3Com 3CRWX120695A Installation And Basic Configuration Manual

Also see for 3CRWX120695A: User guide User guide Command reference Configuration guide Command reference

Contents

3Com 3CRWX120695A Installation And Basic Configuration Manual Manual pdf 53 page image

Installing a Server Certificate for Network Users 53assigned by a certificate authority (CA). If you use a certificate assigned bya CA, you also need to install the CA’s own certificate for validation.If you use an authentication protocol that uses EAP-TLS on the WXswitch, users also need certificates. (For more information, see theWireless LAN Switch and Controller Configuration Guide.)The command syntax for installing certificates for management by 3WXMor Web Manager and installing certificates for network users is verysimilar. The CLI commands for configuring network user authenticationuse the eap option instead of the admin option, but are otherwise thesame. Likewise, the procedures are the same.Generating aSelf-SignedCertificate forNetwork UsersAs an alternative to using a certificate assigned by a CA, you cangenerate a self-signed certificate on the WX switch. To use a self-signedcertificate, use the following commands:crypto generate key eap {1024 | 2048}crypto generate self-signed eapThe common name is required. The other fields are optional. MSSautomatically installs the key and self-signed certificate into its certificateand key store.Installing a CertificateAssigned by aCertificate Authorityfor Network UsersYou can install a certificate assigned by a CA in one of the followingways:■ Install a PKCS #12 object file—To use this method:■ Install a PKCS #7 object file—To use this method:In either case, you also need to install the CA’s own certificate. The CAcertificate allows users to verify that the switch certificate assigned by theCA is valid.Installing a Certificate for Network Users from a PKCS #12 ObjectFileTo install a public-private key pair and a certificate assigned by a CA in aPKCS #12 object file, use the following commands:copy tftp://ip-addr/source-url [destination-url]crypto otp eap stringcrypto pkcs12 eap filename