HP StorageWorks Fabric OS 6.1.1 administrator guide (5697-0235, December 2009)

Fabric OS 6.1.1 administrator guide 95
Summary of SSL procedures
Configure SSL by obtaining, installing, and activating digital certificates for SSL support. Certificates are
required on all switches that are to be accessed through SSL.
You must also install a certificate in the Java Plug-in on the management workstation, and you may need to
add a certificate to your Web browser.
Configuring for SSL involves these major steps, which are shown in detail in the next sections.
1. Choose a Certificate Authority (CA).
2. Generate the following items on each switch:
a. A public and private key by using the secCertUtil genkey command.
b. A certificate signing request (CSR) by using the secCertUtil gencsr command.
3. Store the CSR on a file server by using the secCertUtil export command.
4. Obtain the certificates from the CA.
You can request a certificate from a CA through a Web browser. After you request a certificate, the CA
either sends certificate files by e-mail (public) or gives access to them on a remote host (private).
Typically, the CA provides the certificate files listed in Table 18.
5. On each switch, install and then activate the certificate.
6. If necessary, install the root certificate to the browser on the management workstation.
7. Add the root certificate to the Java Plug-in keystore on the management workstation.
Choosing a Certificate Authority
To ease maintenance and allow secure out-of-band communication between switches, consider using one
CA to sign all management certificates for a fabric. If you use different CAs, management services operate
correctly, but the Web Tools Fabric Events button is unable to retrieve events for the entire fabric.
Each CA (for example, Verisign or GeoTrust) has slightly different requirements; for example, some
generate certificates based on IP address, while others require an FQDN, and most require a 1024-bit
public/private key while some may accept a 2048-bit key. Consider your fabric configuration, check CA
websites for requirements, and gather all the information that the CA requires.
Generating a public and private key
Perform this procedure on each switch.
1. Connect to the switch and log in as admin.
2. Issue the following command to generate a public/private key pair:
switch:admin> seccertutil genkey
The system reports that this process will disable secure protocols, delete any existing CSR, and delete
any existing certificates.
3. Respond to the prompts to continue and select the key size:
Continue (yes, y, no, n): [no] y
Select key size [1024 or 2048]: 1024
Generating new rsa public/private key pair
Done.
Table 18 SSL certificate files
Certificate file Description
name.crt The switch certificate.
nameRoot.crt The root certificate. Typically, this certificate is already installed in the
browser, but if not, you must install it.
nameCA.crt The CA certificate. It must be installed in the browser to verify the validity of
the server certificate or server validation fails.