the transfer download start command, and answer ‘n’ to the prompt, to view
the current download settings:
>transfer download start
Mode........................................... TFTP
Data Type...................................... Admin Cert
TFTP Server IP................................. xxx.xxx.xxx.xxx
TFTP Path...................................... <directory path>
TFTP Filename..................................
Are you sure you want to start? (y/n)
n
Transfer Canceled
Note: The TFTP server cannot run on the same computer as the Cisco Wireless
Control System, because Cisco WCS and the TFTP server use the same communica-
tion port.
CAUTION: Each certificate has a variable-length embedded RSA Key. The RSA key
can be from 512 bits, which is relatively insecure, through thousands of bits, which is
very secure. When you are obtaining a new certificate from a Certificate Authority
(such as the Microsoft CA), be sure the RSA key embedded in the certificate is AT
LEAST 768 Bits.