DO NOT SHARE THESE DOCS WITH CUSTOMERS!

This is an LA release that will only be provided to a select number of PLM-sanctioned customers (PDFs only). Contact PLM for details.

In this section:

Related articles:


This topic explains how to generate and install RSA key pairs and generate Certificate Signing Request (CSR) on the SBC Core systems. The certificate request is then sent to a CA, and the issued certificate is then installed on the SBC. This feature simplifies the certificates and keys managing process, and also provides more security than previous methods since the private key never leaves the SBC system. For feature description, see Certificate Management.

Note

During this procedure, the CSR contents display in an alert message. The simplest method to copy this data is to use the mouse to click-and-drag the contents, and then copy-paste elsewhere. Ribbon recommends using Firefox Web browser to perform this procedure since it supports this simple copy-paste method.


Note

The SBC supports a maximum of 4,096 TLS certificates/CAs (both local and remote).

The SBC allows importing of a single certificate in a single file only. If a CA provides a .p12 or a .pfx certificate bundle with multiple CA certificates in it, extract the certificates from the bundle, store them in separate files, and import them separately.

Generate RSA Key Pairs and CSRs Using EMA

  1. Login to EMA GUI.

  2. Create a configuration object to hold a locally generated RSA key pair.

    1. On the main screen, go to one of the following locations:

      • All > System > Security > PKI > Certificate

      • Configuration > Security Configuration > PKI > Certificate
        The Certificate screen is displayed.
        Figure 1: Certificate Screen


    2. Click New Certificate.
      Figure 2: New Certificate Button


    3. The following fields are displayed:

      Parameter

      Description

      Name

      Specifies the name of the certificate.

      State

      Leave as Disabled (default value).

      File Name

       NA

      Pass Phrase NA
      TypeFrom the drop-down list select local-internal.
    4. Click Save to save the changes. The new Certificate is displayed at the bottom of the original Certificate in the Certificate List panel.

  3. Generate Key pair and CSR (certificate signing request) for submission to a Certificate Authority (CA):

    1. Select newly-created certificate from the list. The Certificate screen refreshes with the newly-created certificate object, and now displays the Edit Selected Certificate and Certification Commands options in the lower pane.
      Figure 3: Edit Selected Certificate




    2. Select Generate CSR option from the Certificate Commands drop-down menu, and click Select. The SBC Generate CSR Command dialog is displayed.
      Figure 4: SBC generateCSR Command Dialog



    3. The following are the Certificate parameters:


      Parameter

      Description

      key Size 

      The size in bits of the key pair to generate the private key.

      • keySize1k – 1024 bits

      • keySize2k – 2048 bits

      • keySize4k (default) – 4096 bits
      • keySizeEcDsaSecp521r1 - Generates public and private keys for the Elliptic Curve DSA (Digital Signature Algorithm) certificate. The parameter keySizeEcDsaSecp521r1 maps to elliptic curve parameter named secp521r1 - NIST/SECG curve over a 521-bit prime field.


      Note

      Ribbon recommends using the 4096 bit key size wherever possible since it provides greater security strength.

      Csr Subscription

      <csr subject name> The name of the CSR subject using the following format.

      Note

      At least one of the following keys must be specified in the csr subject name.

      /C=<xx>/ST=<xx>/L=<string>/O=<string>/CN=<string>

      Where:

      • C = 2-digit country abbreviation
      • ST = 2-digit state or province abbreviation
      • L = Locality name
      • O = Organization name
      • CN = Common Name

      Example:

      /C=US/ST=MA/L=Westford/O=Ribbon Inc./CN=www.mydomain.com

      Subject Alternative Dns Name

      Specifies the names of the alternative DNS subjects. Multiple alternative names can be specified using "," (comma) as a separator.

      For example:

      (Max: 4096 characters)

      "nj.mydomain.com, in.mydomain.com, uk.mydomain.com, ca.mydomain.com, tx.mydomain.com"

      Note

      This field is available from 4.0.2 release.

    4. Make the required changes to the required fields and click generateCSR. The CSR displays in an alert message similar to below:
      Figure 5: CSR Example


  4. Copy-paste CSR content. Two methods are described below:

    1. Firefox: Click-and-drag your mouse pointer to highlight the text, then do a Ctrl+C, Ctrl+V to copy and paste contents elsewhere.

    2. Internet Explorer: Click the alert message, and then perform a Ctrl-A to select it, a Ctrl-C to copy contents, and a Ctrl-V to paste contents elsewhere.

      Note

      Using IE method may result in copying additional web page data unrelated to CSR content within the CSR header and footer. If this occurs, be sure to remove the irrelevant content.

  5. Contact CA to request a certificate using the generated CSR results.

See CSR Subject Field Syntax for descriptions of the fields.

Generate RSA Key Pairs and CSRs Using CLI

  1. Login to the SBC CLI, and switch to Configure mode.

  2. Create a configuration object to hold a locally generated RSA key pair:

    % set system security pki certificate <certName> type local-internal
  3. Generate Key pair and CSR for submission to a Certificate Authority (CA):

    % request system security pki certificate <certName created from step 2> generateCSR csrSub <csrSub> keySize <keySize>
  4. Contact CA to request certificate using the generated CSR.

  5. Once CA issues the certificate, place the certificate in SBC at /opt/sonus/external/<PEM_filename> and install the certificate using the command:

    % set system security pki certificate <certName> filename <PEM_filename> state enabled

Import Certificate Using EMA

Use one of the following methods to import certificate:


Use importCert Command:

  1. On the main screen, go to one of the following locations:

    • All > System > Security > PKI > Certificate

    • Configuration > Security Configuration > PKI > Certificate
      Figure 6: Certificate Screen


  2. Click the radio button next to the specific Certificate which you want to import.
    Figure 7: Edit Selected Certificate


  3. Select importCert from Certificate Commands drop-down menu, and click Select. The SBC importCert Command pop-up dialog is displayed.
    Figure 8: Import Cert Command Dialog




  4. Copy and paste the returned certificate content from the CA to the Cert Content field.

  5. Click importCert to import the certificate content to the SBC.


Copy certificate to /opt/sonus/external:

  1. Once CA issues the certificate, place the certificate in the SBC directory: /opt/sonus/external/<PEM_filename>

  2. On the main screen, go to one of the following locations:

    • All > System > Security > PKI > Certificate

    • Configuration > Security Configuration > PKI > Certificate
      Figure 9: Certificate Screen


  3. Click the radio button next to the specific Certificate which you want to copy.
    Figure 10: Edit Selected Certificate


  4. From the Edit Selected Certificate screen, click File Name field and enter the PEM filename.
  5. Set State to Enabled and click Save.

Info

For command details, see following pages: