<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!-- saved from url=(0014)about:internet -->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta http-equiv="Content-Style-Type" content="text/css" />
    <meta name="GENERATOR" content="Quadralay WebWorks AutoMap 2003 Platinum Edition Client for FrameMaker 8.6.6597.0" />
    <meta name="TEMPLATEBASE" content="emwebh8-1-17" />
    <meta name="LASTUPDATED" content="08/01/13 14:47:51" />
    <title>Configuration Examples  </title>
    <!-- Copyright 2010-2013, Cisco Systems, Inc. All rights reserved. -->

    <link rel="StyleSheet" href="document.css" type="text/css" />
    <link rel="StyleSheet" href="catalog.css" type="text/css" />


<script> 
    var is_chrome = navigator.userAgent.toLowerCase().indexOf('chrome') > -1; 
   
    if(is_chrome){document.domain=document.domain}
   </script>
    <script type="text/javascript" language="JavaScript1.2" src="expand.js"></script>
    <script type="text/javascript" language="JavaScript1.2" src="page.js"></script>

    <script type="text/javascript" language="JavaScript1.2">
     <!--
      function  WWNoOp() {}
      function  WWNoValue() { return ""; }

      var  VarDropDown;

      if (typeof(HTMLHelp_Object) != "undefined")
      {
        VarDropDown = new WWDropDown_Object();
      }
      else
      {
        VarDropDown = new Object();
        VarDropDown.fAnchorOpen  = WWNoOp;
        VarDropDown.fAnchorClose = WWNoOp;
        VarDropDown.fDIVOpen  = WWNoOp;
        VarDropDown.fDIVClose = WWNoOp;
      }
     // -->
    </script>

  
<SCRIPT language="javascript">
<!--
  self.document.write("<link href='"+top.relPath+"shared/style.css' rel='stylesheet' type='text/css'>");
  myid=1650;
  self.document.write("<script type='text/javascript' language='JavaScript' src='"+top.relPath+"shared/con_utils.js'></scr"+"ipt>");
//-->
</SCRIPT>
</head>

  <body onload="highlightSearchTerms();" bgcolor="#ffffff">

    
    <blockquote>
    <a name="top"></a>

    
    


<a name="wp1119398"> </a><h1 class="pTitle">
Configuration Examples 

</h1>
<a name="wp1119443"> </a><p class="pBody">
This section shows an example of the tasks you can use to configure certificates and CRLs on the Cisco 
MDS 9000 Family switches using the Microsoft Windows Certificate server.This section includes the 
following topics:

</p>
<div class="pSmartList1"><ul class="pSmartList1">
<a name="wp1119451"> </a><li class="pSmartList1"><a href="digicert34.html">Downloading a CA Certificate</a>
</li>
<a name="wp1119455"> </a><li class="pSmartList1"><a href="digicert35.html">Requesting an Identity Certificate</a>
</li>
<a name="wp1119459"> </a><li class="pSmartList1"><a href="digicert36.html">Revoking a Certificate</a>
</li>
<a name="wp1119463"> </a><li class="pSmartList1"><a href="digicert37.html">Generating and Publishing the CRL</a>
</li>
<a name="wp1119467"> </a><li class="pSmartList1"><a href="digicert38.html">Downloading the CRL</a>
</li>
<a name="wp1119471"> </a><li class="pSmartList1"><a href="digicert39.html">Importing the CRL</a>
</li>
</ul></div>
<a name="wp1119476"> </a><p class="pBody">
To configure certificates on an MDS switch, follow these steps:

</p>
<div class="pSmartList1"><ol type="1" class="pSmartList1">
<a name="wp1119477"> </a><li class="pSmartList1">Choose <span style="font-weight: bold">Switches</span> and set the LogicalName field to configure the switch host name.
</li>
<a name="wp1119478"> </a><li class="pSmartList1">Choose<span style="font-weight: bold"> Switches &gt; Interfaces &gt; Management &gt; DNS </span>and set the DefaultDomainName field to 
configure.
</li>
<a name="wp1119479"> </a><li class="pSmartList1">To create an RSA key-pair for the switch, follow these steps:
</li>
<div class="pSmartList2"><ol type="a" class="pSmartList2">
<a name="wp1119480"> </a><li class="pSmartList2">Choose <span style="font-weight: bold">Switches &gt; Security &gt; PKI</span> and select the RSA <span style="font-weight: bold">Key-Pair</span> tab.</li>
<a name="wp1119481"> </a><li class="pSmartList2">Click<span style="font-weight: bold"> Create Row</span> and set the name and size field.</li>
<a name="wp1119482"> </a><li class="pSmartList2">Check the <span style="font-weight: bold">Exportable</span> check box and click <span style="font-weight: bold">Create</span>.</li>
</ol></div>
<a name="wp1119483"> </a><li class="pSmartList1">To create a trust point and associate the RSA key-pairs with it, follow these steps:
</li>
<div class="pSmartList2"><ol type="a" class="pSmartList2">
<a name="wp1119484"> </a><li class="pSmartList2">Choose S<span style="font-weight: bold">witches &gt; Security &gt; PKI</span> and select the <span style="font-weight: bold">Trustpoints</span> tab.</li>
<a name="wp1119485"> </a><li class="pSmartList2">Click <span style="font-weight: bold">Create Row </span>and set the TrustPointName field.</li>
<a name="wp1119486"> </a><li class="pSmartList2">Select the RSA key-pairs from the KeyPairName drop-down menu.</li>
<a name="wp1119487"> </a><li class="pSmartList2">Select the certificates revocation method from the CARevoke drop-down menu.</li>
<a name="wp1119488"> </a><li class="pSmartList2">Click <span style="font-weight: bold">Create</span>.</li>
</ol></div>
<a name="wp1119489"> </a><li class="pSmartList1">Choose <span style="font-weight: bold">Switches &gt; Copy Configuration</span> and click <span style="font-weight: bold">Apply Changes </span>to copy the running to startup 
configuration and save the trustpoint and key pair.
</li>
<a name="wp1119490"> </a><li class="pSmartList1">Download the CA certificate from the CA that you want to add as the trustpoint CA.
</li>
<a name="wp1119491"> </a><li class="pSmartList1">To authenticate the CA that you want to enroll to the trust point, follow these steps:.
</li>
<div class="pSmartList2"><ol type="a" class="pSmartList2">
<a name="wp1119492"> </a><li class="pSmartList2">Using Device Manager, choose <span style="font-weight: bold">Admin &gt; Flash Files</span> and select <span style="font-weight: bold">Copy</span> and tftp copy the CA certificate to bootflash.</li>
<a name="wp1119493"> </a><li class="pSmartList2">Using DCNM-SAN, choose <span style="font-weight: bold">Switches &gt; Security &gt; PKI </span>and select the <span style="font-weight: bold">TrustPoint Actions</span> tab. </li>
<a name="wp1119494"> </a><li class="pSmartList2">Select <span style="font-weight: bold">cauth</span> from the Command drop-down menu.</li>
<a name="wp1119495"> </a><li class="pSmartList2">Click <span style="font-weight: bold">...</span> in the URL field and select the CA certificate from bootflash.</li>
<a name="wp1119496"> </a><li class="pSmartList2">Click <span style="font-weight: bold">Apply Changes </span>to authenticate the CA that you want to enroll to the trust point.</li>
<a name="wp1119497"> </a><li class="pSmartList2">Click the <b class="cBold">Trust Point Actions </b>tab in the Information Pane.</li>
<a name="wp1119498"> </a><li class="pSmartList2">Make a note of the CA certificate fingerprint displayed in the IssuerCert FingerPrint column for the trust point row in question. Compare the CA certificate fingerprint with the fingerprint already communicated by the CA (obtained from the CA web site). If the fingerprints match exactly, accept the CA by performing the <b class="cBold">certconfirm</b> trust point action. Otherwise, reject the CA by performing the <b class="cBold">certnoconfirm</b> trust point action. </li>
<a name="wp1119499"> </a><li class="pSmartList2">If you select <b class="cBold">certconfirm</b> in step g, click the<span style="font-weight: bold"> Trust Point Actions</span> tab, select <b class="cBold">certconfirm</b> from the command drop-down menu, and then click <b class="cBold">Apply Changes</b>. </li>
<a name="wp1119500"> </a><li class="pSmartList2">If you select <b class="cBold">certnoconfirm</b> in step g, click the<span style="font-weight: bold"> Trust Point Actions</span> tab, select the <b class="cBold">certnoconfirm</b> from the command drop-down menu and then click <b class="cBold">Apply Changes</b>.</li>
</ol></div>
<a name="wp1119501"> </a><li class="pSmartList1">To generate a certificate request for enrolling with that trust point, follow these steps:
</li>
<div class="pSmartList2"><ol type="a" class="pSmartList2">
<a name="wp1119502"> </a><li class="pSmartList2">Click the <b class="cBold">Trust Point Actions </b>tab in the Information pane. </li>
<a name="wp1119503"> </a><li class="pSmartList2">Select <b class="cBold">certreq</b> from the Command drop-down menu. This generates a PKCS#10 certificate signing request (CSR) needed for an identity certificate from the CA corresponding to this trust point entry. </li>
<a name="wp1119504"> </a><li class="pSmartList2">Enter the output file name for storing the generated certificate request. It should be specified in the bootflash:filename format and will be used to store the CSR generated in PEM format.</li>
<a name="wp1119505"> </a><li class="pSmartList2">Enter the <em class="cEmphasis">challenge</em> password to be included in the CSR. The challenge password is not saved with the configuration. This password is required in the event that your certificate needs to be revoked, so you must remember this password.</li>
<a name="wp1119506"> </a><li class="pSmartList2">Click <b class="cBold">Apply Changes</b> to save the changes.</li>
</ol></div>
<a name="wp1119507"> </a><li class="pSmartList1">Request an identity certificate from the CA.
</li>
<a name="wp1119508"> </a><p class="pListNote1">
<strong>Note	&nbsp;&nbsp;&nbsp;</strong> The CA may require manual verification before issuing the identity certificate.

</p>
<a name="wp1119509"> </a><li class="pSmartList1">To import the identity certificate, follow these steps:
</li>
<div class="pSmartList2"><ol type="a" class="pSmartList2">
<a name="wp1119510"> </a><li class="pSmartList2">Using Device Manager, choose <span style="font-weight: bold">Admin &gt; Flash Files</span> and select <span style="font-weight: bold">Copy</span> and use TFTP to copy the CA certificate to bootflash.</li>
<a name="wp1119511"> </a><li class="pSmartList2">Using DCNM-SAN, choose <span style="font-weight: bold">Switches &gt; Security &gt; PKI </span>and click the <span style="font-weight: bold">TrustPoint Actions</span> tab. </li>
<a name="wp1119512"> </a><li class="pSmartList2">Select the <b class="cBold">certimport</b> option from the Command drop-down menu to import an identity certificate in this trust point. </li>
<a name="wp1119513"> </a><p class="pBodyAutonumRel">
<strong>Note	&nbsp;&nbsp;&nbsp;</strong> The identity certificate should be available in PEM format in a file in bootflash. 

</p>
<a name="wp1119514"> </a><li class="pSmartList2">Enter the name of the certificate file which was copied to bootflash, in the URL field in the bootflash:filename format.</li>
<a name="wp1119515"> </a><li class="pSmartList2">Click <b style="font-weight: bold" class="cBold">Apply Changes </b><b style="font-weight: normal" class="cBold">to save your changes.</b></li>
<a name="wp1119516"> </a><p class="pListBodyLevel2">
If successful, the values of the identity certificate and its related objects, like the certificate file 
name, are automatically updated with the appropriate values as per the corresponding attributes in 
the identity certificate.

</p>
</ol></div>
</ol></div>
<a name="wp1119518"> </a><div style="color: #000000; font-size: 7pt; font-style: normal; font-variant: normal; font-weight: normal; margin-bottom: 10pt; margin-left: 0pt; margin-right: 0pt; margin-top: 0pt; text-align: left; text-decoration: none; text-indent: 0pt; text-transform: none">

</div>
<hr /><br><p class="pBody">Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.</p> 

    </blockquote>

  </body>
</html>
