Hitachi AMS 2100, Руководство по оборудованию

Страница: 232 / 306

7–50
Configuration
Hitachi AMS 2100/2300 Storage System Hardware Guide
Changing the server certificate and private key
Complete the following easy steps to create a server certificate/private key
using OpenSSL. After creating the server certificate/private key, update the
server certificate/private key on the array.
1. Install OpenSSL and configure your environment that enable OpenSSL
to use. Refer to OpenSSL Project ( http://www.openssl.org ).
2. Create a private key using the RSA algorithm. You can select a key
length of 512, 1024, or 2048 bits.
3. Create an x.509 v3 server certificate. Use the certificate signed by the
Certificate Authority (CA) or the certificate with your signature for the
server certificate depending on the purpose.
a.
When using the server certificate signed by the CA:
Create a Certificate Signing Request (CSR). Submit the CSR (“csr.pem” in the
example) to the CA and obtain the signed server certificate.
For example,
when the expiration date is 365 days (one year), enter:
openssl req -new -days 365 -key privkey.pem -out csr.pem
The obtained signed server certificate is described as “cacert.pem”
hereinafter.
b. When using a self-signed certificate, create a certificate with your
signature. Use the certificate only for the local environment or test.
For example, when the validity period is 365 days (one year)
openssl req -new -x509 -key privkey.pem -out cacert.pem -
days 365
NOTE:
• Only the x.509v3 certificate and RSA key are supported.
• The certificate, private key and public key are read integrally up to the
total of 8192 bytes.
• The Certificate Revocation List (CRL) is unsupported.
NOTE: You cannot use the private key encrypted by the Triple DES
algorithm, etc. For example, with a 2048-bit key length, the command
would be
openssl genrsa -out privkey.pem 2048