HP Cisco MDS 9216A Cisco MDS 9000 Family Fabric Manager Configuration Guide, R - Page 181

Chapter 7 Fabric Manager Web Server Installing Fabric Manager Web Server Send documentation comments to [email protected] Using Fabric Manager Web Server with SSL Fabric Manager Web Server uses TCP port 80 by default. If you want to install SSL certificates and use Fabric Manager Web Server over HTTPS (using TCP port 443 or another custom port), you need a certificate for each external IP address that accepts secure connections. You can purchase these certificates from a well-known Certificate Authority (CA). To enable SSL, users must set up the keystore to use either self-signed certificate or a certificate from a trusted third party company like Verisign. To create a local certificate, follow these steps: Step 1 Step 2 Set up a keystore to use self-signed certificate (local certificate). From the command line, issue the following command: %JAVA_HOME%/bin/keytool -genkey -alias tomcat -keyalg RSA -keystore "C:\Program Files\Cisco Systems\MDS 9000\keystore" Enter your name, organization, state, and country. Enter changeit when prompted for a keystore password. If you prefer to use your own password, don't forget to change the keystorepass attribute in the server.xml file. When prompted for a key password, press enter or use the same password as the keystore password. Note You can now follow the steps in the next section for modifying Fabric Manager Web Server to use SSL. Step 3 To set up a keystore to use CA certificate, follow these steps: Complete Steps 1 and 2 above and then Step 3. In order to obtain a certificate from the Certificate Authority of your choice, you must create a Certificate Signing Request (CSR). The CSR is used by the certificate authority to create a certificate that identifies your website as secure. To create a CSR, follow these steps: Step 1 Create a local certificate (as described in the previous section). Note You must enter the domain of your website in the field first and last name in order to create a working certificate. Step 2 Step 3 Step 4 Step 5 The CSR is then created with with this command: keytool -certreq -keyalg RSA -alias tomcat -file certreq.csr -keystore "C:\Program Files\Cisco Systems\MDS 9000\keystore" Now you have a file called certreq.csr. The file is encoded in PEM format. You can submit it to the certificate authority. You can find instructions for submitting the file on the Certificate Authority website. You will receive a certificate. Once you have your certificate, you can import it into you local keystore. First, you must import a Chain Certificate or Root Certificate into your keystore. You can then import your certificate. Download a Chain Certificate from the Certificate Authority where you obtained the certificate. OL-8007-10, Cisco MDS SAN-OS Release 3.x Cisco MDS 9000 Family Fabric Manager Configuration Guide 7-5