HP Fabric OS 7.1.0, Administrator'S Manual

Page: 215 / 666

Fabric OS Administrator’s Guide 215
53-1002745-02
Authentication policy for fabric elements
7
FCAP configuration overview
Beginning with Fabric OS release 7.0.0, you must configure the switch to use third-party certificates
for authentication with the peer switch.
To perform authentication with FCAP protocol with certificates issued from third party, the user has
to perform following steps:
1. Choose a certificate authority (CA).
2. Generate a public, private key, passphrase and a CSR on each switch.
3. Store the CSR from each switch on a file server.
4. Obtain the certificates from the CA.
You can request a certificate from a CA through a Web browser. After you request a certificate,
the CA either sends certificate files by e-mail (public) or gives access to them on a remote host
(private). Typically, the CA provides the certificate files listed in
Table 36 .
ATTENTION
Only the .pem file is supported for FCAP authentication.
5. On each switch, install the CA certificate before installing switch certificate.
6. After the CA certificate is installed, install the switch certificate on each switch.
7. Update the switch database for peer switches to use third-party certificates.
8. Use the newly installed certificates by starting the authentication process.
Generating the key and CSR for FCAP
The public/private key and CSR has to be generated for the local and remote switches that will
participate in the authentication. In FCAP, one command is used to generate the public/private key
the CSR, and the passphrase.
1. Log in to the switch using an account with admin permissions, or an account associated with
the chassis role and having OM permissions for the PKI RBAC class of commands.
2. Enter the secCertUtil generate -fcapall -keysize command on the local switch.
switch:admin> seccertutil generate -fcapall -keysize 1024
WARNING!!!
About to create FCAP:
ARE YOU SURE (yes, y, no, n): [no] y
Installing Private Key and Csr...
Switch key pair and CSR generated...
3. Repeat step 2 on the remote switch.
TABLE 36
FCAP certificate files
Certificate file Description
name CA.pem The CA certificate. It must be installed on the remote and local switch to verify the
validity of the switch certificate or switch validation fails.
name .pem The switch certificate.