Cisco MDS SanOS Troubleshooting Guide -- Troubleshooting Digital Certificates - Revision history

Pravraj: /* Importing Certificate and RSA Key Pairs from Backup Using the CLI */

2010-09-09T10:26:08Z

Importing Certificate and RSA Key Pairs from Backup Using the CLI

← Older revision		Revision as of 10:26, 9 September 2010
Line 686:		Line 686:
	1. Use the<span style="font-style: normal">'''<font color="Black"> show crypto ca trustpoints</font>'''</span> command to verify that the trust point is empty.		1. Use the<span style="font-style: normal">'''<font color="Black"> show crypto ca trustpoints</font>'''</span> command to verify that the trust point is empty.

-	2. ~~Optionally, use~~ the <span style="font-style: normal">'''<font color="Black">delete ca-certificate</font>'''</span> command in trust point config submode to remove the CA certificate from the trust point.	+	2. (Optional) Use the <span style="font-style: normal">'''<font color="Black">delete ca-certificate</font>'''</span> command in trust point config submode to remove the CA certificate from the trust point.

	<pre>		<pre>
Line 696:		Line 696:


-	3. ~~Optionally, use~~ the <span style="font-style: normal">'''<font color="Black">delete certificate force </font>'''</span>command in trust point config submode to remove the certificates from the trust point.	+	3. (Optional) Use the <span style="font-style: normal">'''<font color="Black">delete certificate force </font>'''</span>command in trust point config submode to remove the certificates from the trust point.

	<pre>		<pre>
Line 707:		Line 707:
	</pre>		</pre>

-	4. ~~Optionally, use~~ the <span style="font-style: normal">'''<font color="Black">no rsakeypair</font>'''</span> command in the trust point config submode to remove the RSA key pairs from the trust point.	+	4. (Optional) Use the <span style="font-style: normal">'''<font color="Black">no rsakeypair</font>'''</span> command in the trust point config submode to remove the RSA key pairs from the trust point.

	<pre>		<pre>

Pravraj: /* Importing Certificate and RSA Key Pairs from Backup Using Fabric Manager */

2010-09-09T10:24:57Z

Importing Certificate and RSA Key Pairs from Backup Using Fabric Manager

← Older revision		Revision as of 10:24, 9 September 2010
Line 648:		Line 648:
	1. Choose <span style="font-style: normal">'''<font color="Black">Switches > Security > PKI</font>'''</span> and select the <span style="font-style: normal">'''<font color="Black">TrustPointDetails</font>'''</span> tab to verify that the trust point is empty.		1. Choose <span style="font-style: normal">'''<font color="Black">Switches > Security > PKI</font>'''</span> and select the <span style="font-style: normal">'''<font color="Black">TrustPointDetails</font>'''</span> tab to verify that the trust point is empty.

-	2. ~~Optionally, follow these steps to empty~~ the trust point:	+	2. (Optional)Empty the trust point by following these steps:

-	: a. Choose <span style="font-style: normal">'''<font color="Black">Switches > Security > PKI </font>'''</span>and ~~select~~ the <span style="font-style: normal">'''<font color="Black">TrustPoint </font>'''</span>tab.	+	: a. Choose <span style="font-style: normal">'''<font color="Black">Switches > Security > PKI </font>'''</span>and click the <span style="font-style: normal">'''<font color="Black">TrustPoint </font>'''</span>tab.

	: b. Delete the RSA key pair from the Key Pair Name field and click <span style="font-style: normal">'''<font color="Black">Apply Changes</font>'''</span>.		: b. Delete the RSA key pair from the Key Pair Name field and click <span style="font-style: normal">'''<font color="Black">Apply Changes</font>'''</span>.

-	: c. Choose <span style="font-style: normal">'''<font color="Black">Switches > Security > PKI </font>'''</span>and ~~select~~ the <span style="font-style: normal">'''<font color="Black">TrustPoint Actions</font>'''</span> tab.	+	: c. Choose <span style="font-style: normal">'''<font color="Black">Switches > Security > PKI </font>'''</span>and click the <span style="font-style: normal">'''<font color="Black">TrustPoint Actions</font>'''</span> tab.

	: d. Select <span style="font-style: normal">'''<font color="Black">cadelete</font>'''</span> from the Command drop-down menu and click <span style="font-style: normal">'''<font color="Black">Apply Changes </font>'''</span>to delete the CA certificate.		: d. Select <span style="font-style: normal">'''<font color="Black">cadelete</font>'''</span> from the Command drop-down menu and click <span style="font-style: normal">'''<font color="Black">Apply Changes </font>'''</span>to delete the CA certificate.
Line 662:		Line 662:
	3. In Device Manager, choose <span style="font-style: normal">'''<font color="Black">Admin > Flash Files</font>'''</span> and select <span style="font-style: normal">'''<font color="Black">Copy</font>'''</span> to copy the PKCS#12 format file to the switch bootflash.		3. In Device Manager, choose <span style="font-style: normal">'''<font color="Black">Admin > Flash Files</font>'''</span> and select <span style="font-style: normal">'''<font color="Black">Copy</font>'''</span> to copy the PKCS#12 format file to the switch bootflash.

-	4. In Fabric Manager, choose <span style="font-style: normal">'''<font color="Black">Switches > Security > PKI </font>'''</span>and ~~select~~ the <span style="font-style: normal">'''<font color="Black">TrustPoint Actions</font>'''</span> tab.	+	4. In Fabric Manager, choose <span style="font-style: normal">'''<font color="Black">Switches > Security > PKI </font>'''</span>and click the <span style="font-style: normal">'''<font color="Black">TrustPoint Actions</font>'''</span> tab.

	5. Select the '''pkcs12import''' option from the Command drop-down menu to import the key pair, identity certificate, and the CA certificate or certificate chain in PKCS#12 format to the selected trust point.		5. Select the '''pkcs12import''' option from the Command drop-down menu to import the key pair, identity certificate, and the CA certificate or certificate chain in PKCS#12 format to the selected trust point.

Pravraj: /* Cannot Import Certificate and RSA Key Pairs from Backup */

2010-09-09T10:22:59Z

Cannot Import Certificate and RSA Key Pairs from Backup

← Older revision		Revision as of 10:22, 9 September 2010
Line 609:		Line 609:

	{\| id="wp40550table40548" width="80%" border="1" cellpadding="3"		{\| id="wp40550table40548" width="80%" border="1" cellpadding="3"
-	\|+ Table 24-6 Cannot Import Certificate and RSA Key Pairs from Backup	+	\|+ '''Table 24-6 Cannot Import Certificate and RSA Key Pairs from Backup'''
	\|- align="left" valign="bottom"		\|- align="left" valign="bottom"
	! scope="col" \|		! scope="col" \|
Line 633:		Line 633:
	Choose<span style="font-style: normal">'''<font color="Black"> Switches > Security > PKI </font>'''</span>in Fabric Manager. Right-click the RSA key pair that you want to delete and click <span style="font-style: normal">'''<font color="Black">Delete Row</font>'''</span>.		Choose<span style="font-style: normal">'''<font color="Black"> Switches > Security > PKI </font>'''</span>in Fabric Manager. Right-click the RSA key pair that you want to delete and click <span style="font-style: normal">'''<font color="Black">Delete Row</font>'''</span>.

-	Or use the no <span style="font-style: normal">'''<font color="Black">crypto key zeroize rsa</font>'''</span> CLI command	+	You can also use the no <span style="font-style: normal">'''<font color="Black">crypto key zeroize rsa</font>'''</span> CLI command.
	\|}		\|}

Pravraj: /* PKI Fails After Reboot */

2010-09-09T10:22:16Z

PKI Fails After Reboot

← Older revision		Revision as of 10:22, 9 September 2010
Line 581:		Line 581:

	{\| id="wp39723table39721" width="80%" border="1" cellpadding="3"		{\| id="wp39723table39721" width="80%" border="1" cellpadding="3"
-	\|+ Table 24-5 PKI Fails After Reboot	+	\|+ '''Table 24-5 PKI Fails After Reboot'''
	\|- align="left" valign="bottom"		\|- align="left" valign="bottom"
	! scope="col" \|		! scope="col" \|
Line 595:		Line 595:
	Certificates not saved to NVRAM.		Certificates not saved to NVRAM.
	\|		\|
-	Save the running-config to startup- config to save the trust point to startup. Then reimport the certificates. See the "Configuring Certificates on the MDS Switch Using Fabric Manager" section or the "Configuring Certificates on the MDS Switch Using the CLI" section.	+	Save the running-config to startup-config to save the trust point to startup. Then reimport the certificates. See the "Configuring Certificates on the MDS Switch Using Fabric Manager" section or the "Configuring Certificates on the MDS Switch Using the CLI" section.
	\|}		\|}

Pravraj: /* Configuring Certificates on the MDS Switch Using the CLI */

2010-09-09T10:21:42Z

Configuring Certificates on the MDS Switch Using the CLI

← Older revision		Revision as of 10:21, 9 September 2010
Line 439:		Line 439:
	</pre>		</pre>

-	6. Use the copy running-config startup-config command to save the trust point and key pair.	+	6. Use the '''copy running-config startup-config''' command to save the trust point and key pair.

-	7.Download the CA certificate from the CA that you want to add as the trust point CA.	+	7. Download the CA certificate from the CA that you want to add as the trust point CA.

-	8.Authenticate the CA that you want to enroll to the trust point.	+	8. Authenticate the CA that you want to enroll to the trust point.
	<pre>		<pre>
	Vegas-1(config)# crypto ca authenticate myCA		Vegas-1(config)# crypto ca authenticate myCA
Line 486:		Line 486:


-	~~Step~~ 9 Generate a certificate request for enrolling with that trust point.	+	9. Generate a certificate request for enrolling with that trust point.

	<pre>		<pre>
Line 515:		Line 515:
	</pre>		</pre>

-	10.Request an identity certificate from the CA.	+	10. Request an identity certificate from the CA.

	----		----
-	{{Note \|he CA may require manual verification before issuing the identity certificate. }}	+	{{Note \|The CA may require manual verification before issuing the identity certificate. }}
	----		----

-	11.Import the identity certificate.	+	11. Import the identity certificate.
	<pre>		<pre>
	Vegas-1(config)# crypto ca import myCA certificate		Vegas-1(config)# crypto ca import myCA certificate

Pravraj: /* Configuring Certificates on the MDS Switch Using Fabric Manager */

2010-09-09T10:19:56Z

Configuring Certificates on the MDS Switch Using Fabric Manager

Pravraj: /* Certificate Fails at Peer */

2010-09-09T10:14:19Z

Certificate Fails at Peer

← Older revision		Revision as of 10:14, 9 September 2010
Line 262:		Line 262:

	{\| id="wp39197table39195" width="80%" border="1" cellpadding="3"		{\| id="wp39197table39195" width="80%" border="1" cellpadding="3"
-	\|+ Table 24-4 Certificate Fails at Peer	+	\|+ '''Table 24-4 Certificate Fails at Peer'''
	\|- align="left" valign="bottom"		\|- align="left" valign="bottom"
	! scope="col" \|		! scope="col" \|

Pravraj: /* Cannot Export Identity Certificate in PKCS#12 Format */

2010-09-09T10:13:57Z

Cannot Export Identity Certificate in PKCS#12 Format

← Older revision		Revision as of 10:13, 9 September 2010
Line 232:		Line 232:

	{\| id="wp39154table39152" width="80%" border="1" cellpadding="3"		{\| id="wp39154table39152" width="80%" border="1" cellpadding="3"
-	\|+ Table 24-3 Cannot Export Identity Certificate in PKCS#12 Format	+	\|+ '''Table 24-3 Cannot Export Identity Certificate in PKCS#12 Format'''
	\|- align="left" valign="bottom"		\|- align="left" valign="bottom"
	! scope="col" \|		! scope="col" \|

Pravraj: /* CA Will Not Generate Identity Certificate */

2010-09-09T10:13:32Z

CA Will Not Generate Identity Certificate

← Older revision		Revision as of 10:13, 9 September 2010
Line 193:		Line 193:

	{\| id="wp32642table32637" width="80%" border="1" cellpadding="3"		{\| id="wp32642table32637" width="80%" border="1" cellpadding="3"
-	\|+ Table 24-2 CA Will Not Generate Identity Certificate	+	\|+ '''Table 24-2 CA Will Not Generate Identity Certificate'''
	\|- align="left" valign="bottom"		\|- align="left" valign="bottom"
	! scope="col" \|		! scope="col" \|
Line 209:		Line 209:
	Configure the host name and the IP domain name. Choose <span style="font-style: normal">'''<font color="Black">Switches</font>'''</span> in Fabric Manager and set the LogicalName field to the host name.<span style="font-style: normal">'''<font color="Black"> </font>'''</span>Choose<span style="font-style: normal">'''<font color="Black"> Switches > Interfaces > Management > DNS </font>'''</span>and set the DefaultDomainName field.		Configure the host name and the IP domain name. Choose <span style="font-style: normal">'''<font color="Black">Switches</font>'''</span> in Fabric Manager and set the LogicalName field to the host name.<span style="font-style: normal">'''<font color="Black"> </font>'''</span>Choose<span style="font-style: normal">'''<font color="Black"> Switches > Interfaces > Management > DNS </font>'''</span>and set the DefaultDomainName field.

-	Or use the <span style="font-style: normal">'''<font color="Black">hostname</font>'''</span> and th<span style="font-style: normal">'''<font color="Black">e ip domain-name</font>'''</span> CLI commands.	+	You can also use the <span style="font-style: normal">'''<font color="Black">hostname</font>'''</span> and th<span style="font-style: normal">'''<font color="Black">e ip domain-name</font>'''</span> CLI commands.
	\|- align="left" valign="top"		\|- align="left" valign="top"
	\|		\|
Line 218:		Line 218:
	Create exportable RSA keys. Choose<span style="font-style: normal">'''<font color="Black"> Switches > Security > PKI </font>'''</span>in Fabric Manager and click the <span style="font-style: normal">'''<font color="Black">Trustpoint Action </font>'''</span>tab. Select <span style="font-style: normal">'''<font color="Black">certreq</font>'''</span> from the Command drop-down menu, fill in the URL field and enter the challenge password in the Password field. Click <span style="font-style: normal">'''<font color="Black">Apply Changes</font>'''</span>.		Create exportable RSA keys. Choose<span style="font-style: normal">'''<font color="Black"> Switches > Security > PKI </font>'''</span>in Fabric Manager and click the <span style="font-style: normal">'''<font color="Black">Trustpoint Action </font>'''</span>tab. Select <span style="font-style: normal">'''<font color="Black">certreq</font>'''</span> from the Command drop-down menu, fill in the URL field and enter the challenge password in the Password field. Click <span style="font-style: normal">'''<font color="Black">Apply Changes</font>'''</span>.

-	Or use the <span style="font-style: normal">'''<font color="Black">crypto ca enroll </font>'''</span>CLI command and enter a challenge password during enrollment.	+	You can also use the <span style="font-style: normal">'''<font color="Black">crypto ca enroll </font>'''</span>CLI command and enter a challenge password during enrollment.
	\|}		\|}

Pravraj: /* Common Troubleshooting Commands in the CLI */

2010-09-09T10:08:53Z

Common Troubleshooting Commands in the CLI

← Older revision		Revision as of 10:08, 9 September 2010
Line 171:		Line 171:
	The following commands may be useful in troubleshooting digital certificate issues:		The following commands may be useful in troubleshooting digital certificate issues:

-	* show crypto ca certificates	+	* '''show crypto ca certificates'''
-	* show crypto key	+	* '''show crypto key'''
-	* show crypto ca crl	+	* '''show crypto ca crl'''
-	* show crypto ca trustpoint	+	* '''show crypto ca trustpoint'''
-		+

	== Digital Certificate Issues ==		== Digital Certificate Issues ==

← Older revision		Revision as of 10:19, 9 September 2010
Line 303:		Line 303:
	2. Choose<span style="font-style: normal">'''<font color="Black"> Switches > Interfaces > Management > DNS </font>'''</span>and set the DefaultDomainName field to configure the DNS domain name for the switch.		2. Choose<span style="font-style: normal">'''<font color="Black"> Switches > Interfaces > Management > DNS </font>'''</span>and set the DefaultDomainName field to configure the DNS domain name for the switch.

-	3. ~~Follow these steps to create~~ an RSA key pair for the switch:	+	3. Create an RSA key pair for the switch by following these steps:

	: a. Choose <span style="font-style: normal">'''<font color="Black">Switches > Security > PKI</font>'''</span> and select the <span style="font-style: normal">'''<font color="Black">RSA</font>'''</span> <span style="font-style: normal">'''<font color="Black">Key-Pair</font>'''</span> tab.		: a. Choose <span style="font-style: normal">'''<font color="Black">Switches > Security > PKI</font>'''</span> and select the <span style="font-style: normal">'''<font color="Black">RSA</font>'''</span> <span style="font-style: normal">'''<font color="Black">Key-Pair</font>'''</span> tab.
Line 311:		Line 311:
	: c. Check the <span style="font-style: normal">'''<font color="Black">Exportable</font>'''</span> check box and click <span style="font-style: normal">'''<font color="Black">Create</font>'''</span>.		: c. Check the <span style="font-style: normal">'''<font color="Black">Exportable</font>'''</span> check box and click <span style="font-style: normal">'''<font color="Black">Create</font>'''</span>.

-	4. ~~Follow these steps to create~~ a trust point and associate the RSA key pairs with it:	+	4. Create a trust point and associate the RSA key pairs with it by following these steps:

	: a. Choose S<span style="font-style: normal">'''<font color="Black">witches > Security > PKI</font>'''</span> and select the <span style="font-style: normal">'''<font color="Black">Trust Point</font>'''</span> tab.		: a. Choose S<span style="font-style: normal">'''<font color="Black">witches > Security > PKI</font>'''</span> and select the <span style="font-style: normal">'''<font color="Black">Trust Point</font>'''</span> tab.
Line 327:		Line 327:
	6. Download the CA certificate from the CA that you want to add as the trustpoint CA.		6. Download the CA certificate from the CA that you want to add as the trustpoint CA.

-	7. ~~Follow these steps to authenticate~~ the CA that you want to enroll to the trust point:	+	7. Authenticate the CA that you want to enroll to the trust point by following these steps:

	: a. In Device Manager, choose <span style="font-style: normal">'''<font color="Black">Admin > Flash Files</font>'''</span> and select <span style="font-style: normal">'''<font color="Black">Copy</font>'''</span> and then select <span style="font-style: normal">'''<font color="Black">tftp</font>'''</span> from the Protocols radio button to copy the CA certificate to bootflash.		: a. In Device Manager, choose <span style="font-style: normal">'''<font color="Black">Admin > Flash Files</font>'''</span> and select <span style="font-style: normal">'''<font color="Black">Copy</font>'''</span> and then select <span style="font-style: normal">'''<font color="Black">tftp</font>'''</span> from the Protocols radio button to copy the CA certificate to bootflash.

-	: b. In Fabric Manager, choose <span style="font-style: normal">'''<font color="Black">Switches > Security > PKI </font>'''</span>and ~~select~~ the <span style="font-style: normal">'''<font color="Black">TrustPoint Actions</font>'''</span> tab.	+	: b. In Fabric Manager, choose <span style="font-style: normal">'''<font color="Black">Switches > Security > PKI </font>'''</span>and click the <span style="font-style: normal">'''<font color="Black">TrustPoint Actions</font>'''</span> tab.

	: c. Select <span style="font-style: normal">'''<font color="Black">cauth</font>'''</span> from the Command drop-down menu.		: c. Select <span style="font-style: normal">'''<font color="Black">cauth</font>'''</span> from the Command drop-down menu.
Line 343:		Line 343:
	: g. Make a note of the CA certificate fingerprint displayed in the IssuerCert FingerPrint column for the trust point row in question. Compare the CA certificate fingerprint with the fingerprint already communicated by the CA (obtained from the CA web site). If the fingerprints match exactly, accept the CA by selecting the '''certconfirm''' trust point action. Otherwise, reject the CA by selecting the '''certnoconfirm''' trust point action.		: g. Make a note of the CA certificate fingerprint displayed in the IssuerCert FingerPrint column for the trust point row in question. Compare the CA certificate fingerprint with the fingerprint already communicated by the CA (obtained from the CA web site). If the fingerprints match exactly, accept the CA by selecting the '''certconfirm''' trust point action. Otherwise, reject the CA by selecting the '''certnoconfirm''' trust point action.

-	: h. If you selected '''certconfirm''' in step g, ~~select~~ the<span style="font-style: normal">'''<font color="Black"> Trust Point Actions</font>'''</span> tab, select '''certconfirm''' from the Command drop-down menu and then click '''Apply Changes'''.	+	: h. If you selected '''certconfirm''' in step g, click the<span style="font-style: normal">'''<font color="Black"> Trust Point Actions</font>'''</span> tab, select '''certconfirm''' from the Command drop-down menu, and then click '''Apply Changes'''.

-	: i. If you selected '''certnoconfirm''' ~~inStep~~ g, ~~select~~ the<span style="font-style: normal">'''<font color="Black"> Trust Point Actions</font>'''</span> tab, select '''certnoconfirm''' from the Command drop-down menu, and then click '''Apply Changes'''.	+	: i. If you selected '''certnoconfirm''' in Step g, click the<span style="font-style: normal">'''<font color="Black"> Trust Point Actions</font>'''</span> tab, select '''certnoconfirm''' from the Command drop-down menu, and then click '''Apply Changes'''.

-	8. ~~Follow these steps to generate~~ a certificate request for enrolling with that trust point:	+	8. Generate a certificate request for enrolling with that trust point by following these steps:

-	: a. ~~Select~~ the '''Trust Point Actions '''tab in the Information pane.	+	: a. Click the '''Trust Point Actions '''tab in the Information pane.

	: b. Select '''certreq''' from the Command drop-down menu. This generates a PKCS#10 certificate signing request (CSR) needed for an identity certificate from the CA corresponding to this trust point entry.		: b. Select '''certreq''' from the Command drop-down menu. This generates a PKCS#10 certificate signing request (CSR) needed for an identity certificate from the CA corresponding to this trust point entry.
Line 365:		Line 365:
	----		----

-	10. ~~Follow these steps to import~~ the identity certificate:	+	10. Import the identity certificate by following these steps:

-	: a. In Device Manager, choose <span style="font-style: normal">'''<font color="Black">Admin > Flash Files</font>'''</span> and select <span style="font-style: normal">'''<font color="Black">Copy, </font>'''</span>then select <span style="font-style: normal">'''<font color="Black">tftp</font>'''</span> from the Protocol radio buttons<span style="font-style: normal">~~'''~~<font color="Black"> to </font>~~'''~~</span>tftp copy the CA certificate to bootflash.	+	: a. In Device Manager, choose <span style="font-style: normal">'''<font color="Black">Admin > Flash Files</font>'''</span> and select <span style="font-style: normal">'''<font color="Black">Copy, </font>'''</span>then select <span style="font-style: normal">'''<font color="Black">tftp</font>'''</span> from the Protocol radio buttons<span style="font-style: normal"> <font color="Black"> to </font> </span>tftp copy the CA certificate to bootflash.

-	: b. In Fabric Manager, choose <span style="font-style: normal">'''<font color="Black">Switches > Security > PKI </font>'''</span>and ~~select~~ the <span style="font-style: normal">'''<font color="Black">TrustPoint Actions</font>'''</span> tab.	+	: b. In Fabric Manager, choose <span style="font-style: normal">'''<font color="Black">Switches > Security > PKI </font>'''</span>and click the <span style="font-style: normal">'''<font color="Black">TrustPoint Actions</font>'''</span> tab.

	: c. Select the '''certimport''' option from the Command drop-down menu to import an identity certificate in this trust point.		: c. Select the '''certimport''' option from the Command drop-down menu to import an identity certificate in this trust point.
Line 379:		Line 379:
	: d. Enter the name of the certificate file that was copied to bootflash in the URL field in the bootflash:filename format.		: d. Enter the name of the certificate file that was copied to bootflash in the URL field in the bootflash:filename format.

-	: e. Click ~~'''~~'''Apply Changes ~~'''~~'''<span style="font-style: normal; font-weight: normal"><font color="Black">to save your changes.</font></span>	+	: e. Click '''Apply Changes''' <span style="font-style: normal; font-weight: normal"><font color="Black">to save your changes.</font></span>

-	If successful, the values of the identity certificate and its related objects, ~~like~~ the certificate ~~file name~~, are automatically updated with the appropriate values as per the corresponding attributes in the identity certificate.	+	If successful, the values of the identity certificate and its related objects, such as the certificate filename, are automatically updated with the appropriate values as per the corresponding attributes in the identity certificate.

	----		----