Legal Disclaimer: The resource assets in this website may include abbreviated and/or legacy terminology for HPE Aruba Networking products. See www.arubanetworks.com for current and complete HPE Aruba Networking product lines and names.
Creating a Certificate Signing Request
After you select a certificate type (Server Certificate or Service Certificate), you can create a certificate signing request (CSR Certificate Signing Request. In PKI systems, a CSR is a message sent from an applicant to a CA to apply for a digital identity certificate.). When you generate certificate signing request, the private key The part of a public-private key pair that is always kept private. The private key encrypts the signature of a message to authenticate the sender. The private key also decrypts a message that was encrypted with the public key of the sender. is automatically stored on the current Policy Manager server. Thus, you can then upload (import) the certificate alone, without having to include the Private Key in the import process.
|
A certificate signing request created in ClearPass is valid for only 15 days. After 15 days, the CSR Certificate Signing Request. In PKI systems, a CSR is a message sent from an applicant to a CA to apply for a digital identity certificate. expires and the certificates that were created by it cannot be installed. Also note that the stored private key The part of a public-private key pair that is always kept private. The private key encrypts the signature of a message to authenticate the sender. The private key also decrypts a message that was encrypted with the public key of the sender. is removed 15 days after the certificate signing request was created. If you don't import the certificate within 15 days, you must create the CSR Certificate Signing Request. In PKI systems, a CSR is a message sent from an applicant to a CA to apply for a digital identity certificate. and certificate again. |
To create a certificate signing request:
1. Navigate to Administration > Certificates > Certificate Store. The tab is displayed.
2. Click the Create Certificate Signing Request link. The dialog opens:
Figure 1 Create Certificate Signing Request Dialog
3. Specify the parameters as described in Table 1, then click .
Parameter |
Action/Description |
Common Name (CN Common Name. CN is the primary name used to identify a certificate. ) |
Enter the name associated with this entity. This can be a hostname defined as a Fully Qualified Domain Name (FQDN Fully Qualified Domain Name. FQDN is a complete domain name that identifies a computer or host on the Internet.), or an IP address. Best practices is to ensure the CN Common Name. CN is the primary name used to identify a certificate. is an FQDN Fully Qualified Domain Name. FQDN is a complete domain name that identifies a computer or host on the Internet. when applicable. The default value for this field is the server hostname. If the hostname is not defined as a FQDN Fully Qualified Domain Name. FQDN is a complete domain name that identifies a computer or host on the Internet., then this field must be manually updated to include an FQDN Fully Qualified Domain Name. FQDN is a complete domain name that identifies a computer or host on the Internet. or IP address. When using IPv6 address, it should be represented in the shortest possible format as defined in RFC Request For Comments. RFC is a commonly used format for the Internet standards documentss. 5952. |
Organization (O) |
Optionally, enter the name of the organization. |
Organizational Unit (OU) |
Optionally, enter the name of the department, division, section, or other meaningful name. |
Location (L) State (ST) Country (C) |
Optionally, enter the name of the location, state, country. |
Subject Alternate Name (SAN) |
Optionally, enter the alternative names for the specified Common Name in one of the following formats: email: email_address IP: ip_address dns: dns_name rid: id NOTE: When configuring a Database Server Certificate, either the Common Name or the Subject Alternate Name (SAN) DNS Domain Name System. A DNS server functions as a phone book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element. name must be set to the IP address (also, both fields can be set to the IP address if desired). When using IPv6 address, it should be represented in the shortest possible format as defined in RFC Request For Comments. RFC is a commonly used format for the Internet standards documentss. 5952. |
Private Key Password Verify Private Key Password |
Enter the private key The part of a public-private key pair that is always kept private. The private key encrypts the signature of a message to authenticate the sender. The private key also decrypts a message that was encrypted with the public key of the sender. password, then verify it. |
Private Key Type |
Select the length for the generated private key types from the following options: NIST/SECG curve over a 256 bit prime field (ec|scep256r1) NIST/SECG curve over a 384 bit prime field (ec|scep384r1) NIST/SECG curve over a 521 bit prime field (ec|scep521r1) |
Digest Algorithm |
Select the message digest algorithm from the following options: |
4. Click .
The generated certificate signing request is displayed.
Figure 2 Certificate Signing Request Generated
Note that the Private Key is automatically stored on the current Policy Manager server. You can then upload (import) the certificate without having to include the Private Key as part of the import process (for related information, see Importing a Server Certificate).
5. Copy the certificate signing request content and paste it into the Web form as part of the enrollment process.
6. To save and download the Certificate Signing Request file, click Download CSR Certificate Signing Request. In PKI systems, a CSR is a message sent from an applicant to a CA to apply for a digital identity certificate..