ProCurve 800, Руководство по настройке

Страница: 309 / 406

5-45
Configuring the RADIUS Server—Without Identity Driven Manager
Manage Digital Certificates for RADIUS
Install a Server Certificate for RADIUS
You have a variety of options for obtaining and installing the server certificate
for RADIUS authentication. You can:
■
Create a self-signed certificate on the NAC 800.
■
Obtain and install a CA-signed certificate in one of these ways:
• Create a private/public keypair and certificate request on the NAC 800
and submit the request to your CA.
• On the CA, request a certificate on behalf of the NAC 800. Make sure to
save the associated private key so that you can load it to the NAC 800.
Create a Self-Signed Certificate
Follow these steps to create a self-signed certificate to be used for RADIUS
authentication:
1. Log into the NAC 800 as root.
2. Configure the openssl application to issue self-signed certificates with the
correct extensions for a RADIUS server. (See Appendix B, “Appendix B:
Linux Commands” for vi commands.)
a. Copy the default configuration file for openssl to a new location. You
will make changes to the new file.
ProCurve NAC 800:# cp /var/ssl/openssl.cnf /etc/
raddb/certs/openssl.cnf
b. Enter this command:
ProCurve NAC 800:# cd /etc/raddb/certs
c. Alter the new configuration file:
ProCurve NAC 800:/etc/raddb/certs# vi openssl.cnf
d. Press
[i]
to enter Insert mode.
e. Find the “[new_oids]” section. Add this text above:
[radsrv]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, serverAuth
f. Press [Esc] to exit Insert mode.
g. Save the changes and exit vi.
:wq