Coyote Point Systems E350GX, Руководство по установке и администрированию

Страница: 292 / 344

Appendix E: Using Certificates in HTTPS Clusters
288 Equalizer Installation and Administration Guide
previous section, then your certificate is already in PKCS12 format; it can be installed directly into a browser
without conversion.)
Like PEM format, PKCS12 format supports having all your certificates and your private key in one file, as discussed
above in the section “Preparing a Signed CA Certificate for Installation” on page 283. If you followed the
instructions in that section and created the file
clientprivcert.pem (containing the client certificate, the private key,
and any intermediate certificates), then converting the file to PKCS12 is simple:
openssl pkcs12 -export -in clientprivcert.pem -out clientprivcert.pfx
The resulting file, clientprivcert.pfx , can now be installed into all client browsers that will be accessing the cluster
that requires a client certificate.
In Internet Explorer , certificates are installed by selecting Tools > Internet Options from the main menu, selecting
the Content tab, and pressing the Certificates button. Select the Personal tab and then the Import button.
In FireFox , certificates are installed by selecting Tools > Options from the main menu, selecting Advanced ,
selecting the Encryption tab, and pressing the View Certificates button. When the Certificate Manager appears,
select the Your Certificates tab and then the Import button.
Private Key Storage for Cluster Certificates
When you upload a cluster certificate to Equalizer, the uploaded file contains:
• the cluster certificate
• zero or more intermediate certificates
• the private key for the cluster certificate (chosen by you when you created the certificate signing request or
self-signed certificate)
The private key should be guarded carefully and access to it restricted to those who administer Equalizer. If you do
not have Xcel enabled, or if you have Xcel II, private keys are kept in Equalizer’s file system. Xcel I also provides
the option to store provate keys in dedicated write-only memory.
Note that you should not check the sks check box when uploading client certificates, which are always stored on
Equalizer without a private key.
Equalizer Xcel SSL Hardware Acceleration provides hardware-based SSL encryption and decryption. There are two
versions of Xcel, Xcel I and Xcel II. The older version, Xcel I, optionally supports storing private keys for cluster
certificates in dedicated write-only memory -- this is called
secure key storage (SKS). All private keys uploaded to
write-only memory can only be accessed by the accelerator hardware, thus preventing unauthorized access to your
private keys.
If your Equalizer has Xcel I, a check box labeled use secure key storage will appear on an HTTPS cluster’s
Certificates
tab (see Figure 65). Checking this box tells Equalizer to store your private key in Xcel I’s write-only
memory so that no one can access it.
Xcel I provides 128 kilobits of memory for private keys. This will hold up to 128 one-kilobit (1024-bit) keys, the
only key length supported by Xcel I. (Be sure to use only 1024-bit private keys with Xcel I, regardless of whether
SKS is used.)
For Xcel II, and on Equalizer models without Xcel, a key length of 1024 bits or less is recommended. While larger
private keys are supported, 2048-bit and larger private keys can have a significant impact on performance.
Caution – With Xcel II and on Equalizer models without Xcel, a cluster certificate’s private key is stored on
Equalizer in the directory /var/eq/ssl and therfore will be accessible to anyone who can log into Equalizer. It is
therefore essential that you restrict access to the Equalizer console via the serial line and SSH, since any user
logged into the console can copy or remove your private key.
All Equalizer logins should be protected with
non-trivial passwords, and logins should be given only to trusted personnel.