Search

Setting Up PKI

The following is the sequential workflow involved in the session establishment using PKI:

  1. Generate the involved X509v3 certificates: CA certificates, OCSP Signature CA certificate, Peer certificate (for example: Syslog server or SSH client), ExtremeXOS device certificate.
  2. Download the CA certificates and OCSP Signature CA certificates to the ExtremeXOS device.
  3. Download the ExtremeXOS device certificate and key to ExtremeXOS device (required for establishing TLS session with Syslog server).
  4. Configure the peer (Syslog server or SSH client) as required to use its own X509v3 certificate in the connection request.
  5. Initiate the connection request from peer (Syslog server or SSH client) to ExtremeXOS device.
  6. The ExtremeXOS device performs the following tasks on the received peer‘s certificate and accepts or rejects the connection request:
    • Certificate chain verification
    • Validity checks on certificate extensions
    • OCSP
9037555-00 Rev AA