CLI Guide

Switch Management Commands 2384
crypto certificate generate
Use the crypto certificate generate command to generate a self-signed
HTTPS certificate.
Syntax
crypto certificate number generate
• number—Specifies the certificate number. (Range: 1–2)
• generate—Regenerates the SSL RSA key.
Default Configuration
This command has no default configuration.
Command Mode
Global Configuration mode
User Guidelines
This command is not saved in the router switch configuration; however, the
certificate and keys generated by this command are saved in the private
configuration. If the RSA keys do not exist, the key-generate command in
Crypto Certificate Generation mode must be used. The key-generate sub-
command regenerates the RSA key pair. At least the common name must be
configured for a certificate to be valid.
To save the generated certificate and keys on the local switch and distribute
the certificate across a stack, save the configuration. Otherwise, the certificate
and keys will not be available after the next reboot.
If the common-name is not configured, the certificate is generated with a
common name equal to the lowest IP address of the switch. If a duration is
not configured, the certificate is generated with a duration of 365 days.
As of firmware release 6.6.1, the key length of the certificate is increased to
2048 bits and the switch uses SHA-256 to sign the generated certificate. Any
previously generated certificates are left unaltered.
This command generates two files:
• sslt_certN.pem
• sslt_keyN.pem