ssl add

Installs Secure Sockets Layer certificate and private key files on an CNA module.

ssl add <url> [ encrypted ] [ <slot> | ustat <name> ]
 

• url--FTP or HTTP location of the files to be added (see copy command for URL syntax)
• slot--chassis slot of the USTAT module for which the certificate and key are valid
• name--name of the USTAT module for which the certificate and key are valid

Must have privileged-level access.

Each web server needs its own SSL certificate and private key files, as well as any required intermediate files. If your Certificate Authority (such as VeriSign or Thawte, for example) provided you with one or more Intermediate CAs when you obtained your certificate and key, then you must install all of them on CNA.

Use the encrypted keyword if the key is encrypted. CNA will prompt you for the pass phrase required to decrypt the key.

If you are adding certificate files for SSL-enabled USTAT modules, you can use either the slot parameter to specify module number, or the keyword ustat followed by the name of the ustat. Each USTAT-SSL requires the installation of its own certificate and key. See SSL Certificate/Key Files in Chapter 3: Security of the CNA Basic Monitoring Guide.

If you are enabling SSL for the CNA web interface, do not specify a module number.

The certificate file should be named server.crt and any intermediate files should be named chainca.crt.

To add files one at a time, specify the filename as the url argument. This file must be in must be in Base64-encoded format.

Use this method if you have already added a .key file using the ssl generate-csr command.

If you have not yet installed the .key file, you must install it with the server.crt file. Package them together in .tar, .tar.gz, .tgz, or .zip format and specify that file as the url argument.

You can also include one or more chainca.crt files if desired (may be included in any order).

This will replace any existing SSL server.key and server.crt files.

NOTE: The server.key and server.crt files must be issued together by your CA. If they don’t match, they cannot work together. Additionally, the certificate file must be named server.crt.

Each of the SSL files must meet the follow requirements:

• server.crt--X.509 certificate in PEM (Base64-encoded DER) format
• server.key--the private RSA key in PEM (Base64-encoded DER) format; for general browser compatibility, the key size should be 1024 bits or less
• chainca.crt--intermediate X.509 certificate in PEM (Base64-encoded DER) format

If the common name (CN) in the server certificate is a fully qualified domain name, not an IP address, your USTAT-SSL VIPs should be reachable through DNS.

After installing the files on the module, you must enable, or re-enable, SSL with the ip http server ssl on command. (If the web server is already running, the command will restart it.)

You must restart the web server on each module, one at a time.

However, each server can be restarted with a single command, using the following shorthand notation (assuming USTAT modules named one, two and three):

CNA# config t module ustat one ip http server ssl on
 
CNA# config t module ustat two ip http server ssl on
 
CNA# config t module ustat three ip http server ssl on