ssl generate-csr

Generates a Certificate Signing Request for obtaining an SSL certificate.

ssl generate-csr [ <slot> ] [ with-certificate ] [ > <url> ]
 

• slot--slot number of the USTAT module
• url--remote destination for the request

Must have privileged-level access.

The ssl generate-csr command will create a Certificate Signing Request (in the form of a .csr file), which you can then send to a Certificate Authority (CA) in order to obtain the SSL certificate file (server.crt) required by the ssl add command.

When you submit a certificate request to your CA, you should specify that certificates be in the same format used by an Apache web server running SSLeay. Specifically, CNA does not support PKCS7 files.

The ssl generate-csr command also creates a server.key file and automatically installs it (unencrypted) into the specified module.

If you are generating a new CSR for a module that has already had SSL files installed, use the ssl delete command first. Otherwise, the new key will overwrite the existing key but the old certificate will still exist, and the module’s web server will not function correctly.

When you enter the ssl generate-csr command on the command line, CNA will prompt you for the following information, which will be used by your CA to create the certificate (field names are defined in the X.509 standard):

• Common Name (CN)--domain name of the CNA module for which certificate files are sought; must be an exact match to the hostname portion of the URL used to reach the module (if a USTAT, use the domain name in the single-pixel.gif image tag, such as www.one-pixel-gif.yourdomain.com; if the management module, use the domain name you use to reach the web interface, such as CNA.yourcompany.com)
• Organizational Unit (OU)--your unit in your organization, such as department or business unit
• Organization (O)--your company
• City/Locality (L)--city in which CN is located
• State/Province (ST)--state or province in which L is located
• Country (C)--country in which ST is located
• Contact e-mail address--e-mail address associated with the web-server

Some of the fields may be optional; some may require a specific syntax. Abbreviations in names may be prohibited in some places and required in others (you may be required to enter Saint Louis instead of St. Louis, but US for United States and GB for Great Britain, for example). You should check with your CA before generating this .csr file.

Use the with-certificate keyword to also generate a self-signed crt file on CNA. See ip http server ssl on for more information on enabling SSL.

When you execute the ssl generate-csr command, the Certificate Signing Request file will be sent to the screen, or, if you use the redirection character >, the location specified by the command-line argument url. See the copy command for valid URL formats.