Generate a new key-pair from a DOD-approved certificate issuer. Sites must consult the PKI/PKI pages on the https://cyber.mil/ website for procedures for NIPRNet and SIPRNet. RSA: request security pki generate-key-pair certificate-id type rsa size <512 | 1024 | 2048 | 4096> ECDSA: request security pki generate-key-pair certificate-id type ecdsa size <256 | 384> Generate a CSR from RSA key-pair using the following command and options. request security generate-certificate-request certificate-id digest domain email ip-address subject 'CN=,DC=,DC=,O=,OU=, L=,ST=,C=' filename Generate a CSR from ECDSA key-pair use the following command and options. request security generate-certificate-request certificate-id digest domain email ip-address subject 'CN=,DC=,DC=,O=,OU=, L=,ST=,C=' filename If no filename is specified, the CSR is displayed on the standard out (terminal) After receiving the approved certificate from the CA, enter the following command and options to upload the certificate. request security pki local-certificate certificate-id filename From the operational mode of the hierarchy: set security certificates local new load-key-file /var/tmp/new.pem Type the following command to load the X.509 certificate into the certificate store in operations mode. >request security pki local-certificate load certificate-id filename For this example, assume the transferred the X.509 certificate called 'device-cert.crt' to the /var/tmp directory on the SRXD. The following command will load the device-cert.crt certificate file and associate it with the public/private keypair named 'device-keypair' generated in a previous step. >request security pki local-certificate load certificate-id device-keypair filename /var/tmp/device-cert.crt

Detections

Analytics

Item Search