NOTE:
SSL is described in client/server terminology, where the SSL-enabled switch is the server
and a Web browser is the client.
The certificate provides information to the browser such as the server name, the trusted certificate
authority (CA) that issued the certificate, the date it was issued, and the switch’s public key.
The browser and server use this information to negotiate a secure connection in the following
manner:
•
The browser verifies the certificate authority’s authenticity by checking it against its own list
of CAs. (Web browsers such as Microsoft Internet Explorer and Mozilla Firefox maintain data
on trusted CAs.)
•
After validating the CA, the browser and switch negotiate the highest level of security available
to both. The browser uses the public key to encrypt a random number and send it to the switch.
The switch uses a private key stored in memory (not advertised on the certificate) to decrypt
it. From this process, the browser and switch determine an algorithm for encrypting and
decrypting all further communication during the HTTPS session.
To enable secure HTTPS connections via SSL, the HTTPS Admin mode must be enabled on the
switch, and the Web server must have a public key certificate. The switch can generate its own
certificates, or you can generate these externally and download them to the switch.
•
Certificates generated by the switch are self-signed; that is., the validity of the information
provided in the certificate is attested to by the switch itself.
•
Downloaded certificates can also be self-signed (by a server other than the switch), or they
can be root certificates. A root certificate has been digitally signed by a CA, and is therefore
considered to provide a higher level of security.
You can also download the encryption parameter files that provide algorithms for encrypting the
key exchanges.
To manage HTTP parameters and certificates, you use both the Secure Connection page and the
Update Manager page.
To display the Secure Connection page, click
Security > Secure Connection
in the navigation pane.
Figure 27 Secure Connection Page
Table 24 Secure Connection Fields
Description
Field
Enable the Administrative mode of HTTP. This mode can only be disabled when the
HTTPS Admin mode is enabled.
HTTP Admin Mode
Enable secure HTTPS sessions. (Verify that the Certificate Present field is set to True.)
HTTPS Admin Mode
You can only download SSL certificates when this mode is disabled.
The number of minutes after which an HTTPS session times-out if there is no user
activity.
Session Soft Timeout
40
Security
