Certificate Signing Request Management¶
A certificate signing request, or CSR, combines the public key along with a list of attributes that uniquely identify an entity such as a TNSR router. Once created, the CSR is exported and sent to the Certificate Authority (CA). The CA will sign the request and return a certificate.
Set Certificate Signing Request Attributes¶
The first step in creating a CSR is to set the attributes which identify this firewall. These attributes will be combined to form the certificate Subject:
tnsr# pki signing-request set common-name tnsr.example.com tnsr# pki signing-request set country US tnsr# pki signing-request set state Texas tnsr# pki signing-request set city Austin tnsr# pki signing-request set org Example Co tnsr# pki signing-request set org-unit IT
The attributes include:
|common-name:||The common name of the entity the certificate will identify, typically the fully qualified domain name of this host, or a username.|
|country:||The country in which the entity is located.|
|state:||The state or province in which the entity is located.|
|city:||The city in which the entity is located.|
|org:||The company name associated with the entity.|
|org-unit:||The department or division name inside the company.|
At a minimum, a common-name must be set to generate a CSR.
Next, set the required digest algorithm which will be used to create a hash of the certificate data:
tnsr# pki signing-request set digest sha256
This algorithm can be any of the following choices, from
weakest to strongest:
SHA-256 is the recommended minimum strength digest algorithm.
Before generating the CSR, review the configured attributes for the CSR:
tnsr# pki signing-request settings show Certificate signing request fields: common-name: tnsr.example.com country: US state: Texas city: Austin org: Example Co org-unit: IT digest: sha256
If any attributes are incorrect, change them using the commands shown previously.
Generate a Certificate Signing Request¶
If the attributes are all correct, generate the CSR using the same name as the private key created previously. TNSR will output CSR data to the terminal in PEM format:
tnsr# pki signing-request mycert generate -----BEGIN CERTIFICATE REQUEST----- <csr data> -----END CERTIFICATE REQUEST-----
The CSR data is stored in a file at
Remember that the private key, CSR, and certificate must all use identical names!
The CSR data for existing entries can be displayed in PEM format:
tnsr# pki signing-request mycert get -----BEGIN CERTIFICATE REQUEST----- <csr data> -----END CERTIFICATE REQUEST-----
Copy and paste the CSR data, including the armor lines (
from the terminal into a local file, and submit that copy of the CSR to the CA
Remember, the private key for the CSR is not required for signing. Do not send the private key to the CA.
Other CSR Operations¶
A CSR entry may be deleted once the certificate has been imported to TNSR:
tnsr# pki signing-request <name> delete
To view a list of all CSR entries known to TNSR:
tnsr# pki signing-request list
To reset the CSR attribute contents:
tnsr# pki signing-request settings clear