Configuring the FIPS 140 Hardware
F5 Networks, Inc., Platform Guide
2 - 11
Using the key utilities to generate keys
To obtain a valid certificate, you must have a private key. If you do not have
a key, you can use the genconf and genkey utilities on the 520/540 to
generate a key and a temporary certificate. The genkey and gencert utilities
automatically generate a request file that you can submit to a certificate
authority (CA). If you have a key, you can use the gencert utility to generate
a temporary certificate and request file.
These key utilities have specific funtions:
◆
genconf
This utility creates a key configuration file that contains specific
information about your organization. The genkey utility uses this
information to generate a certificate.
◆
genkey
After you run the genconf utility, run this utility to generate a temporary
10-year certificate for testing the SSL Accelerator on the 520/540. This
utility also creates a request file that you can submit to a certificate
authority (CA) to obtain a certificate.
◆
gencert
If you already have a key, run this utility to generate a temporary
certificate and request file for the SSL Accelerator.
WARNING
After you import or generate keys on a redundant system, make sure you
synchronize the 520/540 configurations. To synchronize the 520/540
configuration, see To synchronize the 520/540 configuration from the
command line, on page 2-6.
Generating a key configuration file and a key
If you do not have a key, you can generate a key configuration file using the
genconf utility, and use the file to generate a key with the genkey utility.
You can also use these utilities to create a new key configuration file.
To generate a key configuration file using the genconf
utility
To generate a key and certificate, first run the genconf utility from the
command line with the following command:
/usr/local/bin/genconf
The utility prompts you for information about the organization for which
you are requesting certification. This information includes:
•
The fully qualified domain name (FQDN) of the server. Note that this
FQDN must be RFC1034/1035-compliant, and cannot be more than 63
characters long (this is an x509 limitation).
Summary of Contents for 520
Page 1: ...Platform Guide 520 540 MAN 0067 00...
Page 2: ......
Page 4: ...ii...
Page 5: ...Table of Contents...
Page 6: ......
Page 8: ...Table of Contents iv...
Page 10: ......
Page 30: ......
Page 46: ......
Page 50: ...Chapter 3 3 4...
Page 51: ...Glossary...
Page 52: ......
Page 56: ...Glossary Glossary 4...
Page 57: ...Index...
Page 58: ......
Page 61: ......
