Creating a New Server Certificate (CLI)

To create a new server certificate, use the following steps.

1. To create a new CSR, enter the configuration settings certificates system context, and enter the create command.

   Or to create a new CSR based on existing CSR or certificate, enter the above context and then the command clone CSR or certificate number. For example:

   hostname:configuration settings certificates system> clone cert-000

2. To complete the CSR form, use the following CLI commands.

   hostname:configuration settings certificates system (uncommitted)> get
                    subject_commonname = hostname.us.example.com
              subject_organizationname = (unset)
        subject_organizationalunitname = (unset)
                  subject_localityname = (unset)
           subject_stateorprovincename = (unset)
                   subject_countryname = (unset)
                  subject_emailaddress = (unset)
                                   dns = hostname.us.example.com
                                    ip = 192.0.2.1
                                   uri = (unset)
                               comment = (unset)
   hostname:configuration settings certificates system (uncommitted)> set comment="test certificate"
                               comment = test certificate (uncommitted)
   hostname:configuration settings certificates system (uncommitted)> commit

3. To view the CSR, use following commands.

   hostname:configuration settings certificates system> show
   Properties:
                   default = auto
   System Certificates:
   CERT     TYPE SUBJECT                   ISSUER                    EXPIRES   
   cert-000 req  hostname.us.example.com     
   cert-001 CA   Joe Test CA              Joe Test CA               2038-1-19
   cert-002 cert hostname.us.example.com  Joe Test CA               2038-1-21

   hostname:configuration settings certificates system> dump cert-000
   -----BEGIN CERTIFICATE REQUEST-----
   MIICwzCCAasCAQIwIjEgMB4GA1UEAxMXaG9zdG5hbWUudXMuZXhhbXBsZS5jb20w
      ...
   lhwblMXqR/3xptwym1vy5dYBJsQLKroA8nr/xFb3nhJB8nI+dxSN
   -----END CERTIFICATE REQUEST-----

4. Copy the CSR and transfer it to your CA in the prescribed manner.
5. After receiving the signed certificate from the CA, enter the configuration settings certificates system context, and enter the import command.

   hostname:configuration settings certificates system> import
   ("." to end)> -----BEGIN CERTIFICATE-----
   ("." to end)> MIID0DCCArigAwIBAgIBQDANBgkqhkiG9w0BAQUFADCBmDELMAkGA1UEBhMCVVMx
     …
   
   ("." to end)> 2ai9ZwREdTkcjcgQDxeHNZCpcHk=
   ("." to end)> -----END CERTIFICATE-----
   ("." to end)> .

6. To check the imported certificates, view all certificate entries using the command show.

   hostname:configuration settings certificates system> show
   Properties:
                   default = auto
   System Certificates:
   CERT     TYPE SUBJECT                   ISSUER                    EXPIRES   
   cert-000 req  hostname.us.example.com     
   cert-001 CA   Joe Test CA              Joe Test CA               2038-1-19
   cert-002 cert hostname.us.example.com  Joe Test CA               2038-1-21