HP StorageWorks 1606 Brocade Fabric OS Administrator's Guide v6.3.0 (53-100133 - Page 151

Secure Sockets Layer protocol 6 a. A public and private key by using the secCertUtil genkey command. b. A certificate signing request (CSR) by using the secCertUtil gencsr command. 3. Store the CSR on a file server by using the secCertUtil export command. 4. Obtain the certificates from the CA. You can request a certificate from a CA through a Web browser. After you request a certificate, the CA either sends certificate files by e-mail (public) or gives access to them on a remote host (private). Typically, the CA provides the certificate files listed in Table 19. TABLE 19 SSL certificate files Certificate file Description name.crt nameRoot.crt nameCA.crt The switch certificate. The root certificate. Typically, this certificate is already installed in the browser, but if not, you must install it. The CA certificate. It must be installed in the browser to verify the validity of the server certificate or server validation fails. 5. On each switch, install the certificate. Once the certificate is loaded on the switch, HTTPS starts automatically. 6. If necessary, install the root certificate to the browser on the management workstation. 7. Add the root certificate to the Java Plug-in keystore on the management workstation. Certificate authorities To ease maintenance and allow secure out-of-band communication between switches, consider using one certificate authority (CA) to sign all management certificates for a fabric. If you use different CAs, management services operate correctly, but the Web Tools Fabric Events button is unable to retrieve events for the entire fabric. Each CA (for example, Verisign or GeoTrust) has slightly different requirements; for example, some generate certificates based on IP address, while others require an FQDN, and most require a 1024-bit public/private key while some may accept a 2048-bit key. Consider your fabric configuration, check CA Web sites for requirements, and gather all the information that the CA requires. Generating a public and private key Perform this procedure on each switch. 1. Connect to the switch and log in as admin. 2. Enter the secCertUtil genkey command to generate a public/private key pair. The system reports that this process will disable secure protocols, delete any existing CSR, and delete any existing certificates. 3. Respond to the prompts to continue and select the key size. Example of generating a key Continue (yes, y, no, n): [no] y Select key size [1024 or 2048]: 1024 Fabric OS Administrator's Guide 109 53-1001336-01