Cisco Cisco Identity Services Engine 1.2 产品宣传页

第

6 页

安全访问操作指南

创建

CA 签名的 SMC 证书

此处生成的是

SMC 私钥，即由 CA 机构签名的证书签名请求 (CSR)。用于 pxGrid 的 CA 模板必须同时包含对

pxGrid 操作有效的客户端身份验证和服务器身份验证的 EKU。

步骤

1. 在 SMC 上创建私钥。

openssl genrsa -out smc.key 4096

Generating RSA private key, 4096 bit long modulus

.............................................................................................................

..............................................................................++

..........++

e is 65537 (0x10001)

步骤

2. 创建要由 CA 服务器签名的 SMC CSR 请求。

openssl req -new -key smc.key -out smc.csr

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [AU]:

State or Province Name (full name) [Some-State]:

Locality Name (eg, city) []:

Organization Name (eg, company) [Internet Widgits Pty Ltd]:

Organizational Unit Name (eg, section) []:

Common Name (e.g. server FQDN or YOUR name) []:

Email Address []:

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

步骤

3. 获取对 SMC 的根访问权限，使用 SCP 将 SMC.CSR 和 SMC.key 文件复制到安全的 PC。此 PC 用于

将

SMC.CSR 复制/粘贴到 pxGrid 自定义模板的高级用户请求中。

步骤

4. 下载 base-64 编码格式的证书。