Users Guide

Command mode EXEC
Usage
information
Generate a CSR when you want a CA to sign a host certificate. Generate a self-signed certificate if you
do not set up a CA and implement a certificate trust model in your network.
If you enter the cert-file option, you must enter all the required parameters, including the local path
where the certificate and private key are stored.
If you do not specify the cert-file option, you are prompted to fill in the other parameter values for
the certificate interactively; for example:
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a
DN.
There are quite a few fields but you can leave some blank.
For some fields there will be a default value; if you enter '.', the
field will be left blank.
Country Name (2 letter code) [US]:
State or Province Name (full name) [Some-State]:California
Locality Name (eg, city) []:San Francisco
Organization Name (eg, company) []:Starfleet Command
Organizational Unit Name (eg, section) []:NCC-1701A
Common Name (eg, YOUR name) [hostname]:S4148-001
Email Address []:[e-mail]
If the system is in FIPS mode — crypto fips enable command — the CSR and private key are
generated using approved algorithms from a cryptographic library that has been validated against the
FIPS 140-2 standard. You can install the FIPS-compliant certificate-key pair using the crypto cert
install command with the fips option.
Examples
OS10# crypto cert generate request cert-file home://cert1.pem key-file
home://cee OS10-VM email [e-mail] length 1024 altname DNS.dell.com
Processing certificate ...
Successfully created CSR file /home/admin/cert1.pem and key
OS10# crypto cert generate self-signed cert-file home://cert2.pem key-
file home:e OS10-VM email [e-mail] length 1024 altname.dell.com
validity 365
Processing certificate ...
Successfully created certificate file /home/admin/cert2.pem and key
Supported
releases
10.4.3.0 or later
crypto cert install
Installs a host certificate and private key on the switch. A host certificate may be trusted from a CA or self-signed.
Syntax
crypto cert install cert-file cert-path key-file {key-path | private}
[password passphrase] [fips]
Parameters
● cert-file cert-path — Enter the local path to where the downloaded certificate is stored. You
can enter a full path or a relative path; for example, home://s4048-001-cert.pem or usb://
s4048-001-cert.pem or flash://certs/s4810-001-request.crt.
● key-file {key-path | private} — Enter the local path to retrieve the downloaded or locally
generated private key. Specify a key-path to install the key from a local directory. Enter private to
install the key from a local hidden location. After the certificate is successfully installed, the private
key is deleted from the specified key-path location and copied to the hidden location.
● password passphrase — (Optional) Enter the password used to decrypt the private key if it was
generated using a password.
1178 Security