Digital certificate configuration examples
This section shows how to obtain an online CA signed certificate, remove the expired certificate, renew the certificate, and install an offline subject certificate.
Obtain an Online CA-signed Subject Certificate
Use the following procedure as an example to obtain an online CA signed subject certificate that the application can use.
About this task
In the following commands, the variable WORD<1-45> refers to the name of the certificate authority and the variable WORD<1-80> refers to the certificate filename.
Procedure
- Configure
the subject:
certificate subject common-name 822-pki certificate subject e-mail 822@extremenetworks.com certificate subject unit Engineering certificate subject organization ExtremeNetworks certificate subject locality Salem certificate subject country US certificate subject province Massachusetts certificate subject subject-name 822 certificate subject common-name 823-pki certificate subject e-mail 823@extremenetworks.com certificate subject unit Engineering certificate subject organization ExtremeNetworks certificate subject locality Salem certificate subject country US certificate subject province Massachusetts certificate subject subject-name 823
Note
The values mentioned are for example only.
- Configure
the certificate authority (CA):
certificate ca ej common-name subca5 certificate ca ej key-name rsa_2048 certificate ca ej ca-url http://192.51.100.9:8080/ejbca/publicweb/apply/scep/test/pkiclient.exe certificate ca ej use-post true
Note
The values mentioned are for example.
Install an Offline CA Certificate
Use the following procedure as an example to install an offline CA certificate.
About this task
In the following commands, the variable WORD<1-80> refers to the certificate filename.
Procedure
- Configure
the subject:
certificate subject common-name 822-pki certificate subject e-mail client1@extemenetworks.com certificate subject unit Engineering certificate subject organization ExtremeNetworks certificate subject locality Salem certificate subject province Massachusetts certificate subject country US certificate subject subject-name 822
Note
The values mentioned are for example only.
- Install the Root CA certificate:
certificate install-file offline-root-ca-filename WORD<1-80>
Note
If the subject certificate issuer is directly the Root, then Step 7 and 8 are optional. If the subject is issued by Intermediate CA, then Step 7 and 8 are mandatory, also in the certificate chain between Root and Subject, all the Intermediates must be installed using these steps.
Configuring X.509 V3 certificates for SSH Two Factor Authentication
Note
DEMO FEATURE - Two-Factor Authentication–X.509v3 Certificates for SSH is a demonstration feature on some products. Demonstration features are provided for testing purposes. Demonstration features are for lab use only and are not for use in a production environment. For more information on feature support, see Fabric Engine and VOSS Feature Support Matrix.
Use the following procedure as an example to configure the SSH server on the switch, and the SSH client Secure CRT for two factor authentication using X.509 V3 certificates.
Before you begin
The following certificates must be loaded on the SSH server and SSH client:
-
For the Secure CRT (SSH client):
-
subject certificate from the PIV card.
-
-
For the switch (SSH server):
-
CAC-server.pem - the subject certificate
-
ca.cert.pem - the root CA certificate
-
Self-signedTrustAnchorCertificate.cer - the root CA certificate that signed the intermediate certificate
-
RSA2048IssuingCACertificate.cer - the intermediate certificate signed by the pervious root CA that signed the subject certificate.
-
About this task
Use the following steps as an example to configure the SSH server on the switch, the RADIUS Windows server, and the SSH client Secure CRT.
Procedure
-
Ensure the switch is running in
Enhanced Secure Mode:
Switch:1(config)#show boot config flags flags enhancedsecure-mode true
Note
This shows a partial output of only the relevant entry.
X.509 Authentication Username Option Example
Use the following procedure as an example to configure username authentication options using X.509 V3 certificates.
Procedure
Install Online Certificates for Fabric Extend with IPsec
Use the following procedure as an example to install subject certificates for switches that use Fabric Extend with IPsec. After you complete the certificate configuration, you must configure the IPsec authentication method for the Fabric Extend tunnel. For more information about IPsec configuration, see IPsec configuration using CLI. For more information about Fabric Extend, see Fabric Extend configuration using the CLI.
Note
The values mentioned are for example only.
Before you begin
Configure the Fabric Extend tunnels between the branch and hub switches.