F5 520, Руководство пользователя

Страница: 43 / 61

Configuring the FIPS 140 Hardware
F5 Networks, Inc., Platform Guide 2 - 13
Generating a certificate request file and temporary certificate
This section describes how to use the key you generated, or an existing key,
to generate a certificate request file and a temporary certificate with the
gencert utility.
To generate a certificate with an existing key using the
gencert utility
To generate a temporary certificate and request file to submit to the
certificate authority with the gencert utility, you must first copy an existing
key for a server into the following directory on the 520/540:
/config/bigconfig/ssl.key/
After you copy the key into this directory, type the following command at
the command line:
/usr/local/bin/gencert <server_name>
For the <server_name>, type the FQDN of the server to which the
certificate applies. After the utility starts, it prompts you for various
information. After you run this utility, a certificate request form is created in
the following directory:
/config/bigconfig/ssl.crt/<fqdn>.csr
The <fqdn> is the fully qualified domain name of the server. Please contact
your certificate authority (CA) and follow their instructions for submitting
this request form.
Importing existing public keys and certificates
No additional software is needed to import an existing private key. Change
to the /config/bigconfig/ssl.key directory (or the directory that contains the
private key you want to import). Identify the key you want to import. It must
be in PEM format. From the command line, run the generatekey command
with the following command:
generatekey
WARNING
After you import or generate keys on a redundant system, make sure you
synchronize the 520/540 configuration. To synchronize the 520/540
configuration, see To synchronize the 520/540 configuration from the
command line, on page 2-6