Importing Or Exporting Certificates And Private Keys - Cisco 11503 - CSS Content Services Switch Configuration Manual

Importing or Exporting Certificates and Private Keys

Importing or Exporting Certificates and Private Keys
Cisco Content Services Switch SSL Configuration Guide
3-12
Then you must chain both certificates together in a single file, creating a chained
certificate. As one file, the CSS returns the entire certificate chain to the client
upon the initial SSL handshake.
Copy the server global and intermediate certificates to an FTP server. When
creating a chained certificate for the CSS, make sure that the global and
intermediate certificate are in their proper order. In one file, paste the server
global site certificate first, followed by the intermediate certificate. You must
insert a single new line between the certificates.
Save the file and import it to the CSS, as described in the
Certificates and Private Keys"
You can import preexisting or new certificates and private keys to the CSS disk
from a file, or a series of files, that are stored on a remote secure server. For
information on generating certificates, see the
Private Keys in the CSS"
To transfer these files, Cisco Systems recommends that you use a secure
encrypted transport mechanism between the CSS and the remote server. The CSS
supports the Secure Shell protocol (SSHv2), which provides secure encryption
communications between two hosts over an insecure network. The CSS supports
file transport between network devices using the Secure File Transfer Protocol
(SFTP) and the File Transfer Protocol (FTP). Of the two file transport protocols,
Cisco Systems recommends SFTP as the transport mechanism of choice. It is
similar to FTP except that it uses a secure and encrypted connection.
Before you import certificates or keys to the CSS:
On the CSS, ensure that SSH access to the CSS is enabled to accept
•
connections from SSH clients and that the Secure Management license key is
installed prior to transferring certificates and keys. By default, SSH access is
enabled through the no restrict ssh global command. If SSH access is
restricted, or if the license key is not installed, SSH will not accept
connections from SSH clients and the copy ssl sftp command will fail,
resulting in generation of an error message.
Chapter 3
section.
"Generating Certificates and
section.
Configuring SSL Certificates and Keys
"Importing or Exporting
OL-5655-01