Configuring Secure Http Servers And Clients; Default Ssl Configuration; Ssl Configuration Guidelines; Configuring A Ca Trustpoint - Cisco IE-3000-8TC Software Configuration Manual
Software configuration guide
Hide thumbs
Also See for IE-3000-8TC:
- Command reference manual (802 pages) ,
- Administration manual (496 pages) ,
- Message manual (98 pages)
Table of Contents
Advertisement
Configuring the Switch for Secure Socket Layer HTTP
Configuring Secure HTTP Servers and Clients
These sections contain this configuration information:
•
•
•
•
•
Default SSL Configuration
The standard HTTP server is enabled.
SSL is enabled.
No CA trustpoints are configured.
No self-signed certificates are generated.
SSL Configuration Guidelines
When SSL is used in a switch cluster, the SSL session terminates at the cluster commander. Cluster
member switches must run standard HTTP.
Before you configure a CA trustpoint, you should ensure that the system clock is set. If the clock is not
set, the certificate is rejected due to an incorrect date.
Configuring a CA Trustpoint
For secure HTTP connections, we recommend that you configure an official CA trustpoint.
A CA trustpoint is more secure than a self-signed certificate.
Beginning in privileged EXEC mode, follow these steps to configure a CA trustpoint:
Command
Step 1
configure terminal
Step 2
hostname hostname
Step 3
ip domain-name domain-name
Step 4
crypto key generate rsa
Step 5
crypto ca trustpoint name
Step 6
enrollment url url
Cisco IE 3000 Switch Software Configuration Guide
11-40
Default SSL Configuration, page 11-40
SSL Configuration Guidelines, page 11-40
Configuring a CA Trustpoint, page 11-40
Configuring the Secure HTTP Server, page 11-41
Configuring the Secure HTTP Client, page 11-43
Purpose
Enter global configuration mode.
Specify the hostname of the switch (required only if you have not
previously configured a hostname). The hostname is required for security
keys and certificates.
Specify the IP domain name of the switch (required only if you have not
previously configured an IP domain name). The domain name is required
for security keys and certificates.
(Optional) Generate an RSA key pair. RSA key pairs are required before
you can obtain a certificate for the switch. RSA key pairs are generated
automatically. You can use this command to regenerate the keys, if
needed.
Specify a local configuration name for the CA trustpoint and enter CA
trustpoint configuration mode.
Specify the URL to which the switch should send certificate requests.
Chapter 11
Configuring Switch-Based Authentication
OL-13018-03
Hide quick links:
Advertisement
Table of Contents
Troubleshooting
