HP Cisco MDS 9216 Cisco MDS 9000 Family Fabric Manager Configuration Guide, Re - Page 822

Configuring CAs and Digital Certificates Chapter 43 Configuring Certificate Authorities and Digital Certificates Send documentation comments to [email protected] Figure 43-6 Copy Files Dialog Box Step 4 Step 5 Step 6 Select tftp as the Protocol field. Click the Browse button to locate the appropriate file to copy to bootflash. Click Apply to apply these changes. Authenticating the CA The configuration process of trusting a CA is complete only when the CA is authenticated to the MDS switch. The switch must authenticate the CA. It does this by obtaining the self-signed certificate of the CA in PEM format, which contains the public key of the CA. Because the certificate of the CA is self-signed (the CA signs its own certificate) the public key of the CA should be manually authenticated by contacting the CA administrator to compare the fingerprint of the CA certificate. Note If the CA being authenticated is not a self-signed CA (that is, it is a subordinate CA to another CA, which itself may be a subordinate to yet another CA, and so on, finally ending in a self-signed CA), then the full list of the CA certificates of all the CAs in the certification chain needs to be input during the CA authentication step. This is called the CA certificate chain of the CA being authenticated. The maximum number of certificates in a CA certificate chain is 10. To authenticate a CA using Fabric Manager, follow these steps: Step 1 Step 2 Expand Switches > Security then select PKI in the Physical Attributes pane. Click the Trust Point Actions tab in the Information pane. You see the information shown in Figure 43-7. Figure 43-7 Trust Point Actions Tab 43-10 Cisco MDS 9000 Family CLI Configuration Guide OL-16184-01, Cisco MDS SAN-OS Release 3.x