Users Guide

• Both take the name of the certificate. For example, if you install a certificate using:
OS10# crypto cert install cert-file home://Dell_host1.pem key-file home://abcd.key
The certificate-key pair is installed as Dell_host1.pem and Dell_host1.key. In configuration commands, refer to the pair as
Dell_host1. When you configure a security profile, you would enter Dell_host1 in the certificate certificate-
name command.
• For security reasons, because the key file contains private key information, it copied to a secure location in the OS10 file system
and deleted from its original location specified in the key-file key-path parameter.
NOTE: fips installs the certificate-key pair as FIPS-compliant. Enter fips to install a certificate-key pair that is
used by a FIPS-aware application, such as Syslog over TLS. If you do not enter fips, the certificate-key pair is
stored as a non-FIPS-compliant pair.
You determine if the certificate-key pair is generated as FIPS-compliant. Do not use FIPS-compliant certificate-key
pairs outside of FIPS mode. When FIPS mode is enabled, you can still generate CSRs for non-FIPS certificates for
use with non-FIPS applications. Be sure to install these certificates as non-FIPS with the crypto cert install
command.
3. Configure a security profile for system logging over TLS using an X.509v3 certificate.
a. Create a Syslog security profile in CONFIGURATION mode. See Security profiles for more information.
crypto security-profile profile-name
b. Assign an X.509v3 certificate and private key pair to the security profile in SECURITY-PROFILE mode. For certificate-name,
enter the name of the certificate-key pair as it appears in the show crypto certs output without the .pem extension.
certificate certificate-name
exit
c. Create a system logging-specific profile in CONFIGURATION mode.
logging security-profile profile-name
Where profile-name is the name of the Syslog security profile created in Step 2a with the crypto security-profile
profile-name command. You cannot delete a crypto server profile if it is configured for a logging server.
If you reconfigure crypto security profile-name, configured Syslog TLS servers are automatically updated to use the new
certificate-key pair used by the new profile.
If you reconfigure the certificate assigned to a crypto security profile, Syslog TLS servers are automatically updated to use new
certificate-key pair.
If you delete a certificate from a configured crypto security profile, system logging over TLS fails. A host certificate is required for the
protocol exchange with an external device.
4. Configure a remote TLS server to receive system messages in CONFIGURATION mode.
logging server {ipv4–address | ipv6–address} tls [port-number]
[severity
severity-level] [vrf {management | vrf-name]
Example: Configure Syslog over TLS
OS10# copy tftp://CAadmin:secret@172.11.222.1/cacert.pem home://cacert.pem
OS10# crypto ca-cert install home://cacert.pem
Processing certificate ...
Installed Root CA certificate
CommonName = Certificate Authority CA
IssuerName = Certificate Authority CA
OS10# show crypto ca-certs
--------------------------------------
| Locally installed certificates |
--------------------------------------
cacert.crt
OS10# crypto cert generate request cert-file home://clientreq.pem key-file home://
clientkey.pem cname "Top of Rack 6" altname "IP:10.0.0.6 DNS:tor6.dell.com" email
1322
Troubleshoot OS10