年代年代L FAQs
Basic questions
HTTPS access to the GUI fails on a VPX instance. How do I gain access?
A certificate-key pair is required for HTTPS access to the GUI. On a Citrix ADC appliance, a certificate-key pair is automatically bound to the internal services. On an MPX or SDX appliance, the default key size is 1024 bytes, and on a VPX instance, the default key size is 512 bytes. However, most browsers today do not accept a key that is less than 1024 bytes. As a result, HTTPS access to the VPX configuration utility is blocked.
Citrix recommends that you install a certificate-key pair of at least 1024 bytes and bind it to the internal service for HTTPS access to the configuration utility. Alternately, update thens-server-certificate
to 1024 bytes. You can use HTTP access to the configuration utility or the CLI to install the certificate.
If I add a license to an MPX appliance, the certificate-key pair binding is lost. How do I resolve this problem?
如果许可证不存在wh MPX设备en it starts, and you add a license later and restart the appliance, you might lose the certificate binding. Reinstall the certificate and bind it to the internal service
Citrix recommends that you install an appropriate license before starting the appliance.
What are the various steps involved in setting up a secure channel for an SSL transaction?
年代etting up a secure channel for an SSL transaction involves the following steps:
The client sends an HTTPS request for a secure channel to the server.
After selecting the protocol and cipher, the server sends its certificate to the client.
The client checks the authenticity of the server certificate.
If any of the checks fail, the client displays the corresponding feedback.
如果通过检查或客户端决定continue even if a check fails, the client creates a temporary, disposable key. This key is called thepre-master secretand the client encrypts this key by using the public key of the server certificate.
The server, upon receiving the pre-master secret, decrypts it by using the server’s private key and generates the session keys. The client also generates the session keys from the pre-master secret. Thus both client and server now have a common session key, which is used for encryption and decryption of application data.
I understand that SSL is a CPU-intensive process. What is the CPU cost associated with the SSL process?
The following two stages are associated with the SSL process:
The initial handshake and secure channel setup by using the public and private key technology.
Bulk data encryption by using the symmetric key technology.
Both of the preceding stages can affect server performance, and they require intensive CPU processing for of the following reasons:
The initial handshake involves public-private key cryptography, which is very CPU intensive because of large key sizes (1024 bit, 2048 bit, 4096 bit).
Encryption/decryption of data is also computationally expensive, depending on the amount of data that must be encrypted or decrypted.
What are the various entities of an SSL configuration?
An SSL configuration has the following entities:
- 年代erver certificate
- Certificate Authority (CA) certificate
- Cipher suite that specifies the protocols for the following tasks:
- Initial key exchange
- 年代erver and client authentication
- Bulk encryption algorithm
- Message authentication
- Client authentication
- CRL
- 年代年代L Certificate Key Generation Tool that enables you to create the following files:
- Certificate request
- 年代elf-signed certificate
- RSA keys
- DH parameters
I want to use the SSL offloading feature of the Citrix ADC appliance. What are the various options for receiving an SSL certificate?
You must receive an SSL certificate before you can configure the SSL setup on the Citrix ADC appliance. You can use any of the following methods to receive an SSL certificate:
Request a certificate from an authorized certificate authority (CA).
Use the existing server certificate.
Create a certificate-key pair on the Citrix ADC appliance.
Note:This certificate is a test certificate signed by the test Root-CA generated by the Citrix ADC appliance. Test certificates signed by the test Root-CA are not accepted by browsers. The browser throws a warning message stating that the server’s certificate cannot be authenticated.
- For anything other than test purposes, you must provide a valid CA certificate and CA key to sign the server certificate.
What are the minimum requirements for an SSL setup?
The minimum requirements for configuring an SSL setup are as follows:
- Obtain the certificates and keys.
- Create a load balancing SSL virtual server.
- Bind HTTP or SSL services to the SSL virtual server.
- Bind a certificate-key pair to the SSL virtual server.
What are the limits for the various components of SSL?
年代年代L components have the following limits:
- Bit size of SSL certificates: 4096.
- Number of SSL certificates: Depends on the available memory on the appliance.
- Maximum linked intermediate CA SSL certificates: 9 per chain.
- CRL revocations: Depends on the available memory on the appliance.
What are the various steps involved in the end-to-end data encryption on a Citrix ADC appliance?
The steps involved in the server-side encryption process on a Citrix ADC appliance are as follows:
The client connects to the SSL VIP configured on the Citrix ADC appliance at the secure site.
After receiving the secure request, the appliance decrypts the request and applies layer 4–7 content switching techniques and load balancing policies. Then, it selects the best available back-end web server for the request.
The Citrix ADC appliance creates an SSL session with the selected server.
After establishing the SSL session, the appliance encrypts the client request and sends it to the Web server by using the secure SSL session.
When the appliance receives the encrypted response from the server, it decrypts and re-encrypts the data. Then, it sends the data to the client by using the client side SSL session.
The multiplexing technique of the Citrix ADC appliance enables the appliance to reuse SSL sessions that have been established with the Web servers. Therefore, the appliance avoids the CPU intensive key exchange, known asfull handshake. This process reduces the overall number of SSL sessions on the server and maintains end-to-end security.
Certificates and Keys
Can I place the certificate and key files at any location? Is there any recommended location to store these files?
You can store the certificate and key files on the Citrix ADC appliance or a local computer. However, Citrix recommends that you store the certificate and key files in the/nsconfig/ssl
directory of the Citrix ADC appliance. The/etc
directory exists in the flash memory of the Citrix ADC appliance. This action provides portability and facilitates backup and restoration of the certificate files on the appliance.
Note:Make sure that the certificate and the key files are stored in the same directory.
What is the maximum size of the certificate key supported on the Citrix ADC appliance?
A Citrix ADC appliance running a software release earlier than release 9.0 supports a maximum certificate key size of 2048 bits. Release 9.0 and later support a maximum certificate key size of 4096 bits. This limit is applicable to RSA certificates.
An MPX appliance supports certificates from 512 bits up to the following sizes:
4096-bit server certificate on the virtual server
4096-bit client certificate on the service
4096-bit CA certificate (includes intermediate and root certificates)
4096-bit certificate on the back end server
4096-bit client certificate (if client authentication is enabled on the virtual server)
一个虚拟设备支持证书从512年bits up to the following sizes:
4096-bit server certificate on the virtual server
4096-bit client certificate on the service
4096-bit CA certificate (includes intermediate and root certificates)
4096-bit certificate on the back end server from release 12.0-56.x. Older releases support 2048-bit certificates.
2048-bit client certificate (if client authentication is enabled on the virtual server) from release 12.0-56.x.
What is the maximum size of the DH parameter supported on the Citrix ADC appliance?
The Citrix ADC appliance supports a DH parameter of maximum 2048 bits.
What is the maximum certificate-chain length, that is, the maximum number of certificates in a chain, supported on a Citrix ADC appliance?
A Citrix ADC appliance can send a maximum of 10 certificates in a chain when sending a server certificate message. A chain of the maximum length includes the server certificate and nine intermediate CA certificates.
What are the various certificate and key formats supported on the Citrix ADC appliance?
The Citrix ADC appliance supports the following certificate and key formats:
- Privacy Enhanced Mail (PEM)
- Distinguished Encoding Rule (DER)
Is there a limit for the number of certificates and keys that I can install on the Citrix ADC appliance?
No. The number of certificates and keys that can be installed is limited only by the available memory on the Citrix ADC appliance.
I have saved the certificate and key files on the local computer. I want to transfer these files to the Citrix ADC appliance by using the FTP protocol. Is there any preferred mode for transferring these files to the Citrix ADC appliance?
Yes. If using the FTP protocol, you must use binary mode to transfer the certificate and key files to the Citrix ADC appliance.
Note:By default, FTP is disabled. Citrix recommends using the SCP protocol for transferring certificate and key files. The configuration utility implicitly uses SCP to connect to the appliance.
What is the default directory path for the certificate and key?
The default directory path for the certificate and key is ‘/nsconfig/ssl’.
When adding a certificate and key pair, what happens if I do not specify an absolute path to the certificate and key files?
When adding a certificate-key pair, specify an absolute path to the certificate and key files. If you do not specify, the ADC appliance searches the default directory for these files and attempts to load them to the kernel. The default directory is/nsconfig/ssl
. For example, if the cert1024.pem and rsa1024.pem files are available in the/nsconfig/ssl
directory of the appliance, both of the following commands are successful:
add ssl certKey cert1 -cert cert1204.pem -key rsa1024.pem
add ssl certKey cert1 -cert /nsconfig/ssl/cert1204.pem -key /nsconfig/ssl/rsa1024.pem
I have configured a high availability setup. I want to implement the SSL feature on the setup. How must I handle the certificate and key files in a high availability setup?
In a high availability setup, you must store the certificate and key files on both the primary and the secondary Citrix ADC appliance. The directory path for the certificate and key files must be the same on both appliances before you add an SSL certificate-key pair on the primary appliance.
nCipher nShield® HSM
When integrating with nCipher nShield® HSM, do we have to keep in mind any specific configuration when adding the Citrix ADC appliance to HA?
Configure the same nCipher devices on both the nodes in HA. nCipher configuration commands don’t synchronize in HA. For information about the prerequisites for nCipher nShield® HSM, seePrerequisites.
Do we have to individually integrate both the appliances with nCipher nShield® HSM and RFS? Do we need to complete this action before or after the HA setup?
You can complete the integration before or after the HA setup. If the integration is done after the HA setup, the keys imported on the primary node before configuring the secondary node are not synced to the secondary node. Therefore, Citrix recommends nCipher integration before the HA setup.
Do we need to import the key into both the primary and secondary Citrix ADC appliances, or are the keys synchronized from the primary node to the secondary node?
If nCipher is integrated on both devices before forming the HA, the keys are automatically synchronized from RFS in the process of integration.
Given that the HSM is not on the Citrix ADC appliance, but on nCipher, what happens to the keys and certificates when a node fails and is replaced?
如果一个节点失败,你可以同步键和certificates to the new node, by integrating nCipher on the new node. Then, run the following commands:
sync ha files ssl force ha sync
The certificates are synchronized and added if the keys are synchronized in the process of integrating nCipher.
Ciphers
What is a NULL-Cipher?
Ciphers with no encryption are known as NULL-Ciphers. For example, NULL-MD5 is a NULL-Cipher.
Are the NULL-Ciphers enabled by default for an SSL VIP or an SSL service?
No. NULL-Ciphers are not enabled by default for an SSL VIP or an SSL service.
What is the procedure to remove NULL-Ciphers?
To remove the NULL-Ciphers from an SSL VIP, run the following command:
bind ssl cipher REM NULL
To remove the NULL-Ciphers from an SSL Service, run the following command:
bind ssl cipher REM NULL -service
What are the various cipher aliases supported on the Citrix ADC appliance?
To list the cipher aliases supported on the appliance, at the command prompt, type:
sh cipher
What is the command to display all the predefined ciphers of the Citrix ADC appliance?
To display all the predefined ciphers of the Citrix ADC appliance, at the CLI, type:
show ssl cipher
What is the command to display the details of an individual cipher of the Citrix ADC appliance?
To display the details of an individual cipher of the Citrix ADC appliance, at the CLI, type:
show ssl cipher
Example:
show cipher SSL3-RC4-SHA 1) Cipher Name: SSL3-RC4-SHA Description: SSLv3 Kx=RSA Au=RSA Enc=RC4(128) Mac=SHA1 Done
What is the significance of adding the predefined ciphers of the Citrix ADC appliance?
Adding the predefined ciphers of the Citrix ADC appliance causes the NULL-Ciphers to get added to an SSL VIP or an SSL service.
Is it possible to change the cipher’s order without unbinding them from a cipher group on a Citrix ADC appliance?
Yes. It is possible to change the cipher’s order without unbinding the ciphers from a custom cipher group. However, you cannot change the priority in inbuilt cipher groups. To change the priority of a cipher bound to an SSL entity, first unbind the cipher from the virtual server, service, or service group.
Note:If the cipher group bound to an SSL entity is empty, the SSL handshake fails because there is no negotiated cipher. The cipher group must contain at least one cipher.
Is ECDSA supported on the Citrix ADC appliance?
ECDSA is supported on the following Citrix ADC platforms. For details of supported builds, see Table 1 and Table 2 inCiphers available on the Citrix ADC appliances.
- Citrix ADC MPX and SDX appliances with N3 chips
- Citrix ADC MPX 5900/8900/15000/26000
- Citrix ADC SDX 8900/15000
- Citrix ADC VPX appliances
Does the Citrix ADC VPX appliance support AES-GCM/SHA2 ciphers on the front-end?
Yes, AES-GCM/SHA2 ciphers are supported on the Citrix ADC VPX appliance. For details about the supported builds, seeCiphers available on the Citrix ADC appliances.
Certificates
Is the distinguished name in a client certificate available for the length of the user session?
Yes. You can access the distinguished name of the client certificate in subsequent requests during the length of the user session. That is, even after the SSL handshake is complete and the certificate is not sent again by the browser. Use a variable and an assignment as detailed in the following sample configuration:
Example:
add ns variable v2 -type "text(100)" add ns assignment a1 -variable "$v2" -set "CLIENT.SSL.CLIENT_CERT.SUBJECT.TYPECAST_NVLIST_T('=','/').VALUE("CN")" add rewrite action act1 insert_http_header subject "$v2" // example: to insert the distinguished name in the header add rewrite policy pol1 true a1 add rewrite policy pol2 true act1 bind rewrite global pol1 1 next -type RES_DEFAULT bind rewrite global pol2 2 next -type RES_DEFAULT set rewrite param -undefAction RESET
Why do I need to bind the server certificate?
Binding the server certificates is the basic requirement for enabling the SSL configuration to process SSL transactions.
To bind the server certificate to an SSL VIP, at the CLI, type:
bind ssl vserver -certkeyName
To bind the server certificate to an SSL service, at the CLI, type:
bind ssl service -certkeyName
How many certificates can I bind to an SSL VIP or an SSL service?
On a Citrix ADC VPX, MPX/SDX (N3), and MPX/SDX 14000 FIPS appliance, you can bind two certificates to an SSL virtual server or an SSL service if SNI is disabled. The certificates must be one each of type RSA and ECDSA. If SNI is enabled, you can bind multiple server certificates of type RSA or ECDSA. On a Citrix ADC MPX (N2) or MPX 9700 FIPS appliance, if SNI is disabled, you can bind only one certificate of type RSA. If SNI is enabled, you can bind multiple server certificates of type RSA only.
What happens if I unbind or overwrite a server certificate?
When you unbind or overwrite a server certificate, all the connections and SSL sessions created by using the existing certificate are terminated. When you overwrite an existing certificate, the following message appears:
ERROR: Warning: Current certificate replaces the previous binding.
How do I install an intermediate certificate on a Citrix ADC appliance and link to a server certificate?
年代ee the article athttp://support.citrix.com/article/ctx114146for information about installing an intermediate certificate.
Why am I getting a “resource already exists” error when I try to install a certificate on the Citrix ADC?
年代ee the article athttp://support.citrix.com/article/CTX117284for instructions for resolving the “resource already exists” error.
I want to create a server certificate on a Citrix ADC appliance to test and evaluate the product. What is the procedure to create a server certificate?
Perform the following procedure to create a test certificate.
Note:A certificate created with this procedure cannot be used to authenticate all the users and browsers. After using the certificate for testing, you must obtain a server certificate signed by an authorized Root certificate authority.
To create a self-signed server certificate:
To create a Root CA certificate, at the CLI, type:
create ssl rsakey /nsconfig/ssl/test-ca.key 1024 create ssl certreq /nsconfig/ssl/test-ca.csr -keyfile /nsconfig/ssl/test-ca.key Enter the required information when prompted, and then type the following command: create ssl cert /nsconfig/ssl/test-ca.cer /nsconfig/ssl/test-ca.csr ROOT_CERT -keyfile /nsconfig/ssl/test-ca.key
Perform the following procedure to create a server certificate and sign it with the root CA certificate that you just created
To create the request and the key, at the CLI, type:
create ssl rsakey /nsconfig/ssl/test-server.key 1024 create ssl certreq /nsconfig/ssl/test-server.csr -keyfile /nsconfig/ssl/test-server.key
Enter the required information when prompted.
To create a serial-number file, at the CLI, type:
shell # echo '01' > /nsconfig/ssl/serial.txt # exit
To create a server certificate signed by the root CA certificate created in step 1, at the CLI, type:
create ssl cert /nsconfig/ssl/test-server.cer /nsconfig/ssl/test-server.csr SRVR_CERT -CAcert /nsconfig/ssl/test-ca.cer -CAkey /nsconfig/ssl/test-ca.key -CAserial /nsconfig/ssl/serial.txt
To create a Citrix ADC cert-key pair, which is the in-memory object that holds the server certificate information for SSL handshakes and bulk encryption, at the CLI, type:
add ssl certkey test-certkey -cert /nsconfig/ssl/test-server.cer -key /nsconfig/ssl/test-server.key
To bind the cert-key pair to the SSL virtual server, at the CLI, type:
bind ssl vserver
-certkeyName
I have received a Citrix ADC appliance on which NetScaler software release 9.0 is installed. I have noticed an extra license file on the appliance. Is there any change in the licensing policy starting with NetScaler software release 9.0?
Yes. Starting with Citrix NetScaler software release 9.0, the appliance might not have a single license file. The number of license files depends on the Citrix ADC software release edition. For example, if you have installed the Advanced edition, you might need extra license files for the full functionality of the various features. However, if you have installed the Premium edition, the appliance has only one license file.
How do I export the certificate from the Internet Information Service (IIS)?
There are many ways, but by using the following method the appropriate certificate and private key for the website are exported. This procedure must be performed on the actual IIS server.
Open the Internet Information Services (IIS) Manager administration tool.
Expand the websites node and locate the SSL-enabled website that you want to serve through the Citrix ADC appliance.
Right-click this website and click Properties.
Click the Directory Security tab and, in the Secure Communications section of the window, select the View Certificate box.
Click the Details tab, and then click Copy to File.
On the Welcome to the Certificate Export Wizard page, click Next.
年代elect Yes, export the private key, and click Next.
Note:The private key MUST be exported for SSL Offload to work on the Citrix ADC.
Make sure that the Personal Information Exchange -PKCS #12 radio button is selected, and selectonlythe Include all certificates in the certification path if possible check box. Click Next.
Enter a password and click Next.
Enter a file name and location, and then click Next. Give the file an extension of .PFX.
Click Finish.
How do I convert the PKCS#12 certificate and install it on the Citrix ADC?
Move the exported .PFX certificate file to a location from where it can be copied to the Citrix ADC appliance. That is, to a machine that permits SSH access to the management interface of a Citrix ADC appliance. Copy the certificate to the appliance by using a secure copy utility such as SCP.
Access the BSD shell and convert the certificate (for example, cert.PFX) to .PEM format:
root@ns# openssl pkcs12 -in cert.PFX -out cert.PEM
To make sure that the converted certificate is in the correct x509 format, verify that the following command produces no error:
root@ns# openssl x509 -in cert.PEM -text
Verify that the certificate file contains a private key. Begin by issuing the following command:
root@ns# cat cert.PEM Verify that the output file includes an RSA PRIVATE KEY section. -----BEGIN RSA PRIVATE KEY----- Mkm^s9KMs9023pz/s... -----END RSA PRIVATE KEY-----
The following is another example of an RSA PRIVATE KEY section:
Bag Attributes 1.3.6.1.4.1.311.17.2:
localKeyID: 01 00 00 00 Microsoft CSP Name: Microsoft RSA SChannel Cryptographic Provider friendlyName: 4b9cef4cc8c9b849ff5c662fd3e0ef7e_76267e3e-6183-4d45-886e-6e067297b38f Key Attributes X509v3 Key Usage: 10 -----BEGIN RSA PRIVATE KEY----- Proc-Type: 4,ENCRYPTED DEK-Info: DES-EDE3-CBC,43E7ACA5F4423968 pZJ2SfsSVqMbRRf6ug37Clua5gY0Wld4frPIxFXyJquUHr31dilW5ta3hbIaQ+Rg ... (more random characters) v8dMugeRplkaH2Uwt/mWBk4t71Yv7GeHmcmjafK8H8iW80ooPO3D/ENV8X4U/tlh 5eU6ky3WYZ1BTy6thxxLlwAullynVXZEflNLxq1oX+ZYl6djgjE3qg== -----END RSA PRIVATE KEY----- The following is a SERVER CERTIFICATE section:
Bag Attributes localKeyID: 01 00 00 00 friendlyName: AG Certificate subject=/C=AU/ST=NSW/L=Wanniassa/O=Dave Mother Asiapacific/OU=Support/CN=davemother.food.lan issuer=/DC=lan/DC=food/CN=hotdog -----BEGIN CERTIFICATE----- MIIFiTCCBHGgAwIBAgIKCGryDgAAAAAAHzANBgkqhkiG9w0BAQUFADA8MRMwEQYK ... (more random characters) 5pLDWYVHhLkA1pSxvFjNJHRSIydWHc5ltGyKqIUcBezVaXyel94pNSUYx07NpPV/ MY2ovQyQZM8gGe3+lGFum0VHbv/y/gB9HhFesog= -----END CERTIFICATE-----
The following is an INTERMEDIATE CA CERTIFICATE section:
Bag Attributes:
subject=/DC=lan/DC=food/CN=hotdog issuer=/DC=lan/DC=food/CN=hotdog -----BEGIN CERTIFICATE----- MIIESDCCAzCgAwIBAgIQah20fCRYTY9LRXYMIRaKGjANBgkqhkiG9w0BAQUFADA8 ... (more random characters) Nt0nksawDnbKo86rQcNnY5xUs7c7pj2zxj/IOsgNHUp5W6dDI9pQoqFFaDk= -----END CERTIFICATE----- Further Intermediate CA certificates might follow, depending on the certification path of the exported certificate.
Open the .PEM file in a text editor
Locate the first line of the .PEM file and the first instance of the following line, and copy those two lines and all the lines between them:
-----END CERTIFICATE----- Note: Make sure that last copied line is the first -----END CERTIFICATE----- line in the .PEM file.
Paste the copied lines into a new file. Call the new file something intuitive, such as cert-key.pem. This certificate-key pair is for the server hosting the HTTPS service. This file must contain both the section labeled RSA PRIVATE KEY and the section labeled SERVER CERTIFICATE in the preceding example.
Note:The certificate-key pair file contains the private key and must be kept secure.
Locate any subsequent sections beginning with —–BEGIN CERTIFICATE—– and ending with —END CERTIFICATE—–, and copy each such section to a separate new file.
These sections correspond to certificates of trusted CAs that have been included in the certification path. These sections must be copied and pasted into new individual files for these certificates. For example, the INTERMEDIATE CA CERTIFICATE section of the preceding example must be copied and pasted into a new file).
For multiple intermediate CA certificates in the original file, create files for each intermediate CA certificate in the order in which they appear in the file. Keep track (using appropriate file names) of the order in which the certificates appear, as they must be linked together in the correct order in a later step.
复制(cert-key.pem)和证书密钥文件ny additional CA certificate files into the /nsconfig/ssl directory on the Citrix ADC appliance.
Exit the BSD shell and access the Citrix ADC prompt.
Follow the steps in “Install the certificate-key files on the appliance” to install the key/certificate once uploaded on the device.
How do I convert the PKCS#7 certificate and install it on the Citrix ADC appliance?
You can use OpenSSL to convert a PKCS #7 Certificate to a format recognizable by the Citrix ADC appliance. The procedure is identical to the procedure for PKCS #12 certificates, except that you invoke OpenSSL with different parameters. The steps for converting PKCS #7 certificates are as follows:
Copy the certificate to the appliance by using a secure copy utility, such as SCP.
Convert the certificate (for example, cert.P7B) to PEM format:
openssl pkcs7通知DER——cert.p7b -print_certs -text -out cert.pem
Follow steps 3 through 7 as described in the answer for PKCS #12 certificates. Note: Before loading the converted PKCS #7 certificate to the appliance, verify that it contains a private key, exactly as described in step 3 for the PKCS #12 procedure. PKCS #7 certificates, particularly the certificates exported from IIS, do not typically contain a private key.
When I bind a cipher to a virtual server or service by using the bind cipher command, I see the error message “Command deprecated.”?
The command for binding a cipher to a virtual server or service has changed.
Use thebind ssl vserver
command to bind an SSL cipher to an SSL virtual server.
Use thebind ssl service
command to bind an SSL cipher to an SSL service.
Note:New ciphers and cipher groups are added to the existing list and not replaced.
Why can’t I create a cipher group and bind ciphers to it by using the add cipher command?
添加密码命令的功能改变了我n release 10. The command only creates a cipher group. To add ciphers to the group, use the bind cipher command.
OpenSSL
How do I use OpenSSL to convert certificates between PEM and DER?
To use OpenSSL, you must have a working installation of the OpenSSL software and be able to run OpenSSL from the command line.
x509 certificates and RSA keys can be stored in several different formats.
Two common formats are:
- DER (a binary format used primarily by Java and Macintosh platforms)
- PEM (a base64 representation of DER with header and footer information, which is used primarily by UNIX and Linux platforms).
A key and the corresponding certificate, in addition to the root and any intermediate certificates, can also be stored in a single PKCS#12 (.P12, .PFX) file.
Procedure
Use theOpenSSLcommand to convert between formats as follows:
To convert a certificate from PEM to DER:
x509 -in input.crt -inform PEM -out output.crt -outform DER
To convert a certificate from DER to PEM:
x509 -in input.crt -inform DER -out output.crt -outform PEM
To convert a key from PEM to DER:
rsa -in input.key -inform PEM -out output.key -outform DER
To convert a key from DER to PEM:
rsa -in input.key -inform DER -out output.key -outform PEM
Note:如果你进口的关键是加密的upported symmetric cipher, you are prompted to enter the pass-phrase.
Note:To convert a key to or from the obsolete NET (Netscape server) format, substitute NET for PEM or DER as appropriate. The stored key is encrypted in a weak unsalted RC4 symmetric cipher, so a pass-phrase is requested. A blank pass-phrase is acceptable.
年代ystem Limits
What are the important numbers to remember?
Create Certificate Request:
- 请求文件名称:最大63个字符
- Key File Name: Maximum 63 characters
- PEM Passphrase (For Encrypted Key): Maximum 31 characters
- Common Name: Maximum 63 characters
- City: Maximum 127 characters
- Organization Name: Maximum 63 characters
- 年代tate/Province Name: Maximum 63 characters
- Email Address: Maximum 39 Characters
- Organization Unit: Maximum 63 characters
- Challenge Password: Maximum 20 characters
- Company Name: Maximum 127 characters
Create Certificate:
- Certificate File Name: Maximum 63 characters
- Certificate Request File Name: Maximum 63 characters
- Key File Name: Maximum 63 characters
- PEM Passphrase: Maximum 31 characters
- Validity Period: Maximum 3650 days
- CA Certificate File Name: Maximum 63 characters
- CA Key File Name: Maximum 63 characters
- PEM Passphrase: Maximum 31 characters
- CA Serial Number File: Maximum 63 characters
Create and Install a Server Test Certificate:
- Certificate File Name: Maximum 31 characters
- Fully Qualified Domain Name: Maximum 63 characters
- Create Diffie-Hellman (DH) key:
- DH File Name (with path): Maximum 63 characters
- DH Parameter Size: Maximum 2048 bits
Import PKCS12 key:
- Output File Name: Maximum 63 characters
- PKCS12 File Name: Maximum 63 characters
- Import Password: Maximum 31 characters
- PEM Passphrase: Maximum 31 characters
- Verify PEM Passphrase: Maximum 31 characters
- Export PKCS12
- PKCS12 File Name: Maximum 63 characters
- Certificate File Name: Maximum 63 characters
- Key File Name: Maximum 63 characters
- Export Password: Maximum 31 characters
- PEM Passphrase: Maximum 31 characters
- CRL Management:
- CA Certificate File Name: Maximum 63 characters
- CA Key File Name: Maximum 63 characters
- CA Key File Password: Maximum 31 characters
- Index File Name: Maximum 63 characters
- Certificate File Name: Maximum 63 characters
- Create RSA Key:
- Key File Name: Maximum 63 characters
- Key Size: Maximum 4096 bits
- PEM Passphrase: Maximum 31 characters
- Verify Passphrase: Maximum 31 characters
- Change advanced SSL settings:
- Maximum CRL memory size: Maximum 1024 Mbytes
- Encryption trigger timeout (10 mS ticks): Maximum 200
- Encryption trigger packet count: Maximum 50
- OCSP cache size: Maximum 512 Mbytes
- Install Certificate:
- Certificate-Key pair Name: Maximum 31 characters
- Certificate File Name: Maximum 63 characters
- Private Key File Name: Maximum 63 characters
- Password: Maximum 31 characters
- Notification Period: Maximum 100
- Create Cipher Group:
- Cipher Group Name: Maximum 39 characters
- Create CRL:
- CRL Name: Maximum 31 characters
- CRL File: Maximum 63 characters
- URL: Maximum 127 characters
- Base DN: Maximum 127 characters
- Bind DN: Maximum 127 characters
- Password: Maximum 31 characters
- Days: Maximum 31
- Create SSL Policy:
- Name: Maximum 127 characters
- Create SSL Action:
- Name: Maximum 127 characters
- Create OCSP Responder:
- Name: Maximum 32 characters
- URL: Maximum 128 characters
- Batching Depth: Maximum 8
- Batching Delay: Maximum 10000
- Produced At Time Skew: Maximum 86400
- Request Time-out: Maximum120000
- Create Virtual Server:
- Name: Maximum 127 characters
- Redirect URL: Maximum 127 characters
- Client Time-out: Maximum 31536000 secs
- Create Service:
- Name: Maximum 127 characters
- Idle Time-out (secs): Client: Maximum 31536000 Server: Maximum 31536000
- Create Service Group:
- 年代ervice Group Name: Maximum 127 characters
- 年代erver ID: Maximum 4294967295
- Idle Time-out (secs): Client: Maximum value 31536000 Server: Maximum 31536000
- Create Monitor:
- Name: Maximum 31 characters
- Create Server:
- 年代erver Name: Maximum 127 characters
- Domain Name: Maximum 255 characters
- Resolve Retry: Maximum 20939 secs