Dell EMC SmartFabric OS10 User Guide Release 10.5.0

Self-signed certificates

Administrators may prefer to not set up a Certificate Authority and implement a certificate trust model in the network, but still want to use the privacy features provided by the Transport Layer Security (TLS) protocol. In this case, self-signed certificates can be used.

A self-signed certificate is not signed by a CA. The switch presents itself as a trusted device in its certificate. Connecting clients may prompt their users to trust the certificate — for example, when a web browser warns that a site is unsafe — or to reject the certificate, depending on the configuration. A self-signed certificate does not provide protection against man-in-the-middle attacks.

Generate a self-signed certificate

• Create a self-signed certificate in EXEC mode. Store the device.key file in a secure, persistent location, such as NVRAM.

  crypto cert generate self-signed [cert-file cert-path key-file {private | keypath}]
  [country 2-letter code] [state state] [locality city] [organization organization-name]
  [orgunit unit-name] [cname common-name] [email email-address] [validity days] 
  [length length] [altname alt-name]

  If you enter the cert-file option, you must enter all the required parameters, including the local path where the certificate and private key are stored.

  If you do specify the cert-file option, you are prompted to enter the other parameter values for the certificate interactively; for example:

  You are about to be asked to enter information that will be incorporated in your certificate request.
  What you are about to enter is what is called a Distinguished Name or a DN.
  There are quite a few fields but you can leave some blank.
  For some fields there will be a default value; if you enter '.', the field will be left blank.
  Country Name (2 letter code) [US]:
  State or Province Name (full name) [Some-State]:California
  Locality Name (eg, city) []:San Francisco
  Organization Name (eg, company) []:Starfleet Command
  Organizational Unit Name (eg, section) []:NCC-1701A
  Common Name (eg, YOUR name) [hostname]:S4148-001
  Email Address []:scotty@starfleet.com

The switch uses SHA-256 as the digest algorithm. The public key algorithm is RSA with a 2048-bit modulus.

Install self-signed certificate

• Install a self-signed certificate and key file in EXEC mode.

  crypto cert install cert-file home://cert-filename key-file {key-path | private} 
  [password passphrase] [fips]

  • cert-file cert-path specifies a source location for a downloaded certificate; for example, home://s4048-001-cert.pem or usb://s4048-001-cert.pem.
  • key-file {key-path | private} specifies the local path to retrieve the downloaded or locally generated private key. Enter private to install the key from a local hidden location and rename the key file with the certificate name.
  • password passphrase specifies the password used to decrypt the private key if it was generated using a password.
  • fips installs the certificate-key pair as FIPS-compliant. Enter fips to install a certificate-key pair that is used by a FIPS-aware application, such as RADIUS over TLS. If you do not enter fips, the certificate-key pair is stored as a non-FIPS compliant pair.
    NOTE You determine if the certificate-key pair is generated as FIPS-compliant. Do not use FIPS-compliant certificate-key pairs outside of FIPS mode.
  • If you enter fips after using the key-file private option in the crypto cert generate request command, a FIPS-compliant private key is stored in a hidden location in the internal file system that is not visible to users.

If the certificate installation is successful, the file name of the self-signed certificate and its common name are displayed. Use the file name to configure the certificate in a security profile using the crypto security-profile command.

Example: Generate and install self-signed certificate and key

OS10# crypto cert generate self-signed cert-file home://DellHost.pem key-file home://DellHost.key email admin@dell.com length 1024 altname DNS:dell.domain.com validity 365
Processing certificate ...
Successfully created certificate file /home/admin/DellHost.pem and key

OS10# crypto cert install cert-file home://DellHost.pem key-file home://DellHost.key
Processing certificate ...
Certificate and keys were successfully installed as "DellHost.pem" that may be used in a security profile. CN = DellHost.

Display self-signed certificate

OS10# show crypto cert
--------------------------------------
|    Installed non-FIPS certificates    |
--------------------------------------
DellHost.pem
--------------------------------------
|    Installed FIPS certificates    |
--------------------------------------

OS10# show crypto cert DellHost.pem
------------ Non FIPS certificate -----------------
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 245 (0xf5)
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: emailAddress = admin@dell.com
        Validity
            Not Before: Feb 11 20:10:12 2019 GMT
            Not After : Feb 11 20:10:12 2020 GMT
        Subject: emailAddress = admin@dell.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:c7:12:ca:a8:d6:d2:1c:ab:66:9a:d1:db:50:5a:
                    b5:8a:e4:53:9d:f6:b4:fc:cd:f4:b9:46:8a:03:86:
                    be:0b:50:51:c7:25:76:9f:ff:b4:f9:f8:d9:6f:5d:
                    53:52:0c:4d:05:ed:31:23:79:44:5c:d7:62:01:9d:
                    41:e8:ff:3a:b0:35:0c:22:d7:ef:df:05:9a:28:6b:
                    95:10:8e:bc:c6:62:3a:82:30:0f:4f:4e:19:17:48:
                    f1:bd:1e:0c:4f:54:03:42:f3:a7:de:22:40:3d:5e:
                    6b:b2:8e:23:17:53:ef:10:d9:ae:1d:1f:d6:e4:ae:
                    25:9f:d9:39:60:5c:49:b0:ad
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier:
                DA:39:A3:EE:5E:6B:4B:0D:32:55:BF:EF:95:60:18:90:AF:D8:07:09
            X509v3 Subject Alternative Name:
                DNS:dell.domain.com
    Signature Algorithm: sha256WithRSAEncryption
         b8:83:ae:34:bb:84:e6:b4:a3:fd:77:20:67:15:3f:02:76:ca:
         f6:74:d4:d2:36:0e:58:8c:96:13:c2:85:8a:df:ba:c0:d9:c8: