Administrator Guide

You will be prompted to enter information that will be incorporated into the certificate
request. This is called a Distinguished Name or a DN. There are quite a few fields but you
can leave some blank
For some fields there will be a default value. If you enter '.', the field will be left
blank.
-----
Country Name (2 letter code) [AU]: US
State or Province Name (full name) [Some-State]: New Hampshire
Locality Name (eg, city) []: Nashua
Organization Name (eg, company) [Internet Widgits Pty Ltd]: Dell Equallogic
Organizational Unit Name (eg, section) []: Networking and iSCSI
Common Name (e.g. server FQDN or YOUR name) []: kirt5.lab.equallogic.com
Email Address []: [e-mail]
Please enter the following 'extra' attributes to be sent with your certificate request
A challenge password []:
An optional company name []:
5. Generate a certificate request for the strongSwan host:
1.32 draoidoir:fwoods> openssl req -key client.key -new -out draoidoir.csr
You are about to be asked to enter information that will be incorporated into your
certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value. If you enter '.', the field will be left
blank.
-----
Country Name (2 letter code) [AU]: US
State or Province Name (full name) [Some-State]: New Hampshire
Locality Name (eg, city) []: Nashua
Organization Name (eg, company) [Internet Widgits Pty Ltd]: Dell Equallogic
Organizational Unit Name (eg, section) []: Networking and iSCSI
Common Name (e.g. server FQDN or YOUR name) []: draoidoir.lab.equallogic.com
Email Address []: [e-mail]
Please enter the following 'extra' attributes to be sent with your certificate request
A challenge password []:
An optional company name []:
6. Sign the array's certificate request, creating the local certificate for kirt5:
1.33 draoidoir:fwoods> openssl x509 -req -in kirt5.csr -CA root-ca.crt -CAcreateserial -
CAkey server.key -out kirt5.crt -days 365
Signature ok
subject=/C=US/ST=New Hampshire/L=Nashua/O=Dell Equallogic/OU=Networking and iSCSI/
CN=kirt5.lab.equallogic.com/emailAddress=[e-mail]
Getting CA Private Key
7. Do the same for the strongSwan side:
1.34 draoidoir:fwoods> openssl x509 -req -in draoidoir.csr -CA root-ca.crt -CAcreateserial -
CAkey server.key -out draoidoir.crt -days 365
Signature ok
subject=/C=US/ST=New Hampshire/L=Nashua/O=Dell Equallogic/OU=Networking and iSCSI/
CN=draoidoir.lab.equallogic.com/emailAddress=[e-mail]
Getting CA Private Key
Now we can look at the two resulting certificates:
1.35 draoidoir:fwoods> openssl x509 -text -noout -in kirt5.crt
94
About Group-Level Security