Users Guide

• filename species an optional lename that the certicate is stored under in the OS10 trust-store directory. Enter the lename
in the filename.crt format.
2 Obtain an X.509v3 host certicate from the CA server as described in Request and install host certicates:
a Create a private key and generate a certicate signing request for the switch.
b Copy the CSR le to the CA server for signing.
c Copy the CA-signed certicate to the home directory on the switch.
d Install the host certicate:
crypto cert install cert-file home://cert-filepath key-file {key-path | private}
[password
passphrase] [fips]
When you install an X.509v3 certicate-key pair:
• Both take the name of the certicate. For example, if you install a certicate using:
OS10# crypto cert install cert-file home://Dell_host1.pem key-file home://abcd.key
The certicate-key pair is installed as Dell_host1.pem and Dell_host1.key. In conguration commands, refer to the pair
as Dell_host1. When you congure a security prole, you would enter Dell_host1 in the certificate certificate-
name command.
• For security reasons, because the key le contains private key information, it copied to a secure location in the OS10 le system
and deleted from its original location specied in the key-file key-path parameter.
NOTE: fips installs the certicate-key pair as FIPS-compliant. Enter fips to install a certicate-key pair that is used
by a FIPS-aware application, such as Syslog over TLS. If you do not enter fips, the certicate-key pair is stored as a
non-FIPS-compliant pair.
You determine if the certicate-key pair is generated as FIPS-compliant. Do not use FIPS-compliant certicate-key pairs
outside of FIPS mode. When FIPS mode is enabled, you can still generate CSRs for non-FIPS certicates for use with non-
FIPS applications. Be sure to install these certicates as non-FIPS with the crypto cert install command.
3
Congure a security prole for system logging over TLS using an X.509v3 certicate.
a Create a Syslog security prole in CONFIGURATION mode. See Security proles for more information.
crypto security-profile profile-name
b Assign an X.509v3 certicate and private key pair to the security prole in SECURITY-PROFILE mode. For certificate-
name, enter the name of the certicate-key pair as it appears in the show crypto certs output without the .pem
extension.
certificate certificate-name
exit
c Create a system logging-specic prole in CONFIGURATION mode.
logging security-profile profile-name
Where profile-name is the name of the Syslog security prole created in Step 2a with the crypto security-profile
profile-name command. You cannot delete a crypto server prole if it is congured for a logging server.
If you recongure crypto security profile-name, congured Syslog TLS servers are automatically updated to use the new
certicate-key pair used by the new prole.
If you recongure the certicate assigned to a crypto security prole, Syslog TLS servers are automatically updated to use new
certicate-key pair.
If you delete a certicate from a congured crypto security prole, system logging over TLS fails. A host certicate is required for the
protocol exchange with an external device.
4 Congure a remote TLS server to receive system messages in CONFIGURATION mode.
logging server {hostname | ipv4–address | ipv6–address} tls [port-number]
[severity severity-level] [vrf {management | vrf-name]
Example: Congure Syslog over TLS
OS10# copy tftp://CAadmin:secret@172.11.222.1/cacert.pem home://cacert.pem
OS10# crypto ca-cert install home://cacert.pem
1356
Troubleshoot OS10