Cisco MDS-9124 Troubleshooting Guide - Page 479
Cannot Export Identity Certificate in PKCS#12 Format, Certificate Fails at Peer
View all Cisco MDS-9124 manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 479 highlights
Chapter 24 Troubleshooting Digital Certificates Digital Certificate Issues Send documentation comments to [email protected] Cannot Export Identity Certificate in PKCS#12 Format Symptom Cannot export identity certificate in PKCS#12 format. Table 24-3 Cannot Export Identity Certificate in PKCS#12 Format Symptom Cannot export identity certificate in PKCS#12 format. Possible Cause RSA keys not exportable. Solution Create exportable RSA keys. Choose Switches > Security > PKI in Fabric Manager and click Create Row. Check the Exportable check box and create an RSA key pair. Or use the crypto key generate rsa exportable CLI command. Certificate Fails at Peer Symptom Certificate fails at peer. Table 24-4 Certificate Fails at Peer Symptom Certificate fails at peer. Possible Cause Solution FQDN changed after certificate was issued. Revoke certificate and re-create. See the "Configuring Certificates on the MDS Switch Using Fabric Manager" section on page 24-5 or the "Configuring Certificates on the MDS Switch Using the CLI" section on page 24-7. Local and remote clocks are not synchronized. If the clocks are not synchronized, the certificate may appear to be expired. Validate the clocks on the local and peer device. Peer does not recognize CA issuing the certificate. Create a certificate for the CAs known to the peer device. See the "Configuring Certificates on the MDS Switch Using Fabric Manager" section on page 24-5 or the "Configuring Certificates on the MDS Switch Using the CLI" section on page 24-7. Configuring Certificates on the MDS Switch Using Fabric Manager To configure certificates on an MDS switch using Fabric Manager, follow these steps: Step 1 Step 2 Step 3 Choose Switches and set the LogicalName field to configure the switch host name. Choose Switches > Interfaces > Management > DNS and set the DefaultDomainName field to configure the DNS domain name for the switch. Follow these steps to create an RSA key pair for the switch: a. Choose Switches > Security > PKI and select the RSA Key-Pair tab. b. Click Create Row and set the name and size field. c. Check the Exportable check box and click Create. OL-9285-05 Cisco MDS 9000 Family Troubleshooting Guide, Release 3.x 24-5