|
|
|
Use the ssl add and ssl delete commands without a slot argument to provide or remove SSL certificate and key files for the management module web server.
Use these commands with a slot argument when configuring USTAT-SSL modules to serve the user-traffic-test .gif file in response to https:// requests.
To add a certificate and private key (and any Intermediate CAs that are required), you need to bundle into a single package the files that you have obtained from a Certificate Authority (CA), including certificate, key, and any chained intermediate certificates that may be provided. See the ssl add command in the CNA Command Reference Guide for information on bundling the certificate and key files, and file-format requirements.
Each module requires its own set of certificate/key files, although they do not necessarily need to be unique. SSL certificates can now be associated with logical USTAT modules. This allows multiple, independent SSL certificates to share the single “slot” hardware while co-existing with a (possibly different) SSL certificate for the management module.
The requirement is that the host name in the calling URL must exactly match the common name (CN) in the certificate that is returned. That is, if the URL on your web page contains the domain name www.webserver.com, then the certificate that is returned by the USTAT-SSL module must contain the name www.webserver.com.
If you run a load balancer to distribute hits for a single DNS name through all of your USTAT-SSL modules, then you only need one set of certificate/key files.
CAs require a fully qualified domain name, not an IP address, as the common name (CN) in the certificate. Unless you act as your own CA, each of your USTAT-SSL VIPs must be reachable through DNS, either through your load balancing mechanism or by way of an individual DNS entry.
If you continue to encounter problems opening a trusted session, verify that you have installed all required certificates, including any Intermediate CAs that may have been issued when you obtained the certificate and key files. All files issued by your CA must be installed.
Once you have installed certificate and key files, you can use the ssl export command to send backup copies to a remote location.
NOTE: If you downgrade your CNA image to an earlier release, your certificate and key files will be lost unless you have backed them up prior to reloading the image.
|
|
|