HP NonStop SSL, Справочное руководство, Страница: 105 / 127

HP NonStop SSL Reference Manual SSL Reference
•
105
NonStop SSH is installed by default on NonStop servers for maintenance LANs, and can be accessed from the
system console via an SFTP client such as available in Win6530 or OpenSSH in a DOS window.
sftp ..
cd $SYSTEM.SSLCERTS
put server\servcert.der SERVCERT
put server\servkey.der SERVKEY
put ca\cacert.der CACERT
Note : the NonStop SSL installation subvolume $system.znsssl contains a set of test certificates that should not
be used in production systems. Unless the configuration file contains parameter settings pointing to a different
set of certificates, the default certificates in znsssl will be used.
8. Add these parameter settings to the configuration of your HP NonStop SSL server process:
SERVCERT $SYSTEM.SSLCERTS.SERVCERT
CACERTS $SYSTEM.SSLCERTS.CACERT
SERVKEY $SYSTEM.SSLCERTS.SERVKEY
SERVKEYPASS <pass phrase>
Captured output from certificate generation
C:\Comforte\OpenSSL_certificates>openssl genrsa -aes256 -out ca\cakey.pem 4096
Loading 'screen' into random state - done
Generating RSA private key, 4096 bit long modulus
Enter pass phrase for ca\cakey.pem:
Verifying - Enter pass phrase for ca\cakey.pem:
C:\Comforte\OpenSSL_certificates>openssl req -out ca\cacert.pem -new -key ca\cakey.pem
-x509 -days 365
Enter pass phrase for ca\cakey.pem:
Loading 'screen' into random state - done
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:
State or Province Name (full name) [California]:
Locality Name (eg, city) []:
Organization Name (eg, company) [comForte Inc]:
Organizational Unit Name (eg, section) [Development]:
Common Name (eg, YOUR name) []:CRS
Email Address []:
C:\Comforte\OpenSSL_certificates>openssl x509 -inform PEM -outform DER -in
ca\cacert.pem -out ca\cacert.der
C:\Comforte\OpenSSL_certificates>openssl genrsa -aes256 -out server\servkey.pem 4096
Loading 'screen' into random state - done
Generating RSA private key, 4096 bit long modulus
Enter pass phrase for server\servkey.pem:
Verifying - Enter pass phrase for server\servkey.pem:
C:\Comforte\OpenSSL_certificates>openssl req -out server\csr.pem -new -key
server\servkey.pem
Enter pass phrase for server\servkey.pem:
Loading 'screen' into random state - done
You are about to be asked to enter information that will be incorporated