F5 520, Руководство пользователя

Страница: 41 / 61

Configuring the FIPS 140 Hardware
F5 Networks, Inc., Platform Guide 2 - 11
Using the key utilities to generate keys
To obtain a valid certificate, you must have a private key. If you do not have
a key, you can use the genconf and genkey utilities on the 520/540 to
generate a key and a temporary certificate. The genkey and gencert utilities
automatically generate a request file that you can submit to a certificate
authority (CA). If you have a key, you can use the gencert utility to generate
a temporary certificate and request file.
These key utilities have specific funtions:
◆
genconf
This utility creates a key configuration file that contains specific
information about your organization. The genkey utility uses this
information to generate a certificate.
◆
genkey
After you run the genconf utility, run this utility to generate a temporary
10-year certificate for testing the SSL Accelerator on the 520/540. This
utility also creates a request file that you can submit to a certificate
authority (CA) to obtain a certificate.
◆
gencert
If you already have a key, run this utility to generate a temporary
certificate and request file for the SSL Accelerator.
WARNING
After you import or generate keys on a redundant system, make sure you
synchronize the 520/540 configurations. To synchronize the 520/540
configuration, see To synchronize the 520/540 configuration from the
command line, on page 2-6.
Generating a key configuration file and a key
If you do not have a key, you can generate a key configuration file using the
genconf utility, and use the file to generate a key with the genkey utility.
You can also use these utilities to create a new key configuration file.
To generate a key configuration file using the genconf
utility
To generate a key and certificate, first run the genconf utility from the
command line with the following command:
/usr/local/bin/genconf
The utility prompts you for information about the organization for which
you are requesting certification. This information includes:
• The fully qualified domain name (FQDN) of the server. Note that this
FQDN must be RFC1034/1035-compliant, and cannot be more than 63
characters long (this is an x509 limitation).