Administrator Guide

During the initial TLS protocol negotiation, both participating parties also check to see if the other’s certicate is revoked by the CA. To do
this check, the devices query the CA’s designated OCSP responder on the network. The OCSP responder information is included in the
presented certicate, the Intermediate CA inserts the info upon signing it, or it may be statically congured on the host.
Information about installing CA certicates
Dell Networking OS enables you to download and install X.509v3 certicates from Certicate Authorities (CAs).
In a data center environment, CA certicates are created by trusted hosts on the network. By digitally signing devices' certicates with the
CA's private key, trust can be established among all devices in a network. These CA certicates, installed on each of the devices, are used
to verify certicates presented by clients and servers such as the Syslog servers.
Dell Networking OS allows you to download CA certicates using the crypto ca-cert install command. In this command, you can
specify:
• That the certicate is a CA certicate
• The location from which to download the certicate and the protocol to use. For example, tftp://192.168.1.100/
certificates/CAcert.pem. Locations can be usbash, built-in ash, TFTP, FTP, or SCP hosts.
After you download a CA certicate, the system veries the following aspects of the CA certicate:
• The system checks if “CA:TRUE” is specied in the certicate’s extensions section and the keyCertSign bit (bit 5) is set in the
KeyUsage bit string extension. If these extensions are not set, the system does not install the certicate.
• The system checks if the Issuer and Subject elds are the same. If these elds are the same, then the certicate is a self-signed
certicate. These certicates are also called the root CA certicates, as they are not signed by another CA. The system veries the
certicate with its own public key and install the certicate.
• If the Issuer and Subjects elds dier, then the certicate is signed by another CA farther up the chain. These certicates are also
called intermediate certicates. If a higher CA certicate is installed on the switch, then the system veries the downloaded certicate
with the CA's public key. The system repeats this process until the root certicate is reached. The certicate is rejected if the signature
verication fails.
• If a higher CA certicate is not installed on the switch, the system rejects the intermediate CA certicate and logs the attempt. The
system also displays a message indicating the reason for the failure of CA certicate installation. The system checks the “not before”
and “not after” elds against the current system date to ensure that the certicate has not expired.
The veried CA certicate is installed on the switch by adding it to an existing le that contains trusted certicates. The certicate is
inserted into the certicate le that stores certicates in a root-last order. Meaning, the downloaded certicate is t into the le before its
own issuer but following any certicates that it may have issued. This way, the system ensures that the CA certicates le is kept in a root-
last order. The le may contain multiple certicates in PEM format concatenated together. This le is stored in a private and persistent
location on the device such as the flash://ADMIN_DIR folder.
After the CA certicate is installed, the system can secure communications with TLS servers by verifying certicates that are signed by the
CA.
Installing CA certicate
To install a CA certicate, enter the crypto ca-cert install {path} command in Global Conguration mode.
Information about Creating Certicate Signing
Requests (CSR)
Certicate Signing Request (CSR) enables a device to get a X.509v3 certicate from a CA.
In order for a device to get a X.509v3 certicate, the device rst requests a certicate from a CA through a Certicate Signing Request
(CSR). While creating a CSR, you need to provide the information about the certicate and the private key details. Dell Networking OS
enable you to create a private key and a CSR for a device using a single command.
X.509v3
1141