Black Box LES1608A - Prepare a USB Drive and Create the X.509 Certificate and Private Key; What an Unconfigured Console Server Does on First Boot

59
1. 8 7 7. 8 7 7. 2 26 9 BLACKBOX.COM
NEED HELP?
LEAVE THE TECH TO US
LIVE 24/7
TECHNICAL
SUPPORT
1.877.87 7.2269
CHAPTER 4: SYSTEM CONFIGURATION
4.7.4 PREPARE A USB DRIVE AND CREATE THE X.509 CERTIFICATE AND PRIVATE KEY
 Generate the CA certificate so the client and server Certificate Signing Requests (CSRs) can be signed.
# cp /etc/ssl/openssl.cnf .
# mkdir -p exampleCA/newcerts
# echo 00 > exampleCA/serial
# echo 00 > exampleCA/crlnumber
# touch exampleCA/index.txt
# openssl genrsa -out ca.key 8192
# openssl req -new -x509 -days 3650 -key ca.key -out demoCA/
\cacert.pem -subj /CN=ExampleCA
# cp demoCA/cacert.pem ca-bundle.crt
NOTE: This procedure generates a certificate called ExampleCA but any allowed certificate name can be used. Also, this procedure
uses openssl ca. If your organization has an enterprise-wide, secure CA generation process, that should be used instead.
 Generate the client certificate.
# openssl genrsa -out client.key 4096
# openssl req -new -key client.key -out client.csr -subj \
/CN=ExampleClient
# openssl ca -days 365 -in client.csr -out client.crt \
-keyfile ca.key -policy policy_anything -batch -notext
# cat client.key client.crt > client.pem
 Format a USB flash drive as a single FAT32 volume.
 Move the client.pem and ca-bundle.crt files onto the flash drive’s root directory.
4.7.5 WHAT AN UNCONFIGURED CONSOLE SERVER DOES ON FIRST BOOT
When an unconfigured console server boots the following steps occur:
 the console server starts the udhcpc process (via conman).
 udhcpc transmits a DHCP DISCOVER request to the primary Network Interface.
This request includes a Vendor Class Indentifier in the following form:
Black Box/model-name
For example:
Black Box/LES1203A-M
NOTE: In unconfigured console servers, the network interface mode is unset and the DHCP DISCOVER request, therefore, includes
a parameter request for Vendor-Specific Information (option 43). Configured console servers have a config.interfaces.wan.
mode with configuration information included. Consequently, the DHCP DISCOVER packet sent from such servers does not
include an option 43 request.