ExtraHop Trace Admin UI, Руководство пользователя

Страница: 20 / 58

ExtraHop 8.8 ExtraHop Trace Admin UI Guide 20
Next steps
After you confirm that your new settings are working as expected, preserve your configuration changes
through system restart and shutdown events by saving the Running Config file.
SSL Certificate
SSL certificates provide secure authentication to the ExtraHop system.
You can designate a self-signed certificate for authentication instead of a certificate signed by a Certificate
Authority. However, be aware that a self-signed certificate generates an error in the client browser, which
reports that the signing certificate authority is unknown. The browser provides a set of confirmation pages
to trust the certificate, even though the certificate is self-signed. Self-signed certificates can also degrade
performance by preventing caching in some browsers. We recommend that you create a certificate-signing
request from your ExtraHop system and upload the signed certificate instead.
Important: When replacing an SSL certificate, the web server service is restarted. Tunneled
connections from Discover appliances to Command appliances are lost but then re-
established automatically.
Upload an SSL certificate
You must upload a .pem file that includes both a private key and either a self-signed certificate or a
certificate-authority certificate.
Note: The .pem file must not be password protected.
Note: You can also automate this task through the REST API .
1. In the Network Settings section, click SSL Certificate .
2. Click Manage certificates to expand the section.
3. Click Choose File and navigate to the certificate that you want to upload.
4. Click Open .
5. Click Upload .
Generate a self-signed certificate
1. In the Network Settings section, click SSL Certificate .
2. Click Manage certificates to expand the section.
3. Click Build SSL self-signed certificate based on hostname .
4. On the Generate Certificate page, click OK to generate the SSL self-signed certificate.
Note: The default hostname is
extrahop
.
Create a certificate signing request from your ExtraHop system
A certificate signing request (CSR) is a block of encoded text that is given to your Certificate Authority
(CA) when you apply for an SSL certificate. The CSR is generated on the ExtraHop system where the SSL
certificate will be installed and contains information that will be included in the certificate such as the
common name (domain name), organization, locality, and country. The CSR also contains the public key
that will be included in the certificate. The CSR is created with the private key from the ExtraHop system,
making a key pair.
1. Log in to the Administration settings on the ExtraHop system through
https://<extrahop-
hostname-or-IP-address>/admin
.
2. In the Network Settings section, click SSL Certificate .
3. Click Manage certificates and then click Export a Certificate Signing Request (CSR) .