Tip
This is the documentation for the 20.02 version. Looking for the documentation of the latest version? Have a look here.
Certificate Signing Request Management¶
A certificate signing request, or CSR, combines the public key along with a list of attributes that uniquely identify an entity such as a TNSR router. Once created, the CSR is exported and sent to the Certificate Authority (CA). The CA will sign the request and return a certificate.
Set Certificate Signing Request Attributes¶
The first step in creating a CSR is to set the attributes which identify this firewall. These attributes will be combined to form the certificate Subject:
tnsr# pki signing-request set common-name tnsr.example.com
tnsr# pki signing-request set country US
tnsr# pki signing-request set state Texas
tnsr# pki signing-request set city Austin
tnsr# pki signing-request set org Example Co
tnsr# pki signing-request set org-unit IT
The attributes include:
- common-name:
The common name of the entity the certificate will identify, typically the fully qualified domain name of this host, or a username.
- country:
The country in which the entity is located.
- state:
The state or province in which the entity is located.
- city:
The city in which the entity is located.
- org:
The company name associated with the entity.
- org-unit:
The department or division name inside the company.
Note
At a minimum, a common-name must be set to generate a CSR.
Next, set the required digest algorithm which will be used to create a hash of the certificate data:
tnsr# pki signing-request set digest sha256
This algorithm can be any of the following choices, from
weakest to strongest: md5
, sha1
, sha224
, sha256
, sha384
, or
sha512
.
Note
SHA-256 is the recommended minimum strength digest algorithm.
Before generating the CSR, review the configured attributes for the CSR:
tnsr# pki signing-request settings show
Certificate signing request fields:
common-name: tnsr.example.com
country: US
state: Texas
city: Austin
org: Example Co
org-unit: IT
digest: sha256
If any attributes are incorrect, change them using the commands shown previously.
Generate a Certificate Signing Request¶
If the attributes are all correct, generate the CSR using the same name as the private key created previously. TNSR will output CSR data to the terminal in PEM format:
tnsr# pki signing-request mycert generate
-----BEGIN CERTIFICATE REQUEST-----
<csr data>
-----END CERTIFICATE REQUEST-----
The CSR data is stored in a file at /etc/pki/tls/tnsr/certs/<name>.csr
Note
Remember that the private key, CSR, and certificate must all use identical names!
The CSR data for existing entries can be displayed in PEM format:
tnsr# pki signing-request mycert get
-----BEGIN CERTIFICATE REQUEST-----
<csr data>
-----END CERTIFICATE REQUEST-----
Copy and paste the CSR data, including the armor lines (BEGIN
, END
),
from the terminal into a local file, and submit that copy of the CSR to the CA
for signing.
Warning
Remember, the private key for the CSR is not required for signing. Do not send the private key to the CA.
Other CSR Operations¶
A CSR entry may be deleted once the certificate has been imported to TNSR:
tnsr# pki signing-request <name> delete
To view a list of all CSR entries known to TNSR:
tnsr# pki signing-request list
To reset the CSR attribute contents:
tnsr# pki signing-request settings clear