Device Manager GUI Guide vA1(7), Cisco ACE 4700 Series Application Control Engine Appliance
Configuring SSL
Downloads: This chapterpdf (PDF - 232.0KB) The complete bookPDF (PDF - 11.63MB) | Feedback

Configuring SSL

Table Of Contents

Configuring SSL

Using SSL Certificates

Importing SSL Certificates

Using SSL Keys

Importing SSL Key Pairs

Generating SSL Key Pairs

Exporting SSL Certificates

Exporting SSL Key Pairs

Configuring SSL Parameter Maps

Configuring SSL Chain Group Parameters

Configuring SSL CSR Parameters

Generating CSRs

Configuring SSL Proxy Service


Configuring SSL


Secure Sockets Layer (SSL) is an application-level protocol that provides encryption technology for the Internet, ensuring secure transactions such as the transmission of credit card numbers for e-commerce Web sites. SSL provides the secure transaction of data between a client and a server through a combination of privacy, authentication, and data integrity. SSL relies upon certificates and private-public key exchange pairs for this level of security.

Before configuring an ACE appliance for SSL, you must import a digital certificate and its corresponding public and private key pair to the desired ACE appliance context.

If you do not have a certificate and corresponding key pair, you can generate an RSA key pair and a certificate signing request (CSR). Create a CSR when you need to apply for a certificate from a certificate authority (CA). The CA signs the CSR and returns the authorized digital certificate to you.

Table 4-1 describes the steps for using SSL keys and certificates.

Table 4-1 SSL Key and Certificate Procedure Overview 

 
Task
Description

Step 1 

Create an SSL parameter map.

Create an SSL parameter map to specify the options that apply to SSL sessions such as the method to be used to close SSL connections, the cipher suite, and version of SSL or TSL.

See Configuring SSL Parameter Maps.

Step 2 

Create an SSL key pair file.

Create an SSL RSA key pair file to generate a CSR, create a digital signature, and encrypt packet data during the SSL handshake with an SSL peer.

See Generating SSL Key Pairs.

Step 3 

Configure CSR parameters.

Set CSR parameters to define the distinguished name attributes of a CSR.

See Configuring SSL CSR Parameters.

Step 4 

Create a CSR.

Create a CSR to submit with the key pair file when you apply for an SSL certificate.

See Generating CSRs.

Step 5 

Copy and paste the CSR into the Certificate Authority (CA) Web-based application or e-mail the CSR to the CA.

Using the SSL key pair and CSR, apply for an approved certificate from a Certificate Authority.

Use the method specified by the CA for submitting your request.

Step 6 

Save the approved certificate from the CA in its received format on an FTP, SFTP, or TFTP server.

When you receive the approved certificate, save it in the format in which it was received on a network server accessible via FTP, SFTP, or TFTP.

Step 7 

Import the approved certificate and key pair into the desired virtual context.

Import the approved certificate and the associated SSL key pair into the appropriate context using ACE Appliance Device Manager.

See:

Importing SSL Certificates

Importing SSL Key Pairs

Step 8 

Confirm that the public key in the key pair file matches the public key in the certificate file.

Examine the contents of the files to confirm that the key pair information is the same in both the key pair file and the certificate file.

Step 9 

Configure the virtual context for SSL.

See Configuring Traffic Policies, page 7-1.


For more information about using SSL with ACE appliances, see the Cisco 4700 Series Application Control Engine Appliance SSL Configuration Guide.

To configure ACE appliances for SSL, see:

Importing SSL Certificates

Importing SSL Key Pairs

Configuring SSL Parameter Maps

Configuring SSL CSR Parameters

Configuring SSL Chain Group Parameters

Configuring SSL Proxy Service

Using SSL Certificates

Digital certificates and key pairs are a form of digital identification for user authentication. Certificate Authorities issue certificates that attest to the validity of the public keys they contain. A client or server certificate includes the following identification attributes:

Name of the Certificate Authority and Certificate Authority digital signature

Serial number

Name of the client or server (the certificate subject) that the certificate authenticates

Subject's public key

Time stamps that indicate the certificate's expiration date

A Certificate Authority has one or more signing certificates that it uses for creating SSL certificates and certificate revocation lists (CRL). Each signing certificate has a matching private key that is used to create the Certificate Authority signature. The Certificate Authority makes the signing certificates (with the public key embedded) available to the public, enabling anyone to access and use the signing certificates to verify that an SSL certificate or CRL was actually signed by a specific Certificate Authority.

ACE appliances require certificates and corresponding key pairs for:

SSL termination—The ACE appliance acts as an SSL proxy server and terminates the SSL session between it and the client. For SSL termination, you must obtain a server certificate and corresponding key pair.

SSL initiation—The ACE appliance acts as a client and initiates the SSL session between it and the SSL server. For SSL initiation, you must obtain a client certificate and corresponding key pair.

Related Topics

Configuring SSL

Exporting SSL Certificates

Importing SSL Certificates

Using SSL Keys

Importing SSL Key Pairs

Configuring SSL CSR Parameters

Generating CSRs

Importing SSL Certificates

Use this procedure to import SSL certificates.

Assumptions

You have configured an ACE appliance for server load balancing. (See Configuring Load Balancing, page 3-1.)

You have obtained an SSL certificate from a certificate authority (CA) and have placed it on a network server accessible by the ACE appliance.

Procedure


Step 1 Select Config > Virtual Contexts > context > SSL > Certificates. The Certificates table appears, listing any valid SSL certificates.

Step 2 Click Import. The Import dialog box appears.

Step 3 Enter the information in Table 4-2.

Table 4-2 SSL Certificate Management Import Attributes 

Field
Description

Protocol

Specify the method to be used for accessing the network server:

FTP—Indicates that FTP is to be used to access the network server when importing the SSL certificate.

TFTP—Indicates that TFTP is to be used to access the network server when importing the SSL certificate.

SFTP—Indicates that SFTP is to be used to access the network server when importing the SSL certificate.

TERMINAL—Indicates that you will import the file using cut and paste by pasting the certificate information to the terminal display. You can only use the terminal method to display PEM files, which are in ASCII format.

IP Address

This field appears for FTP, TFTP, and SFTP.

Enter the IP address of the remote server on which the SSL certificate file resides.

Remote Filename

This field appears for FTP, TFTP, and SFTP.

Enter the directory and filename of the certificate file on the network server.

Local Filename

Enter the filename to be used for the SSL certificate file when it is imported to the ACE appliance.

Username

This field appears for FTP and SFTP.

Enter the name of the user account on the network server.

Password

This field appears for FTP and SFTP.

Enter the password for the user account on the network server.

Confirm

This field appears for FTP and SFTP.

Reenter the password.

Passphrase

This field appears for FTP and SFTP.

Enter the passphrase that was created with the file. Without this phrase, you cannot use the file. Passphrases are used only with encrypted PEM and PKCS files.

Confirm

This field appears for FTP and SFTP.

Reenter the passphrase.

Nonexportable

The ability to export SSL certificates allows you to copy signed certificates to another server on your network so that you can then import them onto another ACE appliance or Web server. Exporting is similar to copying in that the original files are not deleted.

Select the check box to indicate that this certificate file cannot be exported from the ACE appliance.

Import Text

This field appears for Terminal.

Cut the certificate information from the remote server and paste it into this field.


Step 4 Click:

OK to accept your entries and to return to the Certificates table. The ACE Appliance Device Manager updates the Certificates table with the newly installed certificate.

Cancel to exit this procedure without saving your entries and to return to the Certificates table.


Related Topics

Configuring SSL

Using SSL Keys

Importing SSL Key Pairs

Configuring SSL Parameter Maps

Configuring SSL Chain Group Parameters

Configuring SSL CSR Parameters

Configuring SSL Proxy Service

Using SSL Keys

An ACE appliance and its peer use a public key cryptographic system named Rivest, Shamir, and Adelman Signatures (RSA) for authentication during the SSL handshake to establish an SSL session. The RSA system uses key pairs that consist of a public key and a corresponding private (secret) key. During the handshake, the RSA key pairs encrypt the session key that both devices will use to encrypt the data that follows the handshake.

Use this procedure to view options for working with SSL and SSL keys.

Procedure


Step 1 Select Config > Virtual Contexts > context > SSL > Keys. The Keys table appears.

Step 2 Continue with one of the following options:

Generate a key pair—See Generating SSL Key Pairs.

Import a key pair—See Importing SSL Key Pairs.

Export a key pair—See Exporting SSL Key Pairs.

Generate a CSR—See Generating CSRs.


Related Topics

Generating SSL Key Pairs

Importing SSL Key Pairs

Generating SSL Key Pairs

Exporting SSL Key Pairs

Configuring SSL

Importing SSL Key Pairs

Use this procedure to import an SSL key pair file.

Assumptions

You have configured an ACE appliance for server load balancing. (See Configuring Load Balancing, page 3-1.)

You have obtained an SSL key pair from a certificate authority (CA) and have placed the pair on a network server accessible by the ACE appliance.

Procedure


Step 1 Select Config > Virtual Contexts > context > SSL > Keys. The Keys table appears, listing existing SSL keys.

Step 2 Click Import. The Import dialog box appears.

Step 3 Enter the information in Table 4-3.

Table 4-3 SSL Key Pair Import Attributes 

Field
Description

Protocol

Specify the method to be used for accessing the network server:

FTP—Indicates that FTP is to be used to access the network server when importing the SSL key pair file.

TFTP—Indicates that TFTP is to be used to access the network server when importing the SSL key pair file.

SFTP—Indicates that SFTP is to be used to access the network server when importing the SSL key pair file.

TERMINAL—Indicates that you will import the file using cut and paste by pasting the certificate and key pair information to the terminal display. You can only use the terminal method to display PEM files, which are in ASCII format.

IP Address

This field appears for FTP, TFTP, and SFTP.

Enter the IP address of the remote server on which the SSL key pair file resides.

Remote Filename

This field appears for FTP, TFTP, and SFTP.

Enter the directory and filename of the key pair file on the network server.

Local Filename

Enter the filename to be used for the SSL key pair file when it is imported to the ACE appliance.

Username

This field appears for FTP and SFTP.

Enter the name of the user account on the network server.

Password

This field appears for FTP and SFTP.

Enter the password for the user account on the network server.

Confirm

This field appears for FTP and SFTP.

Reenter the password.

Passphrase

This field appears for FTP and SFTP.

Enter the passphrase that was created with the file. Without this phrase, you cannot use the file. Passphrases are used only with encrypted PEM and PKCS files.

Confirm

This field appears for FTP and SFTP.

Reenter the passphrase.

Nonexportable

The ability to export SSL key pair files allows you to copy key pair files to another server on your network so that you can then import them onto another ACE appliance or Web server. Exporting is similar to copying in that the original files are not deleted.

Select the check box to indicate that this key pair file cannot be exported from the ACE appliance. Clear the check box to indicate that this key pair file can be exported from the ACE appliance.

Import Text

This field appears for Terminal.

Cut the key pair information from the remote server and paste it into this field.


Step 4 Click

OK to accept your entries and to return to the Keys table. The ACE Appliance Device Manager updates the Keys table with the imported key pair file information.

Cancel to exit this procedure without saving your entries and to return to the Keys table.


Related Topics

Configuring SSL

Importing SSL Certificates

Configuring SSL Parameter Maps

Configuring SSL Chain Group Parameters

Configuring SSL CSR Parameters

Configuring SSL Proxy Service

Generating SSL Key Pairs

If you do not have any matching key pairs, you can use the ACE Appliance Device Manager to generate a key pair.

Use this procedure to generate SSL RSA key pairs.

Procedure


Step 1 Select Config > Virtual Contexts > context > SSL > Keys. The Keys table appears.

Step 2 Click Add to add a new key pair. The Keys configuration screen appears.


Note You cannot modify an existing entry in the Keys table. Instead, delete the existing entry, then add a new one.


Step 3 In the Name field, enter the name of the SSL key pair. Valid entries are alphanumeric strings with a maximum of 26 characters.

Step 4 In the Size field, select the key pair security strength. The number of bits in the key pair file defines the size of the RSA key pair used to secure Web transactions. Longer keys produce more secure implementations by increasing the strength of the RSA security policy. Options and their relative levels of security are:

1024—High security, level 1

1536—High security, level 2

2048—High security, level 3

512—Least security

768—Normal security

Step 5 In the Exportable Key field, select the check box to indicate that the key pair file can be exported. Clear the check box to indicate that the key pair file cannot be exported.

Step 6 Click:

Deploy Now to deploy this configuration on the ACE appliance.

Cancel to exit this procedure without saving your entries and to return to the Keys table.

Next to save your entries and to define another RSA key pair.


After generating an RSA key pair, you can:

Create a CSR parameter set. The CSR parameter set defines the distinguished name attributes for the ACE appliance to use during the CSR-generating process. For details on defining a CSR parameter set, see the Configuring SSL CSR Parameters.

Generate a CSR for the RSA key pair file and transfer the CSR request to the certificate authority for signing. This provides an added layer of security because the RSA private key originates directly within the ACE appliance and does not have to be transported externally. Each generated key pair must be accompanied by a corresponding certificate to work. For details on generating a CSR, see Generating CSRs.

Related Topics

Configuring SSL

Importing SSL Certificates

Importing SSL Key Pairs

Configuring SSL Chain Group Parameters

Configuring SSL CSR Parameters

Configuring SSL Proxy Service

Exporting SSL Certificates

The ability to export SSL certificates allows you copy signed certificates to another server on your network so that you can then import them onto another ACE appliance or Web server. Exporting certificates is similar to copying in that the original certificates are not deleted.

Use this procedure to export SSL certificates from an ACE appliance to a remote server.

Assumption

The SSL certificate can be exported. (See Importing SSL Certificates.)

Procedure


Step 1 Select Config > Virtual Contexts > context > SSL > Certificates. The Certificates table appears, listing any valid SSL certificates.

Step 2 Select the certificate you want to export, then click Export. The Export dialog box appears.

Step 3 Enter the information in Table 4-4.

Table 4-4 SSL Certificate Export Attributes 

Field
Description

Protocol

Specify the method to be used for exporting the SSL certificate:

FTP—Indicates that FTP is to be used to access the network server when exporting the SSL certificate.

TFTP—Indicates that TFTP is to be used to access the network server when exporting the SSL certificate.

SFTP—Indicates that SFTP is to be used to access the network server when exporting the SSL certificate.

TERMINAL—Indicates that you will export the certificate using cut and paste by pasting the certificate and key pair information to the terminal display. You can only use the terminal method to display PEM files, which are in ASCII format.

IP Address

This field appears for FTP, TFTP, and SFTP.

Enter the IP address of the remote server to which the SSL certificate file is to be exported.

Remote Filename

This field appears for FTP, TFTP, and SFTP.

Enter the directory and filename to be used for the SSL certificate file on the remote network server.

Username

This field appears for FTP and SFTP.

Enter the name of the user account on the remote network server.

Password

This field appears for FTP and SFTP.

Enter the password for the user account on the remote network server.

Confirm

This field appears for FTP and SFTP.

Reenter the password.


Step 4 Click:

OK to export the certificate and to return to the Certificates table.

Cancel to exit this procedure without exporting the certificate and to return to the Certificates table.


Related Topics

Configuring SSL

Importing SSL Certificates

Importing SSL Key Pairs

Generating SSL Key Pairs

Configuring SSL Chain Group Parameters

Configuring SSL CSR Parameters

Configuring SSL Proxy Service

Exporting SSL Key Pairs

The ability to export SSL key pairs allows you copy SSL key pair files to another server on your network so that you can then import them onto another ACE appliance or Web server. Exporting key pair files is similar to copying in that the original key pairs are not deleted.

Use this procedure to export SSL key pairs from an ACE appliance to a remote server.

Assumption

The SSL key pair can be exported (see Generating SSL Key Pairs).

Procedure


Step 1 Select Config > Virtual Contexts > context > SSL > Keys. The Keys table appears.

Step 2 Select the key entry you want to export, then click Export. The Export dialog box appears.

Step 3 Enter the information in Table 4-5.

Table 4-5 SSL Key Export Attributes 

Field
Description

Protocol

Specify the method to be used for exporting the SSL key pair:

FTP—Indicates that FTP is to be used to access the network server when exporting the SSL key pair.

TFTP—Indicates that TFTP is to be used to access the network server when exporting the SSL key pair.

SFTP—Indicates that SFTP is to be used to access the network server when exporting the SSL key pair.

TERMINAL—Indicates that you will export the key pair using cut and paste by pasting the key pair information to the terminal display. You can only use the terminal method to display PEM files, which are in ASCII format.

IP Address

This field appears for FTP, TFTP, and SFTP.

Enter the IP address of the remote server to which the SSL key pair is to be exported.

Remote Filename

This field appears for FTP, TFTP, and SFTP.

Enter the directory and filename to be used for the SSL key pair file on the remote network server.

Username

This field appears for FTP and SFTP.

Enter the name of the user account on the remote network server.

Password

This field appears for FTP and SFTP.

Enter the password for the user account on the remote network server.

Confirm

This field appears for FTP and SFTP.

Reenter the password.


Step 4 Click:

OK to export the key pair and to return to the Keys table.

Cancel to exit this procedure without exporting the key pair and to return to the Keys table.


Related Topics

Configuring SSL

Importing SSL Certificates

Importing SSL Key Pairs

Generating SSL Key Pairs

Configuring SSL Chain Group Parameters

Configuring SSL CSR Parameters

Configuring SSL Proxy Service

Configuring SSL Parameter Maps

An SSL parameter map defines the SSL session parameters that an ACE appliance applies to an SSL proxy service. SSL parameter maps let you apply the same SSL session parameters to different proxy services.

Use this procedure to create SSL parameter maps.

Procedure


Step 1 Select Config > Virtual Contexts > context > SSL > Parameter Map. The Parameter Map table appears.

Step 2 Click Add to add a new SSL parameter map, or select an existing entry to modify, then click Edit. The Parameter Map configuration screen appears.

Step 3 In the Parameter Map Name field, enter a unique name for the parameter map. Valid entries are alphanumeric strings with a maximum of 64 characters.

Step 4 In the Close Protocol Behavior field, select the method to be used to close the SSL connection:

None—Indicates that the ACE appliance is not to send a close-notify alert message to the SSL peer, nor does the ACE appliance expect a close-notify alert message from the peer. The ACE appliance preserves the session information so that SSL resumption can be used for future SSL connections.

Disabled—Indicates that the ACE appliance is to send a close-notify alert message to the SSL peer; however, the SSL peer does not expect a close-notify alert before removing the session. Whether the SSL peer sends a close-notify alert message or not, the session information is preserved, allowing session resumption for future SSL connections.

Step 5 In the SSL Version field, enter the version of SSL be to used during SSL communications:

All—Indicates that the ACE appliance is to use both SSL v3 and TLS v1 in its communications with peer ACE appliances.

SSL3—Indicates that the ACE appliance is to use only SSL v3 in its communications with peer ACE appliances.

TLS1—Indicates that the ACE appliance is to use only TLS v1 in its communications with peer ACE appliances.

Step 6 Click:

Deploy Now to deploy this configuration on the ACE appliance. The updated Parameter Map screen appears along with the Parameter Map Cipher table. Continue with Step 7.

Cancel to exit this procedure without saving your entries and to return to the Parameter Map table.

Next to save your entries and to define another parameter map.

Step 7 In the Parameter Map Cipher table, click Add to add a cipher, or select an existing cipher, then click Edit. The Parameter Map Cipher configuration screen appears.

Step 8 In the Cipher Name field, select the cipher you want to use. For more information on the SSL cipher suites that ACE appliances support, see Cisco 4700 Series Application Control Engine Appliance SSL Configuration Guide.

Step 9 In the Cipher Priority field, enter the priority you want to assign to this cipher suite. The priority indicates the cipher's preference for use. Valid entries are integers from 1 to 10 with 1 indicating the least preferred and 10 indicating the most preferred. When determining which cipher suite to use, the ACE appliance selects the cipher suite with the highest priority.

Step 10 Click:

Deploy Now to deploy this configuration on the ACE appliance.

Cancel to exit the procedure without saving your entries and to return to the Parameter Map Cipher table.

Next to save your entries and to add another entry to the Parameter Map Cipher table.


Related Topics

Configuring SSL

Importing SSL Certificates

Importing SSL Key Pairs

Generating SSL Key Pairs

Configuring SSL Chain Group Parameters

Configuring SSL CSR Parameters

Configuring SSL Proxy Service

Configuring SSL Chain Group Parameters

A chain group specifies the certificate chains that the ACE appliance sends to its peer during the handshake process. A certificate chain is a hierarchal list of certificates that includes the ACE appliance's certificate, the root certificate authority certificate, and any intermediate certificate authority certificates. Using the information provided in a certificate chain, the certificate verifier searches for a trusted authority in the certificate hierarchal list up to and including the root certificate authority. If the verifier finds a trusted authority before reaching the root certificate authority certificate, it stops searching further.

Use this procedure to configure certificate chains for a virtual context.

Assumption

At least one SSL certificate is available.

Procedure


Step 1 Select Config > Virtual Contexts > context > SSL > Chain Group Parameters. The Chain Group Parameters table appears.

Step 2 Click Add to add a new chain group, or select an existing chain group, then click Edit to modify it. The Chain Group Parameters configuration screen appears.

Step 3 In the Chain Group Name field, enter a unique name for the chain group. Valid entries are alphanumeric strings with a maximum of 64 characters.

Step 4 Click:

Deploy Now to deploy this configuration on the ACE appliance. The updated Chain Group Parameters screen appears along with the Chain Group Certificates table. Continue with Step 5.

Cancel to exit the procedure without saving your entries and to return to the Chain Group Parameters table.

Next to save your entries and to add another entry to the Chain Group Parameters table.

Step 5 In the Chain Group Certificates table, click Add to add an entry. The Chain Group Certificates configuration screen appears.


Note You cannot modify an existing entry in the Chain Group Certificates table. Instead, delete the entry, then add a new one.


Step 6 In the Certificate Name field, select the certificate to add to this chain group.

Step 7 Click:

Deploy Now to deploy this configuration on the ACE appliance.

Cancel to exit the procedure without saving your entries and to return to the Chain Group Certificates table.

Next to save your entries and to add another certificate to this chain group table.


Related Topics

Configuring SSL

Importing SSL Certificates

Importing SSL Key Pairs

Generating SSL Key Pairs

Configuring SSL Parameter Maps

Configuring SSL CSR Parameters

Configuring SSL Proxy Service

Configuring SSL CSR Parameters

A certificate signing request (CSR) is a message you send to a certificate authority such as VeriSign and Thawte to apply for a digital identity certificate. The CSR contains information that identifies the SSL site, such as location and a serial number, and a public key that you choose. A corresponding private key is not included in the CSR, but is used to digitally sign the request. The CSR may be accompanied by other credentials or proofs of identity required by the certificate authority, and the certificate authority may contact the applicant for more information.

If the request is successful, the certificate authority returns a digitally signed (with the private key of the certificate authority) identity certificate.

CSR parameters define the distinguished name attributes the ACE appliance applies to the CSR during the CSR-generating process. These attributes provide the certificate authority with the information it needs to authenticate your site. Defining a CSR parameter set lets you to generate multiple CSRs with the same distinguished name attributes.

Each context on an ACE appliance can contain up to eight CSR parameter sets.

Use this procedure to define the distinguished name attributes for SSL CSRs.

Procedure


Step 1 Select Config > Virtual Contexts > context > SSL > CSR Parameters. The CSR Parameters table appears.

Step 2 Click Add to add new set of CSR attributes, or select an existing entry to modify, then click Edit. The CSR Parameters configuration screen appears.

Step 3 In the Name field, enter a unique name for this parameter set. Valid entries are alphanumeric strings with a maximum of 64 characters.

Step 4 In the Country field, enter the name of the country where the SSL site resides. Valid entries are 2 alphabetic characters representing the country, such as US for the United States. The International Organization for Standardization (ISO) maintains the complete list of valid country codes on its Web site (www.iso.org).

Step 5 In the State field, enter the name of the state or province where the SSL site resides.

Step 6 In the Locality field, enter the name of the city where the SSL site resides.

Step 7 In the Common Name field, enter the name of the domain or host of the SSL site. Valid entries are alphanumeric strings with a maximum of 64 characters.

Step 8 In the Serial Number field, enter a serial number to assign to the certificate. Valid entries are alphanumeric strings with a maximum of 64 characters.

Step 9 In the Organization Name field, enter the name of the organization to include in the certificate. Valid entries are alphanumeric strings with a maximum of 64 characters.

Step 10 In the Email field, enter the site e-mail address. Valid entries are alphanumeric strings with a maximum of 40 characters.

Step 11 In the Organization Unit field, enter the name of the organization to include in the certificate. Valid entries are alphanumeric strings with a maximum of 64 characters.

Step 12 Click:

Deploy Now to deploy this configuration on the ACE appliance.

Cancel to exit this procedure without saving your entries and to return to the CSR Parameters table.

Next to save your entries and to define another set of CSR attributes.


Related Topics

Configuring SSL

Importing SSL Certificates

Importing SSL Key Pairs

Configuring SSL Parameter Maps

Configuring SSL Chain Group Parameters

Configuring SSL Proxy Service

Generating CSRs

Create a CSR when you need to apply for a certificate from a certificate authority. When the certificate authority approves a request, it signs the CSR and returns the authorized digital certificate to you. This certificate includes the private key of the certificate authority. When you receive the authorized certificate and key pair, you can import them for use (see Importing SSL Certificates and Importing SSL Key Pairs).

Use this procedure to generate SSL CSRs.

Assumption

You have configured SSL CSR parameters (see Configuring SSL CSR Parameters).

Procedure


Step 1 Select Config > Virtual Contexts > context > SSL > Keys. The Keys table appears.

Step 2 Select a key in the table, then click Generate CSR. The Generate a Certificate Signing Request dialog box appears.

Step 3 In the CSR Parameter field, select the CSR parameter to be used.

Step 4 Click:

OK to generate the CSR. The CSR appears in a popup window which you can now submit to a certificate authority for approval. Work with your certificate authority to determine the method of submission, such as e-mail or a Web-based application. Click Close to close the popup window and to return to the Keys table.

Cancel to exit this procedure without generating the CSR and to return to the Keys table.


Related Topics

Configuring SSL

Importing SSL Certificates

Importing SSL Key Pairs

Configuring SSL Parameter Maps

Configuring SSL Chain Group Parameters

Configuring SSL Proxy Service

Configuring SSL Proxy Service

SSL proxy service defines the SSL parameter map, key pair, certificate, and chain group an ACE appliance uses during SSL handshakes. By configuring an SSL proxy server service on an ACE appliance, the ACE appliance can act as an SSL server.

Use this procedure to define the attributes that the ACE appliance is to use during SSL handshakes so that it can act as an SSL server.

Assumption

You have configured at least one SSL key pair, certificate, chain group, or parameter map to apply to this proxy service.

Procedure


Step 1 Select Config > Virtual Contexts > context > SSL > Proxy Service. The Proxy Service table appears.

Step 2 Click Add to add a new proxy service, or select an existing service, then click Edit to modify it. The Proxy Service configuration screen appears.

Step 3 In the Proxy Service Name field, enter a unique name for this proxy service. Valid entries are alphanumeric strings with a maximum of 26 characters.

Step 4 In the Key List field, select the key pair that the ACE appliance is to use during the SSL handshake for data encryption.

Step 5 In the Certificate List field, select the certificate that the ACE appliance is to use during the SSL handshake to prove its identity.

Step 6 In the Chain Group Name field, select the chain group that the ACE appliance is to use during the SSL handshake.

Step 7 In the Parameter Map Name field, select the SSL parameter map to associate with this SSL proxy server service.

Step 8 Click:

Deploy Now to deploy this configuration on the ACE appliance.

Cancel to exit this procedure without saving your entries and to return to the Proxy Service table.

Next to save your entries and to add another proxy service.


Related Topics

Configuring SSL

Importing SSL Certificates

Importing SSL Key Pairs

Configuring SSL Parameter Maps

Configuring SSL Chain Group Parameters

Configuring SSL CSR Parameters