Dell S3048-ON, Configuration Manual

Page: 1033 / 1036

NOTE: The command contains multiple options with the Common Name being a required field and blanks being filled in
for unspecified fields.
Information about installing trusted certificates
Dell Networking OS also enables you to install a trusted certificate. The system can then present this certificate for authentication to
clients such as SSH and HTTPS.
This trusted certificate is also presented to the TLS server implementations that require client authentication such as Syslog. The
certificate is digitally signed with the private key of a CA server.
You can download the trusted certificate for a device from flash, usbflash, tftp, ftp, or scp. This certificate is stored in the BSD file system
and can be used to authenticate the switch to clients.
Installing trusted certificates
To install a trusted certificate, perform the following step:
In global configuration mode, enter the following command:
crypto cert inatall { path }
Transport layer security (TLS)
Transport Layer Security (TLS) provides cryptographic protection for TCP-based application protocols.
In Dell Networking OS, TLS already protects secure HTTP for the REST and HTTPD server implementations.
NOTE: There are three modern versions of the TLS protocol: 1.0, 1.1, and 1.2. Older versions are called “SSL” v1, v2, and v3, and
should not be supported.
The TLS protocol implementation in Dell Networking OS takes care of the following activities:
• Session negotiation and shutdown
•
Protocol Version
• Cryptographic algorithm selection
• Session resumption and renegotiation
• Certificate revocation checking, which may be accomplished through OCSP
When operating in FIPS mode, the system is restricted to only the TLS 1.2 protocol version and support the following cipher suites in line
with the NIST SP800-131A Rev 1 policy document—published July 2015:
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA256
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
TLS_DH_RSA_WITH_AES_256_CBC_SHA256
TLS_DH_RSA_WITH_AES_128_CBC_SHA256
TLS_RSA_WITH_AES_128_CBC_SHA256
TLS_RSA_WITH_AES_256_CBC_SHA256
When not operating in FIPS mode, the system may support TLS 1.0 up to 1.2, and older ciphers and hashes:
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
X.509v3 1033