Users Guide

A self-signed certicate is not signed by a CA. The switch presents itself as a trusted device in its certicate. Connecting clients may
prompt their users to trust the certicate — for example, when a web browser warns that a site is unsafe — or to reject the certicate,
depending on the conguration. A self-signed certicate does not provide protection against man-in-the-middle attacks.
To generate and install a self-signed certicate:
1 Create a self-signed certicate and key in a local directory or USB ash drive.
2 Install the self-signed certicate.
Generate a self-signed certicate
• Create a self-signed certicate in EXEC mode. Store the device.key le in a secure, persistent location, such as NVRAM.
crypto cert generate self-signed [cert-file cert-path key-file {private | keypath}]
[country 2-letter code] [state state] [locality city] [organization organization-name]
[orgunit unit-name] [cname common-name] [email email-address] [validity days]
[length length] [altname alt-name]
If you enter the cert-file option, you must enter all the required parameters, including the local path where the certicate and
private key are stored.
If you do specify the cert-file option, you are prompted to enter the other parameter values for the certicate interactively; for
example:
You are about to be asked to enter information that will be incorporated in your certificate
request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank.
For some fields there will be a default value; if you enter '.', the field will be left blank.
Country Name (2 letter code) [US]:
State or Province Name (full name) [Some-State]:California
Locality Name (eg, city) []:San Francisco
Organization Name (eg, company) []:Starfleet Command
Organizational Unit Name (eg, section) []:NCC-1701A
Common Name (eg, YOUR name) [hostname]:S4148-001
Email Address []:[e-mail]
The switch uses SHA-256 as the digest algorithm. The public key algorithm is RSA with a 2048-bit modulus.
NOTE
: When using self-signed X.509v3 certicates with Syslog and RADIUS servers, congure the server to accept self-signed
certicates. Syslog and RADIUS servers require mutual authentication, which means that the client and server must verify each
other's certicates. Dell EMC Networking recommends conguring a CA server to sign certicates for all trusted devices in the
network.
Install self-signed certicate
• Install a self-signed certicate and key le in EXEC mode.
crypto cert install cert-file home://cert-filename key-file {key-path | private}
[password passphrase] [fips]
– cert-file cert-path species a source location for a downloaded certicate; for example, home://s4048-001-
cert.pem
or usb://s4048-001-cert.pem.
– key-file {key-path | private} species the local path to retrieve the downloaded or locally generated private key. Enter
private to install the key from a local hidden location and rename the key le with the certicate name.
– password passphrase species the password used to decrypt the private key if it was generated using a password.
– fips installs the certicate-key pair as FIPS-compliant. Enter fips to install a certicate-key pair that is used by a FIPS-aware
application, such as RADIUS over TLS. If you do not enter
fips, the certicate-key pair is stored as a non-FIPS compliant pair.
NOTE
: You determine if the certicate-key pair is generated as FIPS-compliant. Do not use FIPS-compliant
certicate-key pairs outside of FIPS mode.
– If you enter fips after using the key-file private option in the crypto cert generate request command, a FIPS-
compliant private key is stored in a hidden location in the internal le system that is not visible to users.
Security
983