Users Guide

• key-file {key-path | private} — Enter the local path where the downloaded or locally generated
private key is stored. If the key was downloaded to a remote server, enter the server path using a secure
method, such as HTTPS, SCP, or SFTP. Enter private to store the key in a local hidden location.
• country 2-letter-code — (OPTIONAL) Enter the two-letter code that identies the country.
• state state — Enter the name of the state.
• locality city — Enter the name of the city.
• organization organization-name — Enter the name of the organization.
• orgunit unit-name — Enter name of the unit.
• cname common-name — Enter the common name assigned to the certicate. Common name is the main
identity presented to connecting devices. By default, the switch’s host name is the common name. You can
congure a dierent common name for the switch; for example, an IP address. If the common-name value
does not match the device’s presented identity, a signed certicate does not validate.
• email email-address — Enter a valid email address used to communicate with the organization.
• validity days — Enter the number of days that the certicate is valid. For a CSR, validity has no eect.
For a self-signed certicate, the default is 3650 days or 10 years.
• length bit-length — Enter a bit value for the keyword length. For FIPS mode, the range is from 2048 to
4096; for non-FIPS mode, the range is from 1024 to 4096. The default key length for both FIPS and non-FIPS
mode is 2048 bits. The minimum key length value for FIPS mode is 2048 bits. The minimum key length value
for non-FIPS mode is 1024 bits.
• altname altname — Enter an alternate name for the organization; for example, using the IP address such
as altname IP:192.168.1.100.
Default
Not congured
Command mode EXEC
Usage information Generate a CSR when you want a CA to sign a host certicate. Generate a self-signed certicate if you do not set
up a CA and implement a certicate trust model in your network.
If you enter the cert-file option, you must enter all the required parameters, including the local path where the
certicate and private key are stored.
If you do not specify the cert-file option, you are prompted to ll in the other parameter values for the
certicate interactively; for example:
You are about to be asked to enter information that will be incorporated into
your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank.
For some fields there will be a default value; if you enter '.', the field
will be left blank.
Country Name (2 letter code) [US]:
State or Province Name (full name) [Some-State]:California
Locality Name (eg, city) []:San Francisco
Organization Name (eg, company) []:Starfleet Command
Organizational Unit Name (eg, section) []:NCC-1701A
Common Name (eg, YOUR name) [hostname]:S4148-001
Email Address []:[e-mail]
If the system is in FIPS mode — crypto fips enable command — the CSR and private key are generated
using approved algorithms from a cryptographic library that has been validated against the FIPS 140-2 standard.
You can install the FIPS-compliant certicate-key pair using the crypto cert install command with the
fips option.
Examples
OS10# crypto cert generate request cert-file home://cert1.pem key-file home://
cee OS10-VM email [e-mail] length 1024 altname DNS.dell.com
Security 991