certificate

Defines the table row index.

Displays the X.509 fields configuration for CSR and new self signed certificates.

Creates a self-signed certificate (by the device) with the current key.

Defines or deletes the extended key usage X.509 field for CSR and new self-signed certificates. The add option provides the following sub-commands to define the key (string) and optionally, to define the key as critical:

set-extended-key-usage add <String> [critical]

Defines or deletes the key usage X.509 field for CSR and new self-signed certificates. The add option provides the following sub-commands to define the key (string) and optionally, to define the key as critical:

set-extended-key-usage add <String> [critical]

Defines or deletes the Authority Information Access (AIA) extension field for CSR and new self-signed certificates with the URL of the server where the client can check the validity of the device's certificate during the TLS handshake.

Defines the signature algorithm for CSR and new self-signed certificates.

Defines, deletes or copies the certificate subject name for CSR and new self-signed certificates. The add option provides the following sub-commands to define the subject:

certificate create set-subject add {common-name|country|locality|org-unit|organization|state}

Defines or deletes the Subject Alternative Name (SAN) fields, which can be a DNS, e-mail, IP address or URI. The add option provides the following sub-commands to define the SAN fields:

certificate create set-subject-alternative-name add {dns|email|ip-addr|uri}

Defines or deletes the subject key identifier (SKI) X.509 field for CSR and new self-signed certificates. The add option provides the following sub-commands to define the SKI:

certificate create set-subject-key-identifier add {<HEX STRING>|hash-sha1|hash-sha1-60lsb}

Creates a certificate signing request with the current key, which needs to be sent to the CA.

To view more of the output of the CSR text, press Enter (from "BEGIN CERTIFICATE REQUEST" to "END CERTIFICATE REQUEST").

To send the CSR to a remote server, type the URL with a CSR file name, and then press Enter (see bold text):

(tls-1)# certificate create signing-request

Certificate signing request:

-----BEGIN CERTIFICATE REQUEST-----
MIIDVjCCAb4CAQAwADCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAKyT
2ULFybbBtkT/zX+oiiMQO+86DLeFZ7eD+uZ35vrtrALaV0T2V/m88NR9uULCsCVy
6L0ItCQ5pZ1DreGcKzdfgNmhNPCzUdoqkw/BeBBERMqIhKwnO2ucmeOu0qx/DUBm
....
....
-----END CERTIFICATE REQUEST-----

Send this request to your security administrator for signing,
then upload the new signed certificate to the device.

In order to copy the CSR to url, enter the url or press enter to quit:
tftp://10.11.2.2/my.csr

Sending file...

Displays certificate information of currently installed certificate.

Exports the currently installed certificate in PEM format.

Imports a certificate in textual PEM format.

Note: The imported certificate replaces the currently installed certificate.