HP ProCurve NAC 800, Руководство пользователя

Страница: 455 / 591

System Administration
Creating and Replacing SSL Certificates
15-27
Creating and Replacing SSL Certificates
The Secure Sockets Layer (SSL) protocol uses encryption by way of certifi-
cates to provide security for data or information sent over HTTP.
Certificates are digitally signed statements that verify the authenticity of a
server for security purposes. They use two keys; one public key to encrypt
information and one private key to decipher that information.
keytool
is a key and certificate management utility that allows you to create
your own public and private keys when you use self-authentication. These
keys and certificates are stored in a keystore file.
NOTE:
All of the steps in these sections (“Creating a New Self-signed Certificate,”
and “Using an SSL Certificate from a known Certificate Authority (CA)” in the
users guide) should be performed on the MS and each ES.
In order to avoid SSL certificate warnings in the browser when connecting to
the NAC 800 server (either as a NAC 800 user interface user, or from a
redirected endpoint) you will need to install SSL certificates that have been
signed by a Certificate Authority (CA) recognized by the browser, such as
Thawte, Verisign, or your organization's own local SSL CA. To install certifi-
cates, follow the steps below for the MS and each ES. (Once is sufficient for
single-server installations.) Start by removing your existing keystore and
generating a new self-signed certificate as described in “Creating a New Self-
signed Certificate” on page 15-27, using
compliance
as the alias wherever a
key alias is needed. Once you've generated a self-signed certificate with the
fully-qualified Domain Name of your server, continue with the instructions for
“Using an SSL Certificate from a known Certificate Authority (CA)” on page
15-29.
Creating a New Self-signed Certificate
To generate a private keystore containing a new private key/public certificate
pair :
Command line window
1. Log in as
root
to the NAC 800 server via SSH.