Users Guide

Certificate Signing Request
A Certificate Signing Request (CSR) is a digital request to a certificate authority (referred to as a CA in the Web interface)
for a secure server certificate. Secure server certificates ensure the identity of a remote system and ensure that information
exchanged with the remote system cannot be viewed or changed by others. To ensure the security for your CMC, it is strongly
recommended that you generate a CSR, submit the CSR to a certificate authority, and upload the certificate returned from the
certificate authority.
A certificate authority is a business entity that is recognized in the IT industry for meeting high standards of reliable screening,
identification, and other important security criteria. Examples of CAs include Thawte and VeriSign. After the certificate authority
receives your CSR, they review and verify the information the CSR contains. If the applicant meets the certificate authority’s
security standards, the certificate authority issues a certificate to the applicant that uniquely identifies that applicant for
transactions over networks and on the Internet.
After the certificate authority approves the CSR and sends you a certificate, you must upload the certificate to the CMC
firmware. The CSR information stored on the CMC firmware must match the information contained in the certificate.
NOTE: To configure SSL settings for CMC, you must have Chassis Configuration Administrator privilege.
NOTE: Any server certificate you upload must be current (not expired) and signed by a certificate authority.
Related concepts
Generating a New Certificate Signing Request on page 87
Uploading Server Certificate on page 88
Viewing Server Certificate on page 89
Generating a New Certificate Signing Request
To ensure security, it is strongly recommended that you obtain and upload a secure server certificate to CMC. Secure server
certificates ensure the identity of a remote system and that information exchanged with the remote system cannot be viewed
or changed by others. Without a secure server certificate, CMC is vulnerable to access from unauthorized users.
To obtain a secure server certificate for CMC, you must submit a Certificate Signing Request (CSR) to a certificate authority of
your choice. A CSR is a digital request for a signed, secure server certificate containing information about your organization and
a unique, identifying key.
After generating the CSR, you are prompted to save a copy to your management station or shared network, and the unique
information used to generate the CSR is stored on CMC. This information is used later to authenticate the server certificate
you receive from the certificate authority. After you receive the server certificate from the certificate authority, you must then
upload it to CMC.
NOTE:
For CMC to accept the server certificate returned by the certificate authority, authentication information contained
in the new certificate must match the information that was stored on CMC when the CSR was generated.
CAUTION: When a new CSR is generated, it overwrites any previous CSR on CMC. If a pending CSR is
overwritten before its server certificate is granted from a certificate authority, CMC does not accept the server
certificate because the information it uses to authenticate the certificate has been lost. Take caution when
generating a CSR to prevent overwriting any pending CSR.
Generating a New Certificate Signing Request Using Web Interface
To generate a CSR using the CMC Web interface:
1. In the system tree, go to Chassis Overview, and then click Network > SSL. The SSL Main Menu is displayed.
2. Select Generate a New Certificate Signing Request (CSR) and click Next. The Generate Certificate Signing
Request (CSR) page is displayed.
3. Type a value for each CSR attribute value.
4. Click Generate. A File Download dialog box appears.
5. Save the csr.txt file to your management station or shared network. (You may also open the file at this time and save it
later.) You must later submit this file to a certificate authority.
Configuring CMC
87