Lantronix EDS1100 Guía de usuario descargar pdf (Pagina 100)

11: Security Settings

EDS1100/2100 User Guide 99

Certificates and private keys can be stored in several file formats. Best known are PKCS12, DER

and PEM. Certificate and key can be in the same file or in separate files. The key can be encrypted

with a password or not. The EDS1100/2100 currently only accepts separate PEM files. The key

needs to be unencrypted.

SSL Utilities

Several utilities exist to convert between the formats as follows:

 OpenSSL—Open source set of SSL related command line utilities. It can act as server or

client. It can generate or sign certificate requests. It can convert all kinds of formats.

Executables are available for Linux and Windows. To generate a self-signed RSA certificate/

key combo use the following commands in the order shown:

openssl req –x509 –nodes –days 365 –newkey rsa:1024 –keyout

mp_key.pem –out mp_cert.pem

Note: Signing other certificate requests is also possible with OpenSSL. See

www.openssl.org or www.madboa.com/geek/openssl for more information.

 Steel Belted Radius—Commercial radius server by Juniper Networks that provides a GUI

administration interface. It also provides a certificate request and self-signed certificate

generator. The self-signed certificate has extension .sbrpvk and is in the PKCS12 format.

OpenSSL can convert this into a PEM format certificate and key by usig the following

commands in the order shown:

openssl pkcs12 -in sbr_certkey.sbrpvk -nodes -out sbr_certkey.pem

The sbr_certkey.pem file contains both certificate and key. If loading the SBR certificate into

EDS1100/2100 as an authority, you will need to edit it. Open the file in any plain text editor.

Delete all info before the following:

“----- BEGIN CERTIFICATE-----“

and after

“----- END CERTIFICATE-----“

and save as sbr_cert.pem. SBR accepts trusted-root certificates in the DER format. Again,

OpenSSL can convert any format into DER by using the following commands in the order

shown:

openssl x509 -inform pem -in mp_cert.pem -outform der -out mp_cert.der

Note: With SBR, when the identity information includes special characters such as

dashes and periods, SBR changes the format it uses to store these strings and becomes

incompatible with the current EDS1100/2100 release. We will add support for this and

other formats in future releases.

 Free Radius—Linux open-source Radius server. It is versatile, but complicated to configure.

SSL Configuration

To configure SSL, perform the following steps.

1. Click SSL from the Main Menu. Figure 11-5 shows the page that displays.

1 2 ... 95 96 97 98 99 100 101 102 103 104 105 ... 156 157

Sin comentarios

Lantronix EDS1100 Guía de usuario Pagina 100