Dell MX9116n EMC SmartFabric OS10 User Guide Release 10.5.1 - Page 1173

Netscape Cert Type: SSL Client, S/MIME Netscape Comment: OpenSSL Generated Client Certificate X509v3 Subject Key Identifier: 4A:20:AA:E1:69:BF:BE:C5:66:2E:22:71:70:B4:7E:32:6F:E0:05:28 X509v3 Authority Key Identifier: keyid:A3:39:CB:C7:76:86:3B:05:44:34:C2:6F:90:73:1F:5F:64:55:5C:76 X509v3 Key Usage: critical Delete trusted certificate OS10# OS10# crypto cert delete Dell_host1_CA1.pem Certificate and keys were successfully deleted. CN = Dell_host1_CA1 Self-signed certificates Administrators may prefer to not set up a Certificate Authority and implement a certificate trust model in the network, but still want to use the privacy features provided by the Transport Layer Security (TLS) protocol. In this case, self-signed certificates can be used. A self-signed certificate is not signed by a CA. The switch presents itself as a trusted device in its certificate. Connecting clients may prompt their users to trust the certificate - for example, when a web browser warns that a site is unsafe - or to reject the certificate, depending on the configuration. A self-signed certificate does not provide protection against man-in-the-middle attacks. To generate and install a self-signed certificate: 1. Create a self-signed certificate and key in a local directory or USB flash drive. 2. Install the self-signed certificate. Generate a self-signed certificate ● Create a self-signed certificate in EXEC mode. Store the device.key file in a secure, persistent location, such as NVRAM. crypto cert generate self-signed [cert-file cert-path key-file {private | keypath}] [country 2-letter code] [state state] [locality city] [organization organization-name] [orgunit unit-name] [cname common-name] [email email-address] [validity days] [length length] [altname alt-name] If you enter the cert-file option, you must enter all the required parameters, including the local path where the certificate and private key are stored. If you do specify the cert-file option, you are prompted to enter the other parameter values for the certificate interactively; for example: You are about to be asked to enter information that will be incorporated in your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank. For some fields there will be a default value; if you enter '.', the field will be left blank. Country Name (2 letter code) [US]: State or Province Name (full name) [Some-State]:California Locality Name (eg, city) []:San Francisco Organization Name (eg, company) []:Starfleet Command Organizational Unit Name (eg, section) []:NCC-1701A Common Name (eg, YOUR name) [hostname]:S4148-001 Email Address []:[email protected] The switch uses SHA-256 as the digest algorithm. The public key algorithm is RSA with a 2048-bit modulus. NOTE: When using self-signed X.509v3 certificates with Syslog and RADIUS servers, configure the server to accept selfsigned certificates. Syslog and RADIUS servers require mutual authentication, which means that the client and server must verify each other's certificates. Dell EMC Networking recommends configuring a CA server to sign certificates for all trusted devices in the network. Install self-signed certificate Security 1173