Downloading a Certificate Key from a TFTP Server

You can download a certificate key from files stored in a TFTP server. If the operation is successful, any existing certificate is overwritten. After a successful download, the software attempts to match the public key in the certificate against the private key stored. If the private and public keys do not match, the switch displays a warning message similar to the following: Warning: The Private Key does not match with the Public Key in the certificate. This warning acts as a reminder to also download the private key.

Downloaded certificates and keys are not saved across switch reboots unless you save your current switch configuration. After you use the save command, the downloaded certificate is stored in the configuration file and the private key is stored in the EEPROM.

To download a certificate key from files stored in a TFTP server, use the following command:
download ssl ipaddress certificate {ssl-cert | trusted-ca | ocsp-signature-ca} cert_file
Note
For security measures, you can only download a certificate key in the VR-Mgmt virtual router (VR).
To see whether the private key matches with the public key stored in the certificate, use the following command:
show ssl {detail}
This command also displays:
- HTTPS port configured. This is the port on which the clients will connect.
- Length of the RSA key (the number of bits used to generate the private key).
- Basic information about the stored certificate.

Published March 2020prev | next

Email this topic

Print this page Print this page

Leave feedback Feedback