Dell PowerSwitch S4128F-ON OS10 Enterprise Edition User Guide Release 10.4.3.0 - Page 829

3 OS10 switches generate private keys and create CSRs using the crypto cert generate request command. A switch uploads a CSR to an intermediate CA. To store the private key in a local hidden location, Dell EMC Networking recommends using the keyfile private parameter with the command. 4 Download and install a CA certificate on a host using the crypto ca-cert install command. After you install a CA certificate, a host trusts any certificates that are signed by the CA and presented by other network devices. You must first download a certificate to the home directory, and then install the certificate using the crypto ca-cert install command. 5 Download and install a signed host certificate and private key from an intermediate CA on an OS10 switch. Then install them using the crypto cert install command. After you install the host certificate, OS10 applications use the certificate to secure communication with network devices. The private key is installed in the internal file system on the switch and cannot be exported or viewed. Manage CA certificates OS10 supports the download and installation of public X.509v3 certificates from external certificate authorities. In a data center environment, trusted CA servers can create CA certificates. A host operates as a trusted CA server. Network hosts install certificates that are digitally signed with the CA's private key to establish trust between participating devices in the network. The certificate on an OS10 switch is used to verify the certificates presented by clients and servers, such as Syslog and RADIUS servers, to establish a secure connection with these devices. To import a CA server certificate: 1 Use the copy command to download an X.509v3 certificate created by a CA server using a secure method, such as HTTPS, SCP, or SFTP. Copy a CA certificate to the local directory on the switch, such as home:// or usb://. 2 Use the crypto ca-cert install command to install the certificate. When you install a CA certificate, specify the local path where the certificate is stored. The switch verifies the certificate and installs it in an existing directory of trusted certificates in PEM format. Install CA certificate • Install a CA certificate in EXEC mode. crypto ca-cert install ca-cert-filepath [filename] - ca-cert-filepath specifies the local path to the downloaded certificate; for example, home://CAcert.pem or usb://CAcert.pem. - filename specifies an optional filename that the certificate is stored under in the OS10 trust-store directory. Enter the filename in the filename.crt format. Example: Download and install CA certificate OS10# copy scp:///[email protected]:/tftpboot/certs/Dell_rootCA1.pem home:// Dell_rootCA1.pem password: OS10# crypto ca-cert install home://Dell_rootCA1.pem Processing certificate ... Installed Root CA certificate CommonName = Dell_rootCA1 IssuerName = Dell_rootCA1 Display CA server certificate OS10# show crypto ca-certs | Locally installed certificates Dell_rootCA1.crt OS10# show crypto ca-certs Dell_rootCA1.crt Certificate: Data: Security 829