Digital certificate configuration examples
This section shows how to obtain an online CA signed certificate, remove the expired certificate, renew the certificate, and install an offline subject certificate.
Obtaining an online CA-signed subject certificate
Use the following procedure as an example to obtain an online CA signed subject certificate that the application can use.
About this task
In the following commands, the variable WORD<1-45> refers to the name of the certificate authority and the variable WORD<1-80> refers to the certificate filename.
Procedure
- Configure
the subject:
certificate subject common-name scepsub certificate subject e-mail test@mocana.com certificate subject unit Engineering certificate subject organization "Mocana Corporation" certificate subject locality "San Francisco" certificate subject country US certificate subject province California
Note
The values mentioned are for example only.
- Configure
the certificate authority (CA):
certificate ca ej common-name subca5 certificate ca ej key-name rsa_2048 certificate ca ej ca-url http://192.51.100.9:8080/ejbca/publicweb/apply/scep/test/pkiclient.exe certificate ca ej use-post true
Note
The values mentioned are for example.
Installing an offline CA certificate
Use the following procedure as an example to install the offline CA certificate.
About this task
In the following commands, the variable WORD<1-80> refers to the certificate filename.
Procedure
- Configure
the subject:
certificate subject common-name scepsub certificate subject e-mail test@mocana.com certificate subject unit Engineering certificate subject organization "Mocana Corporation" certificate subject locality "San Francisco" certificate subject country US certificate subject province California
Note
The values mentioned are for example only.
- Install the Root CA certificate:
certificate install-file offline-root-ca-filename WORD<1-80>
Note
If the subject certificate issuer is directly the Root, then Step 7 and 8 are optional. If the subject is issued by Intermediate CA, then Step 7 and 8 are mandatory, also in the certificate chain between Root and Subject, all the Intermediates must be installed using these steps.
Configuring X.509 V3 certificates for SSH Two Factor Authentication
Note
DEMO FEATURE - Two-Factor Authentication–X.509v3 Certificates for SSH is a demonstration feature on some products. Demonstration features are provided for testing purposes. Demonstration features are for lab use only and are not for use in a production environment. For more information on feature support, see VOSS Feature Support Matrix.
Use the following procedure as an example to configure the SSH server on the VOSS switch, and the SSH client Secure CRT for two factor authentication using X.509 V3 certificates.
Before you begin
The following certificates must be loaded on the SSH server and SSH client:
-
For the Secure CRT (SSH client):
-
subject certificate from the PIV card.
-
-
For the VOSS switch (SSH server):
-
CAC-server.pem - the subject certificate
-
ca.cert.pem - the root CA certificate
-
Self-signedTrustAnchorCertificate.cer - the root CA certificate that signed the intermediate certificate
-
RSA2048IssuingCACertificate.cer - the intermediate certificate signed by the pervious root CA that signed the subject certificate.
-
About this task
Use the following steps as an example to configure the SSH server on the VOSS switch, the RADIUS Windows server, and the SSH client Secure CRT.
Procedure
-
Ensure the switch is running in
Enhanced Secure Mode:
Switch:1(config)#show boot config flags flags enhancedsecure-mode true
Note
This shows a partial output of only the relevant entry.
-
Configure the certificate
subject parameters:
Switch:1(config)#certificate subject common-name CAC-server Switch:1(config)#certificate subject e-mail user@companyname.com Switch:1(config)#certificate subject unit CAC-project Switch:1(config)#certificate subject organization Extreme Switch:1(config)#certificate subject locality Salem Switch:1(config)#certificate subject province New Hampshire Switch:1(config)#certificate subject country US Switch:1(config)#show certificate subject Common-name : CAC-server E-mail : jsmith@extremenetworks.com Organizational unit : CAC-project Organization : Extreme Locality : Salem State/Province : New Hampshire Country : US
Note
The values mentioned are for example.
-
Install the Root CA certificate that signed the client certificate chain:
Switch:1(config)#certificate install-file offline-root-ca-filename <CLIENT_ROOT_CERTIFICATE_NAME> Switch:1(config)#show certificate cert-type root-ca-cert CERT STORE table entry Certificate Type : Root CA Certificate CommonName : ca_cert VersionNumber : X.509 v3 SerialNumber : 00fb084e6b97f3f72a IssuerName : CN:ca_cert, EM:none@none.com, OU:SSH, O:LUX, L:BUC, P:RO, C:RO ValidityPeriodNotBefore : 06/15/2018 05:46:58 ValidityPeriodNotAfter : 06/10/2038 05:46:58 CertificateSignatureAlgorithm : sha256withRSAEncryption CertificateSignature : … Subject : CN:ca_cert, EM:none@none.com, OU:SSH, O:LUX, L:BUC, P:RO, C:RO SubjectPublicKeyAlgorithm : rsaEncryption SubjectPublicKey : … HasBasicConstraint : 1 HasKeyUsage : 1 IsCa : 1 KeyUsage : 97 digitalSignature keyCertSign cRLSign ExtendedKeyUsage : CDPUrl : OCSPUrl : CertificateFileName : /intflash/.cert/.rootCACertStore/root_ca_cert_ca_cert.der Switch:1(config)#no ssh rsa-auth Switch:1(config)#no ssh dsa-auth Switch:1(config)#no ssh pass-auth Switch:1(config)#ssh x509v3-auth enable Switch:1(config)#show ssh global Total Active Sessions : 0 version : v2only port : 22 max-sessions : 4 timeout : 60 action rsa-host key : rsa-hostkeysize 2048 action dsa-host key : dsa-hostkeysize 1024 rsa-auth : false dsa-auth : false pass-auth : false keyboard-interactive-auth : false x509-auth : true x509-auth overwrite : false x509-auth strip-domain : false x509-auth use-domain : - x509-auth revocation-check-method : OCSP sftp enable : true client enable : true enable : true authentication-type : aead-aes-128-gcm-ssh aead-aes-256-gcm-ssh hmac-sha1 hmac-sha2-256 encryption-type : 3des-cbc aead-aes-128-gcm-ssh aead-aes-256-gcm-ssh aes128-cbc aes128-ctr aes192-cbc aes192-ctr aes256-cbc aes256-ctr blowfish-cbc rijndael128-cbc rijndael192-cbc key-exchange-method : diffie-hellman-group1-sha1 diffie-hellman-group14-sha1
Note
Disable all other SSH authentication methods except X.509 V3 on the VOSS switch because the SSH client Secure CRT always prefers SSH RSA over X.509 V3 authentication. You can also force Secure CRT to negotiate X.509 V3 SSH RSA only.
X.509 Authentication Username Option Example
Use the following procedure as an example to configure username authentication options using X.509 V3 certificates.
Procedure
Install Online Certificates for Fabric Extend with IPsec
Use the following procedure as an example to install subject certificates for switches that use Fabric Extend with IPsec. After you complete the certificate configuration, you must configure the IPsec authentication method for the Fabric Extend tunnel. For more information about IPsec configuration, see IPsec configuration using CLI. For more information about Fabric Extend, see Fabric Extend configuration using the CLI.
Note
The values mentioned are for example only.
Before you begin
Configure the Fabric Extend tunnels between the branch and hub switches.