<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!-- saved from url=(0014)about:internet -->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta http-equiv="Content-Style-Type" content="text/css" />
    <meta name="GENERATOR" content="Quadralay WebWorks AutoMap 2003 Platinum Edition Client for FrameMaker 8.6.6597.0" />
    <meta name="TEMPLATEBASE" content="emwebh8-1-17" />
    <meta name="LASTUPDATED" content="08/01/13 14:47:51" />
    <title>RSA Key-Pairs and Identity Certificates </title>
    <!-- Copyright 2010-2013, Cisco Systems, Inc. All rights reserved. -->

    <link rel="StyleSheet" href="document.css" type="text/css" />
    <link rel="StyleSheet" href="catalog.css" type="text/css" />


<script> 
    var is_chrome = navigator.userAgent.toLowerCase().indexOf('chrome') > -1; 
   
    if(is_chrome){document.domain=document.domain}
   </script>
    <script type="text/javascript" language="JavaScript1.2" src="expand.js"></script>
    <script type="text/javascript" language="JavaScript1.2" src="page.js"></script>

    <script type="text/javascript" language="JavaScript1.2">
     <!--
      function  WWNoOp() {}
      function  WWNoValue() { return ""; }

      var  VarDropDown;

      if (typeof(HTMLHelp_Object) != "undefined")
      {
        VarDropDown = new WWDropDown_Object();
      }
      else
      {
        VarDropDown = new Object();
        VarDropDown.fAnchorOpen  = WWNoOp;
        VarDropDown.fAnchorClose = WWNoOp;
        VarDropDown.fDIVOpen  = WWNoOp;
        VarDropDown.fDIVClose = WWNoOp;
      }
     // -->
    </script>

  
<SCRIPT language="javascript">
<!--
  self.document.write("<link href='"+top.relPath+"shared/style.css' rel='stylesheet' type='text/css'>");
  myid=1622;
  self.document.write("<script type='text/javascript' language='JavaScript' src='"+top.relPath+"shared/con_utils.js'></scr"+"ipt>");
//-->
</SCRIPT>
</head>

  <body onload="highlightSearchTerms();" bgcolor="#ffffff">

    
    <blockquote>
    <a name="top"></a>

    
    


<a name="wp1072834"> </a><h1 class="pTitle">
RSA Key-Pairs and Identity Certificates

</h1>
<a name="wp1072835"> </a><p class="pBody">
You can generate one or more RSA key-pairs and associate each RSA key-pair with a trust point CA 
where the MDS switch intends to enroll to obtain an identity certificate. The MDS switch needs only one 
identity per CA, which consists of one key-pair and one identity certificate per CA.

</p>
<a name="wp1072836"> </a><p class="pBody">
Cisco MDS NX-OS allows you to generate RSA key-pairs with a configurable key size (or modulus). 
The default key size is 512. You can also configure an RSA key-pair label. The default key label is the 
switch fully qualified domain name (FQDN).

</p>
<a name="wp1072837"> </a><p class="pBody">
The following list summarizes the relationship between trust points, RSA key-pairs, and identity 
certificates:

</p>
<div class="pSmartList1"><ul class="pSmartList1">
<a name="wp1072838"> </a><li class="pSmartList1">A trust point corresponds to a specific CA that the MDS switch trusts for peer certificate verification 
for any application (such as IKE or SSH).
</li>
<a name="wp1072839"> </a><li class="pSmartList1">An MDS switch can have many trust points and all applications on the switch can trust a peer 
certificate issued by any of the trust point CAs.
</li>
<a name="wp1072840"> </a><li class="pSmartList1">A trust point is not restricted to a specific application.
</li>
<a name="wp1072841"> </a><li class="pSmartList1">An MDS switch enrolls with the CA corresponding to the trust point to obtain an identity certificate. 
You can enroll your switch with multiple trust points thereby obtaining a separate identity certificate 
from each trust point. The identity certificates are used by applications depending upon the purposes 
specified in the certificate by the issuing CA. The purpose of a certificate is stored in the certificate 
as certificate extensions.
</li>
<a name="wp1072842"> </a><li class="pSmartList1">When enrolling with a trust point, you must specify an RSA key-pair to be certified. This key-pair 
must be generated and associated to the trust point before generating the enrollment request. The 
association between the trust point, key-pair, and identity certificate is valid until it is explicitly 
removed by deleting the certificate, key-pair, or trust point.
</li>
<a name="wp1072843"> </a><li class="pSmartList1">The subject name in the identity certificate is the fully qualified domain name for the MDS switch.
</li>
<a name="wp1072844"> </a><li class="pSmartList1">You can generate one or more RSA key-pairs on a switch and each can be associated to one or more 
trust points. But no more than one key-pair can be associated to a trust point, which means only one 
identity certificate is allowed from a CA.
</li>
<a name="wp1072845"> </a><li class="pSmartList1">If multiple identity certificates (each from a distinct CA) have been obtained, the certificate that an 
application selects to use in a security protocol exchange with a peer is application specific.
</li>
<a name="wp1072846"> </a><li class="pSmartList1">You do not need to designate one or more trust points for an application. Any application can use 
any certificate issued by any trust point as long as the certificate purpose satisfies the application 
requirements.
</li>
<a name="wp1072847"> </a><li class="pSmartList1">You do not need more than one identity certificate from a trust point or more than one key-pair to 
be associated to a trust point. A CA certifies a given identity (name) only once and does not issue 
multiple certificates with the same subject name. If you need more than one identity certificate for 
a CA, then define another trust point for the same CA, associate another key-pair to it, and have it 
certified, provided CA allows multiple certificates with the same subject name.
</li>
</ul></div>
<hr /><br><p class="pBody">Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.</p> 

    </blockquote>

  </body>
</html>
