Users Guide

– cert-file cert-filepath species a source location for a downloaded certicate; for example, home://s4048-001-
cert.pem or usb://s4048-001-cert.pem.
– key-file {key-path | private} species the local path to retrieve the downloaded or locally generated private key. Enter
private to install the key from a local hidden location and rename the key le with the certicate name.
– password passphrase species the password used to decrypt the private key if it was generated using a password.
– fips installs the certicate-key pair as FIPS-compliant. Enter fips to install a certicate-key pair that is used by a FIPS-aware
application, such as RADIUS over TLS. If you do not enter fips, the certicate-key pair is stored as a non-FIPS-compliant pair.
NOTE: You determine if the certicate-key pair is generated as FIPS-compliant. Do not use FIPS-compliant
certicate-key pairs outside of FIPS mode. When FIPS mode is enabled, you can still generate CSRs for non-FIPS
certicates for use with non-FIPS applications. Be sure to install these certicates as non-FIPS with the crypto
cert install command.
– If you enter fips after using the key-file private option in the crypto cert generate request command, a FIPS-
compliant private key is stored in a hidden location in the internal le system that is not visible to users.
If the certicate installation is successful, the le name of the host certicate and its common name are displayed. Use the lename to
congure the certicate in a security prole using the crypto security-profile command.
Example: Generate CSR and upload to server
OS10# crypto cert generate request cert-file home://DellHost.pem key-file home://DellHost.key
email [e-mail] length 1024 altname DNS:dell.domain.com
Processing certificate ...
Successfully created CSR file /home/admin/DellHost.pem and key
OS10# copy home://DellHost.pem scp:///tftpuser@10.11.178.103:/tftpboot/certs/DellHost.pem
password:
Host certicate tip
When administering a large number of switches, you may choose to not generate numerous CSRs for all switches. An alternate method to
installing a host certicate on each switch is to generate both the private key le and CSR oine; for example, on the CA server. The CSR
is signed by the CA, which generates both a certicate and key le. You then copy the trusted certicate and key le to the switch using
the copy command and install them using the crypto cert install cert-file home://cert-filename key-file
home://
key-filename command.
NOTE
: For security reasons, the private key le is copied to an internal, secure location and removed from the viewable le
system.
Example: Download and install trusted certicate and private key
OS10# copy scp:///tftpuser@10.11.178.103:/tftpboot/certs/Dell_host1_CA1.pem home://
Dell_host1_CA1.pem
password:
OS10# copy scp:///tftpuser@10.11.178.103:/tftpboot/certs/Dell_host1_CA1.key home://
Dell_host1_CA1.key
password:
OS10# crypto cert install cert-file home://Dell_host1_CA1.pem key-file home://Dell_host1_CA1.key
Processing certificate ...
Certificate and keys were successfully installed as "Dell_host1_CA1.pem" that may be used in a
security profile. CN = Dell_host1_CA1
Display trusted certicates
OS10# show crypto cert
--------------------------------------
| Installed non-FIPS certificates |
--------------------------------------
Dell_host1_CA1.pem
--------------------------------------
Security
981