Reference Guide

Your CA may require specific codes for Country, State or Province, Locality, Organization, and Organizational Unit names.
Make sure that your spelling is correct and matches the CA requirements. If the CA requires that the Common Name be
specified as an FQDN, make sure that the fully qualified domain name is set on the domain name switch/director. The IP
address or FQDN is the switch where the certificate gets installed.
You can also specify the hash type using the -hash <sha1 | sha256> option while generating the CSR. For example,
switch:admin> seccertutil gencsr -hash sha256 -country IN –state Kar –locality Bng –org brocade –
orgunit fos –cn switchip
4. Enter secCertUtil export to store the CSR.
5. Enter the requested information. You can use either FTP or SCP.
If you are set up for Secure Copy Protocol (SCP), you can select it; otherwise, select FTP. Enter the IP address of the switch on
which you generated the CSR. Enter the remote directory name of the FTP server to which the CSR is to be sent. Enter your
account name and password on the server.
The following example exports a CSR.
Select protocol [ftp or scp]: ftp
Enter IP address: 192.1.2.3
Enter remote directory: path_to_remote_directory
Enter Login Name: your account
Enter Password: your password
Success: exported CSR.
Obtaining certificates
Once you have generated a CSR, you will need to follow the instructions on the website of the certificate issuing authority that you want
to use; and then obtain the certificate.
Fabric OS and HTTPS support the following types of files from the Certificate Authority(CA):
∙ .cer (binary)
∙ .crt (binary)
∙ .pem (text)
Typically, the CA provides the certificate files listed in the following table.
TABLE 32 SSL certificate files
Certificate file Description
name .pem The switch certificate.
name Root.pem The root certificate. Typically, this certificate is already installed in the
browser, but if not, you must install it.
name CA.pem The CA certificate. It must be installed in the browser to verify the validity
of the server certificate or server validation fails.
NOTE
You must perform this procedure for each switch.
Use the following procedure to obtain a security certificate.
1. Generate and store the CSR as described in Generating and storing a Certificate Signing Request on page 196.
2. Open a web browser window on the management workstation and go to the CA website. Follow the instructions to request a
certificate. Locate the area in the request form into which you are to paste the CSR.
3. Through a Telnet window, connect to the switch and log in using an account with admin permissions.
Configuring Protocols
Brocade Fabric OS Administration Guide, 8.0.1
53-1004111-02 197