Alcatel-Lucent 7450 - Page 37

IP Router Configuration
Router Configuration Guide 37
1. Save the RSA key pair used for SeND.
2. Save the modifiers used during the CGA generation.
To make the CGAs persistent:
1. Import an online or offline generated RSA key pair for SeND.
2. Make sure that the CompactFlash (CF) file(s) containing an RSA key pair that is used
for SeND, is (are) synchronized to the standby CPM by making use of the HA
infrastructure used for certificates.
3. Make sure the configuration file is saved when one or more CGAs are generated.
Persistent RSA Key Pair
The RSA key pair is stored in a file on the CF.
Generate an RSA Key Pair
To generate an RSA key pair, use the admin certificate gen-keypair command:
admin certificate gen-keypair local-url [type rsa] size 1024
For example
admin certificate gen-keypair cf1:\myDir\myRsaKeyPair type rsa size 1024
This generates a der formatted file.
Import an online/offline generated RSA key pair
To import a generated RSA key pair, use the admin certificate secure-nd-import command:
admin certificate secure-nd-import local-url format {der | pem | pkcs12} [password
<password>] [key-rollover]
For example
admin certificate secure-nd-import cf1:\myDir\myRsaKeyPair format der
• Since SeND only uses RSA key pairs, the command is refused if the imported key
type is not RSA.
• Since SeND only supports key size 1024, the command is refused if the imported key
size is not 1024.
• The password has to be specified when an offline generated file in pkcs12 format has
to be imported.