Creating Certificate Signing Requests and Private Keys

Secure Socket Layer (SSL) allows you to:

Generate self-signed certificates, which generate private keys and self-signed X509 certificates.
Download SSL private key/certificate using download ssl ipaddress certificate {ssl-cert | trusted-ca | ocsp-signature-ca} cert_file command (generally used to download CA signed certificate).
Obtain an SSL private-key/certificate using the configure ssl certificate pregenerated command (generally used to obtain the CA signed certificate for copying).

Additionally, you can create certificate signing requests (CSRs)/private key pairs. The CSR can then be taken to a Certificate Authority (CA) for signing. The CA then provides the signed certificate, which can be downloaded to the switch using either of the commands listed previously.

To create a CSR, use the following command:

configure ssl csr privkeylen length country code organization org_name common-name name

To view the CSR any time after creating it, use the following command:

show ssl csr

Note

For enhanced security, the minimum private key length is 2,048 (previously it was 1,024). This length is enforced in both private key/self-signed certificate pairs and private key/CSR pairs.