F5 520, Руководство пользователя, Страница: 44 / 61

Chapter 2
2 - 14
Figure 2.9 is an example session with the generatekey utility.
WARNING
From a security standpoint, it is better to generate a new key instead of
importing a plain text key which may have already been compromised. To
generate a new key, see Using the key utilities to generate keys, on page
2-11.
Additional configuration options
After you complete the 520/540 configuration, you have a number of
options:
◆
After you have initialized the security world and generated keys, you can
manage the keys with the Key Management System. For more
information about the Key Management System, see the BIG-IP
Reference Guide, Chapter 7, Using the Key Management System, under
the Authentication section.
◆
There are additional SSL Accelerator options you can configure. For
more information, see the BIG-IP Reference Guide, Chapter 7, SSL
Accelerator Proxies.
◆
All configurations have health monitoring options. Refer to the BIG-IP
Reference Guide, Chapter 11, Monitors.
◆
When you create a pool, there is an option to set up persistence and a
choice of load balancing methods. Refer to the BIG-IP Reference Guide,
Chapter 4, Pools.
bigip:/config/bigconfig/ssl.key# generatekey --import ssleay protect=module
nCipher KM key generation/import utility
Site domain name ? [ ] host.company.com
Key file to import: bigip.key
Recovery feature ? (y/n) [y] y
key generation/import parameter(s):
protect Protected by MODULE
x509dnscommon Site domain name host.company.com
ssleayconvfile Key file to import bigip.key
recovery Recovery feature 1
Importing existing key ...
Key imported into key management system.
Figure 2.9 An example session where the existing key bigip.key is imported using the generatekey utility