Brocade Virtual ADX Security Guide (Supporting ADX v03.1.00) - Manual (Page 115)

Brocade Virtual ADX Security Guide 103
53-1003250-01
Configuring SSL on a Brocade Virtual ADX
6
The password variable is the password that is used to store this certificate.
The cert-name variable is the filename used to store the generated certificate. This file name can
contain a maximum of 32 characters.
NOTE
To generate a self-signed certificate, the certkey and sign key must be the same.
Using CA-signed certificates
Before generating a CA-signed certificate, you must obtain an RSA key pair as described in
“Obtaining a Brocade Virtual ADX keypair file” on page 101.
Once you’ve obtained the RSA key pair, you can create a certificate signing request (CSR) as shown
in the following example.
Virtual ADX#ssl gencsr testkey
You about to be asked to enter information that will be incorporated into your
certificate request. What you are about to enter is what is called a Distinguished
Name or a DN.
Country name (2 letter code) [US] US
State or province (full name) [Some state] Texas
Locality name (city) [Some city] Dallas
Organization name (Company name) [Brocade Communications] Brocade Communications
Organizational unit name (department) [Web administration] Engineering
Common name (your domain name) [www.brocade.com] www.brocade.com
Email address [[email protected]] [email protected]
-----BEGIN CERTIFICATE REQUEST-----
MIIBszCCARwCAQAwczELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWEx
ETAPBgNVBAcTCFNhbiBKb3NlMRkwFwYDVQQKExBGb3VuZHJ5IG5ldHdvcmtzMQww
CgYDVQQLEwNTUUExEzARBgNVBAMTCnd3dy5xYS5uZXQwgZ8wDQYJKoZIhvcNAQEB
BQADgY0AMIGJAoGBANAF2D9/7qgQ+J9bPvVPhKkWP8GAQ3K4+aIRDYnizQon3unw
invhJImFCvmi+BFdYIj/aA5AQw0xI7618giZEL8VWGJ/D6j9U9wW3+x29QZnwqSF
QOyLRJia/gmpE8SMAeB88FLlZ0IZycEZUBZgolI9TJYnP4v6IM6ChceryCrrAgMB
AAGgADANBgkqhkiG9w0BAQUFAAOBgQBxI90CmjIqDtddLOQDCx5lVLCRnnC/rPnc
2gxu0SJM4eUVUD9DWW6exC9zvuXm3ZtS0CjEbrmorpoqnshEaPFb/tJJO9OQRZIW
CN6ZEdlwLNnh7M2xVdAdd9Nk4dqczM1n/nRD81tBS+rBP1mVwagKyiN2kiuDVCOs
ySuho58USQ==
-----END CERTIFICATE REQUEST-----
The output above, between BEGIN CERTIFICATE REQUEST and END CERTIFICATE REQUEST is a
certificate signing request and registration. It is called a Base-64-encoded CSR.
The certificates that you import into the Brocade Virtual ADX will need to be in Base-64 encoding as
well. The Brocade Virtual ADX accepts certificates in the .PEM and .P12 format. These formats are
described further in this document as well as how to convert between formats.
You need to copy the certificate signing request —the output between the lines that read BEGIN
CERTIFICATE REQUEST and END CERTIFICATE REQUEST— and register it with a trusted certificate
authority; for example, Verisign. They will issue you a server certificate, based on this request
(which will include the intermediate and root certificates).
You will then need to import these certificates into the Brocade Virtual ADX via SCP from a remote
machine.
Again, the certificates you import must be in Base 64 encoding. You can quickly tell if this is the
case by opening the certificate in notepad. It should look like this: