Netscape Certificate Management System 6.1, Руководство администратора

Страница: 422 / 840

CEP Enrollment
422 Netscape Certificate Management System Administrator’s Guide • February 2003
2.
In your router documentation, locate the information specific to requesting
certificates for routers. Check the signing algorithm, such as RSA or DSA, and
key lengths, such as 512 and 1024, supported by the router. Based on that
information, determine the signing algorithm and the key length for the
certificate you want to request.
3.
Find out the password that enables you to access the router in privileged mode.
4.
In your router documentation, locate instructions for requesting certificates.
You will be required to run the appropriate commands using this
documentation.
5.
Generate the Key Pair for the Router
Run the appropriate commands for your router, and generate the key pair. You
will be required to provide the signing algorithm, such as RSA or DSA, and the
key length, such as 512 or 1024. The longer the key length, the more time the
router takes to generate the key pair.
6.
Request the CA’s Certificate
In this part of the operation, you identify the CA to the router, thus enabling
the router to authenticate the CA from which it will request the certificate. You
also verify whether the router is talking to the right CA; you do this manually.
Here’s what you should do:
a.
Run the appropriate command to get the CA certificate.
The command will ask you to specify the following:
—An identity for the CA. You can give any identity; choose something you
will remember, since you will be required to provide it when you submit
the certificate request.
—The CA’s enrollment URL; this is the enrollment URL you identified in
Step 1.
b.
The router gets the CA certificate and displays its fingerprint on your
screen.
c.
Verify the fingerprint on your screen with the one you noted down in
Step 1.
If it matches, the router is talking to the right CA.
7.
Submit the Certificate Request to the CA
To submit the certificate request to the CA: