Users Guide

You can copy the CSR from flash to a destination, such as a USB flash drive, using TFTP, FTP, or SCP.
OS10# copy home://DellHost.pem scp:///tftpuser@10.11.178.103:/tftpboot/certs/
DellHost.pem
password:
The CA server signs the CSR with its private key. The CA server then makes the signed certificate available for the OS10 switch
to download and install.
Install host certificate
1. Use the copy command to download an X.509v3 certificate signed by a CA server to the local home directory using a
secure method, such as HTTPS, SCP, or SFTP.
2. Use the crypto cert install command to install the certificate and the private key generated with the CSR.
● Install a trusted certificate and key file in EXEC mode.
crypto cert install cert-file home://cert-filepath key-file {key-path | private}
[password passphrase] [fips]
○ cert-file cert-filepath specifies a source location for a downloaded certificate; for example, home://
s4048-001-cert.pem or usb://s4048-001-cert.pem.
○ key-file {key-path | private} specifies the local path to retrieve the downloaded or locally generated private
key. Enter private to install the key from a local hidden location and rename the key file with the certificate name.
○ password passphrase specifies the password used to decrypt the private key if it was generated using a password.
○ fips installs the certificate-key pair as FIPS-compliant. Enter fips to install a certificate-key pair that is used by a
FIPS-aware application, such as RADIUS over TLS. If you do not enter fips, the certificate-key pair is stored as a
non-FIPS-compliant pair.
NOTE:
You determine if the certificate-key pair is generated as FIPS-compliant. Do not use FIPS-compliant
certificate-key pairs outside of FIPS mode. When FIPS mode is enabled, you can still generate CSRs for non-FIPS
certificates for use with non-FIPS applications. Be sure to install these certificates as non-FIPS with the crypto
cert install command.
○ If you enter fips after using the key-file private option in the crypto cert generate request command,
a FIPS-compliant private key is stored in a hidden location in the internal file system that is not visible to users.
If the certificate installation is successful, the file name of the host certificate and its common name are displayed. Use the
filename to configure the certificate in a security profile using the crypto security-profile command.
Example: Generate CSR and upload to server
OS10# crypto cert generate request cert-file home://DellHost.pem key-file home://
DellHost.key email [e-mail] length 1024 altname DNS:dell.domain.com
Processing certificate ...
Successfully created CSR file /home/admin/DellHost.pem and key
OS10# copy home://DellHost.pem scp:///tftpuser@10.11.178.103:/tftpboot/certs/
DellHost.pem
password:
Host certificate tip
When administering a large number of switches, you may choose to not generate numerous CSRs for all switches. An alternate
method to installing a host certificate on each switch is to generate both the private key file and CSR offline; for example,
on the CA server. The CSR is signed by the CA, which generates both a certificate and key file. You then copy the trusted
certificate and key file to the switch using the copy command and install them using the crypto cert install cert-
file home://cert-filename key-file home://key-filename command.
NOTE:
For security reasons, the private key file is copied to an internal, secure location and removed from the viewable file
system.
Example: Download and install trusted certificate and private key
OS10# copy scp:///tftpuser@10.11.178.103:/tftpboot/certs/Dell_host1_CA1.pem home://
Dell_host1_CA1.pem
password:
OS10# copy scp:///tftpuser@10.11.178.103:/tftpboot/certs/Dell_host1_CA1.key home://
Dell_host1_CA1.key
Security
1367