Cisco Cisco Identity Services Engine 1.3 Folheto
© 2015 思科系统公司
第
6 页
安全访问操作指南
创建
CA 签名的 SMC 证书
此处生成的是
SMC 私钥,即由 CA 机构签名的证书签名请求 (CSR)。用于 pxGrid 的 CA 模板必须同时包含对
pxGrid 操作有效的客户端身份验证和服务器身份验证的 EKU。
步骤
1. 在 SMC 上创建私钥。
openssl genrsa -out smc.key 4096
Generating RSA private key, 4096 bit long modulus
.............................................................................................................
..............................................................................++
..........++
e is 65537 (0x10001)
步骤
2. 创建要由 CA 服务器签名的 SMC CSR 请求。
openssl req -new -key smc.key -out smc.csr
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:
State or Province Name (full name) [Some-State]:
Locality Name (eg, city) []:
Organization Name (eg, company) [Internet Widgits Pty Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (e.g. server FQDN or YOUR name) []:
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
步骤
3. 获取对 SMC 的根访问权限,使用 SCP 将 SMC.CSR 和 SMC.key 文件复制到安全的 PC。此 PC 用于
将
SMC.CSR 复制/粘贴到 pxGrid 自定义模板的高级用户请求中。
步骤
4. 下载 base-64 编码格式的证书。