Creating a Certificate Signing Request

After you select a certificate type (Server Certificate or Service Certificate), you can create a certificate signing request (CSR Certificate Signing Request. In PKI systems, a CSR is a message sent from an applicant to a CA to apply for a digital identity certificate.). When you generate certificate signing request, the private key The part of a public-private key pair that is always kept private. The private key encrypts the signature of a message to authenticate the sender. The private key also decrypts a message that was encrypted with the public key of the sender. is automatically stored on the current Policy Manager server. Thus, you can then upload (import) the certificate alone, without having to include the Private Key in the import process.

 

A certificate signing request created in ClearPass is valid for only 15 days. After 15 days, the CSR Certificate Signing Request. In PKI systems, a CSR is a message sent from an applicant to a CA to apply for a digital identity certificate. expires and the certificates that were created by it cannot be installed. Also note that the stored private key The part of a public-private key pair that is always kept private. The private key encrypts the signature of a message to authenticate the sender. The private key also decrypts a message that was encrypted with the public key of the sender. is removed 15 days after the certificate signing request was created. If you don't import the certificate within 15 days, you must create the CSR Certificate Signing Request. In PKI systems, a CSR is a message sent from an applicant to a CA to apply for a digital identity certificate. and certificate again.

To create a certificate signing request:

1. Navigate to Administration > Certificates > Certificate Store. The Server Certificates tab is displayed.

2. Click the Create Certificate Signing Request link. The Create Certificate Signing Request dialog opens:

Figure 1  Create Certificate Signing Request Dialog

 

3. Specify the Create Certificate Signing Request parameters as described in Table 1, then click Submit.

Table 1: Create Certificate Signing Request Parameters

Parameter

Action/Description

Common Name (CN Common Name. CN is the primary name used to identify a certificate. )

Enter the name associated with this entity. This can be a hostname defined as a Fully Qualified Domain Name (FQDN Fully Qualified Domain Name. FQDN is a complete domain name that identifies a computer or host on the Internet.), or an IP address. Best practices is to ensure the CN Common Name. CN is the primary name used to identify a certificate. is an FQDN Fully Qualified Domain Name. FQDN is a complete domain name that identifies a computer or host on the Internet. when applicable.

The default value for this field is the server hostname. If the hostname is not defined as a FQDN Fully Qualified Domain Name. FQDN is a complete domain name that identifies a computer or host on the Internet., then this field must be manually updated to include an FQDN Fully Qualified Domain Name. FQDN is a complete domain name that identifies a computer or host on the Internet. or IP address. When using IPv6 address, it should be represented in the shortest possible format as defined in RFC Request For Comments. RFC is a commonly used format for the Internet standards documentss. 5952.

Organization (O)

Optionally, enter the name of the organization.

Organizational Unit (OU)

Optionally, enter the name of the department, division, section, or other meaningful name.

Location (L)

State (ST)

Country (C)

Optionally, enter the name of the location, state, country.

Subject Alternate Name (SAN)

Optionally, enter the alternative names for the specified Common Name in one of the following formats:

email: email_address

URI Uniform Resource Identifier. URI identifies the name and the location of a resource in a uniform format.: uri

IP: ip_address

dns: dns_name

rid: id

NOTE: NOTE: When configuring a Database Server Certificate, either the Common Name or the Subject Alternate Name (SAN) DNS Domain Name System. A DNS server functions as a phone book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element. name must be set to the IP address (also, both fields can be set to the IP address if desired). When using IPv6 address, it should be represented in the shortest possible format as defined in RFC Request For Comments. RFC is a commonly used format for the Internet standards documentss. 5952.

Private Key Password

Verify Private Key Password

Enter the private key The part of a public-private key pair that is always kept private. The private key encrypts the signature of a message to authenticate the sender. The private key also decrypts a message that was encrypted with the public key of the sender. password, then verify it.

Private Key Type

Select the length for the generated private key types from the following options:

2048-bit RSA Rivest, Shamir, Adleman. RSA is a cryptosystem for public-key encryption, and is widely used for securing sensitive data, particularly when being sent over an insecure network such as the Internet. (rsa|2048)

3072-bit RSA Rivest, Shamir, Adleman. RSA is a cryptosystem for public-key encryption, and is widely used for securing sensitive data, particularly when being sent over an insecure network such as the Internet. (rsa|3072)

4096-bit RSA Rivest, Shamir, Adleman. RSA is a cryptosystem for public-key encryption, and is widely used for securing sensitive data, particularly when being sent over an insecure network such as the Internet. (rsa|4096)

NIST/SECG curve over a 256 bit prime field (ec|scep256r1)

NIST/SECG curve over a 384 bit prime field (ec|scep384r1)

NIST/SECG curve over a 521 bit prime field (ec|scep521r1)

Digest Algorithm

Select the message digest algorithm from the following options:

MD5 Message Digest 5. The MD5 algorithm is a widely used hash function producing a 128-bit hash value from the data input.

SHA Secure Hash Algorithm. SHA is a family of cryptographic hash functions. The SHA algorithm includes the SHA, SHA-1, SHA-2 and SHA-3 variants. -1

SHA Secure Hash Algorithm. SHA is a family of cryptographic hash functions. The SHA algorithm includes the SHA, SHA-1, SHA-2 and SHA-3 variants. -224

SHA Secure Hash Algorithm. SHA is a family of cryptographic hash functions. The SHA algorithm includes the SHA, SHA-1, SHA-2 and SHA-3 variants. -256

SHA Secure Hash Algorithm. SHA is a family of cryptographic hash functions. The SHA algorithm includes the SHA, SHA-1, SHA-2 and SHA-3 variants. -384

SHA Secure Hash Algorithm. SHA is a family of cryptographic hash functions. The SHA algorithm includes the SHA, SHA-1, SHA-2 and SHA-3 variants. -512

4. Click Submit.

The generated certificate signing request is displayed.

Figure 2  Certificate Signing Request Generated

Note that the Private Key is automatically stored on the current Policy Manager server. You can then upload (import) the certificate without having to include the Private Key as part of the import process (for related information, see Importing a Server Certificate).

5. Copy the certificate signing request content and paste it into the Web form as part of the enrollment process.

6. To save and download the Certificate Signing Request file, click Download CSR Certificate Signing Request. In PKI systems, a CSR is a message sent from an applicant to a CA to apply for a digital identity certificate..