Coyote Point Systems E350GX, Installation And Administration Manual

Page: 286 / 344

Appendix E: Using Certificates in HTTPS Clusters
282 Equalizer Installation and Administration Guide
confirmation. Once you accept the certificate, the server should ask for a client certificate; your browser may
ask you to choose one. After the client certificate is sent to the server and accepted, the requested page should
be displayed.
Generating a CSR and Getting It Signed by a CA
Most CA vendors provide a means of generating a Certificate Signing Request (CSR) on their websites, and we
recommend that you use the CA website to generate the CSR. For several good tutorials on how to get your
certificates signed, please see:
http://sial.org/howto/openssl/
A CSR can also be generated using the OpenSSL tools on any system, including Windows. The examples below
were executed on a Windows system with the OpenSSL tools installed.
Note that only the most basic openssl command options are shown in these examples. See the openssl (1) and req (1)
manual pages for the SSL implementation on your system for more information.
Generating a CSR using OpenSSL
1. Navigate to an appropriate directory on your system, and create a new directory to hold your CSR, certificate,
and private key.
2. Generate the CSR by entering this command:
openssl req -new -newkey rsa:1024 -out cert.csr
This begins an interactive session to generate a CSR, and also generates a new private key to be output into a
file named
privkey.pem . The key length you use (1024 in this example) can be any multiple of 8. If you already
have a private key, use -key filename (instead of -newkey rsa:1024 ) to specify the file containing the private
key. The key length you use (i.e., 1024 in this example) can be any multiple of 8.
After generating the private key, the following prompts are displayed (example responses shown):
Enter PEM pass phrase: <password>
Verifying - Enter PEM pass phrase: <password>
Country Name (2 letter code) [AU]: US
State or Province Name (full name) [Some-State]: New York
Locality Name (eg, city) []: Millerton
Organization Name (eg, company) [Internet Widgits Pty Ltd]: CPS Inc.
Organizational Unit Name (eg, section) []: Engineering
Common Name (eg, YOUR name) []: mycluster.example.com
Email Address []: admin@example.com
Make sure you remember the password you specify, as you will need it to install and use the certificate.
For a server certificate , the Common Name provided must be the DNS-resolvable fully qualified domain name
(FQDN) used by the Equalizer cluster. When a client receives the certificate from the server, the client browser
will display a warning if the
Common Name does not match the hostname of the request URI.
For a client certificate , the Common Name in the client’s copy of the certificate is only compared to the
Common Name in the copy of the client certificate on the server, so Common Name can be any value.
3. Visit the website of an SSL Certificate Authority (CA) to submit the cert.csr file to the CA.
Note – Generating a CSR from the command line on Equalizer is NOT supported. Consult the Certificate
Authority that supplies your SSL certificates and use the tools that they recommend.