Coyote Point Systems Equalizer GX Series, Руководство администратора

Страница: 822 / 866

Using Certificates in HTTPS Clusters
Generating a Self-Signed Certificate
To generate a self signed certificate in PEM format:
1. Generate a self-signed x509 format certificate by entering this command:
openssl req -new -x509 -newkey rsa:1024 -out selfcert.pem -days 1095
This creates a self-signed certificate ( selfcert.pem ) that will be valid for 1095 days
(about three years) andalso generates a new private key to be output into a file
named
privkey.pem
. If you already have a private key, use -
key filename
instead of -
newkey rsa:1024
to specify the file containing the private key.
After generating the private key, the following prompts are displayed (example
responses shown):
Enter PEM pass phrase: < password >
Verifying - Enter PEM pass phrase: < password >
Country Name (2 letter code) [AU]: US
State or Province Name (full name) [Some-State]: New York
Locality Name (eg, city) []:
Millerton
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
CPS Inc.
Organizational Unit Name (eg, section) []:Engineering Common Name (eg, YOUR name)
[]: myclient.example.com
Email Address []: admin@example.com
Depending on the tool you use to create the certificate, you may also be asked for a
challenge password and other optional information. Make sure you remember the
password
(and, if prompted, the challenge password) you specify, as you will need it to
install the certificate.
The
Common Name
provided must be the DNS-resolvable fully qualified domain name
(FQDN) used by the cluster. For a server certificate, when the client receives the
certificate from the server, the browser will display a warning if the
Common Name
does not match the hostname of the request URI. For a client certificate, the Common
Name in the client’s copy of the certificate is only compared to the
Common Name
in the
copy on the server, so this can be any value.
2. Combine the private key and certificate into one file, using a command like the following:
cat selfcert.pem privkey.pem > clustercert.pem
3. You can now install your self signed certificate and private key file,
clustercert.pem
, on
Equalizer and your clients, as appropriate.
822 Copyright © 2014 Coyote Point Systems, A Subsidiary of Fortinet, Inc.