Kvik SH060, Руководство по сборке, Страница: 24 / 82

Step 3 If you are not configuring secure login to the web UI, skip to Step 4 . If you are configuring secure login, you must create
a keystore file by using the Java
keytool
utility, which is located in the bin subdirectory of the Java installation (see
Step
2
). Use the utility to define a self-signed certificate, or to request and later import a certificate from an external signing
authority:
a) To create a keystore file containing a self-signed certificate, run this command and respond to the prompts:
> keytool -genkey -alias tomcat -keyalg RSA -keystore k-file
Enter keystore password: password
What is your first and last name? [Unknown]: name
What is the name of your organizational unit? [Unknown]: org-unit
What is the name of your organization? [Unknown]: org-name
What is the name of your City or Locality? [Unknown]: local
What is the name of your State or Province? [Unknown]: state
What is the two-letter country code for this unit? [Unknown]: cc
Is CN=name, OU=org-unit, O=org-name, L=local, ST=state, C=cc correct? [no]: yes
Enter key password for <tomcat> (RETURN if same as keystore password):
The keystore filename (k-file) is its fully qualified path. You will be entering the keystore path and password in
Step
16
.
You must use 128-bit SSL to disable weak ciphers in the web UI. For more information, see Enhancing
Security for Web UI, on page 63 .
Note
b) To create a Certificate Signing Request (CSR) that you will submit to the Certificate Authority (CA) when you request
a certificate, create the keystore file as in the previous substep, then execute this command:
> keytool -certreq -keyalg RSA -alias tomcat -file certreq.cer -keystore k-file
Submit the resulting certreq.cer file to the CA. Once you receive the certificate from the CA, first download the Chain
Certificate from the CA, then import the Chain Certificate and your new Certificate into the keystore file, as follows:
> keytool -import -alias root -keystore k-file -trustcacerts -file chain-cert-file
> keytool -import -alias tomcat -keystore k-file -trustcacerts -file new-cert-file
For details on the keytool utility, see the documentation at the Java website of Oracle. For details on the keystore
file and Tomcat, see the documentation at the website of the Apache Software Foundation.
The Cisco Prime Network Registrar installation program for Windows does not try to modify ACLs to restrict
access to the installed files and directories. If you want to restrict access to these files and directories, use the
native Microsoft utilities to manually change file and directory permissions. See
Modifying ACLs in Windows
Installations, on page 16 .
Caution
Step 4 Load the installation CD, or browse to the network resource where the Cisco Prime Network Registrar software is located.
If you download a distribution file from the Cisco website, run it from a different directory than where you will install
Cisco Prime Network Registrar.
Cisco Prime Network Registrar 9.1 Installation Guide
18
Installing and Upgrading Cisco Prime Network Registrar
Installing Cisco Prime Network Registrar