Dell MX9116n EMC SmartFabric OS10 User Guide - Page 970

• password passphrase specifies the password used to decrypt the private key if it was generated using a password. • fips installs the certificate-key pair as FIPS-compliant. Enter fips to install a certificate-key pair that is used by a FIPS-aware application, such as RADIUS over TLS. If you do not enter fips, the certificate-key pair is stored as a non-FIPS-compliant pair. NOTE: You determine if the certificate-key pair is generated as FIPS-compliant. Do not use FIPS-compliant certificate-key pairs outside of FIPS mode. When FIPS mode is enabled, you can still generate CSRs for non-FIPS certificates for use with non-FIPS applications. Be sure to install these certificates as non-FIPS with the crypto cert install command. • If you enter fips after using the key-file private option in the crypto cert generate request command, a FIPScompliant private key is stored in a hidden location in the internal file system that is not visible to users. If the certificate installation is successful, the file name of the host certificate and its common name are displayed. Use the filename to configure the certificate in a security profile using the crypto security-profile command. Example: Generate CSR and upload to server OS10# crypto cert generate request cert-file home://DellHost.pem key-file home://DellHost.key email [email protected] length 1024 altname DNS:dell.domain.com Processing certificate ... Successfully created CSR file /home/admin/DellHost.pem and key OS10# copy home://DellHost.pem scp:///[email protected]:/tftpboot/certs/DellHost.pem password: Host certificate tip When administering a large number of switches, you may choose to not generate numerous CSRs for all switches. An alternate method to installing a host certificate on each switch is to generate both the private key file and CSR offline; for example, on the CA server. The CSR is signed by the CA, which generates both a certificate and key file. You then copy the trusted certificate and key file to the switch using the copy command and install them using the crypto cert install cert-file home://cert-filename key-file home://key-filename command. NOTE: For security reasons, the private key file is copied to an internal, secure location and removed from the viewable file system. Example: Download and install trusted certificate and private key OS10# copy scp:///[email protected]:/tftpboot/certs/Dell_host1_CA1.pem home:// Dell_host1_CA1.pem password: OS10# copy scp:///[email protected]:/tftpboot/certs/Dell_host1_CA1.key home:// Dell_host1_CA1.key password: OS10# crypto cert install cert-file home://Dell_host1_CA1.pem key-file home:// Dell_host1_CA1.key Processing certificate ... Certificate and keys were successfully installed as "Dell_host1_CA1.pem" that may be used in a security profile. CN = Dell_host1_CA1 Display trusted certificates OS10# show crypto cert | Installed non-FIPS certificates Dell_host1_CA1.pem | Installed FIPS certificates OS10# show crypto cert Dell_host1_CA1.pem Non FIPS certificate Certificate: Data: Version: 3 (0x2) Serial Number: 4096 (0x1000) 970 Security