Cisco Cisco Identity Services Engine 1.3 Prospecto
© 2015 思科系统公司
第
8 页
安全访问操作指南
自签名
pxGrid 客户端证书
本节详细介绍
pxGrid 客户端上的自签名证书生成过程。生成 pxGrid 公钥/私钥对后,将根据私钥(例如
self1.key)创建 PKCS 12 文件 (self1.p12)。
此
PKCS 12 文件将导入到充当 pxGrid 脚本的信任库文件名和信任库密码的目标或身份密钥库(例如 self1.jks)
中。
ISE 身份证书和公共证书也都将添加到此密钥库。
ISE 身份证书还将添加到充当信任库文件名和信任库密码的信任密钥库(例如 root1.jks)中。
第
1 步 为 pxGrid 客户端生成私钥(例如 self1.key)。
openssl genrsa -out self1.key 4096
Generating RSA private key, 4096 bit long modulus
..................++
.............................++
e is 65537 (0x10001)
第
2 步 生成自签名 CSR (self1.csr) 请求并提供质询密码。
openssl req -new -key self1.key -out self1.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:cisco123
An optional company name []:LAB
注:在本文档各处使用相同的密码可便于维护,并减少错误
第
3 步 生成自签名证书/公钥对证书(例如 self1.cer)。
openssl req -x509 -days 365 -key self1.key -in self1.csr -out self1.cer