Reference Guide – DOC. 7150B
3-Series Control Systems
•
23
Generate a Certificate Signing Request (CSR)
To generate a certificate signing request, issue the
CREATECSR
"C:ST:L:O:OU:CN:E"
command, where the following parameters are replaced
with the appropriate data that should appear in the certificate:
NOTE:
Any parameter that is not required can be left blank as needed.
•
C
: The two letter country code (corresponding to ISO 3166)
•
ST
: State or province name
•
L
: Locality or city name
•
O
: Organization name (required)
•
OU
: Organizational or unit name
•
CN
: Common name (required)
NOTE:
The common name is not transferable, and thus must be one that
is used by clients. The common name must be officially registered to the
company; otherwise, the certificate request is rejected.
•
E
: Email address
By default, a certificate request for a certificate with a 2048-bit RSA signature is
requested. The CSR "request.csr" file is saved automatically to the "\Sys\"
directory of the control system.
Obtain the Certificate
The exact procedures required to obtain a CA-signed certificate differ depending
on the CA, but in all cases, it is necessary to submit the request.csr file along with
any other verification that the CA requires.
To obtain the request.csr file:
1.
Using SSH, issue the
move \Sys\request.csr \User
command.
2.
Use an SCP client to copy the request.csr file from \User directory of the
control system.
In some cases, it may be necessary to open the .csr file in a text editing program
and to copy and paste the text between the "Begin certificate request" and "End
certificate request" delimiters before sending the file to the CA.
NOTE:
All certificate files must be in .pem format.
