ZyXEL Communications ZyWALL 310 - 58.4 Certificates Commands Summary

Chapter 58 Certificates
ZyWALL Series CLI Reference Guide
496
58.4 Certificates Commands Summary
The following table lists the commands that you can use to display and manage the Zyxel Device’s
summary list of certificates and certification requests. You can also create certificates or certification
requests. Use the
configure terminal command to enter the configuration mode to be able to use
these commands.
user_definition
Not used at the time of writing.
extend_key
Add extended use cases for the certificate.
• client: The Zyxel Device generates and stores a request for a client authentication
certificate.
• ike: The Zyxel Device generates and stores a request for an IKE Intermediate
authentication certificate.
• svr: The Zyxel Device generates and stores a request for a server authentication
certificate.
• client-ike, svr-client, svr-ike, svr-client-ike: Enable a combination of client, ike, and
svr settings. For example, client-ike generates and stores a request for a client
authentication certificate and also an IKE Intermediate authentication certificate.
lifetimes
Sets how long the certificate is valid, in years. The value must be between 2 and 10.
Note: Software such as web browsers might not trust a certificate that has a
long lifetime.
Table 282 Certificates Commands Input Values (continued)
LABEL DESCRIPTION
Table 283 ca Commands Summary
COMMAND DESCRIPTION
ca generate pkcs10 name certificate_name cn-
type {ip cn cn_ipv4_address | ipv6 cn
cn_ipv6_address |fqdn cn cn_domain_name | mail
cn cn_email} [ou organizational_unit] [o
organization] [l town] [s state] [c country]
[usr-def user_definition] key-type {dsa | dsa-
sha256 | ecdsa | ecdsa-sha256 | ecdsa-sha384 |
rsa | rsa-sha256 | rsa-sha512} key-len
key_length [extend-key extend_key] year
lifetimes
Generates a PKCS#10 certification signing
request (CSR).
ca generate pkcs12 name name password password
Encrypts the named certificate using the
specified password. This CLI command is for
debugging purposes only; it is not possible to
download the resulting file.
To encrypt a certificate and download the
resulting CRT file, use the Web Configurator.
ca generate x509 name certificate_name cn-type
{ip cn ipv4 | ipv6 cn cn_ipv6_address | fqdn cn
cn_domain_name | mail cn cn_email} [ou
organizational_unit] [o organization] [l town]
[s state] [c country] [usr-def user_definition]
key-type {dsa | dsa-sha256 | ecdsa | ecdsa-
sha256 | ecdsa-sha384 | rsa | rsa-sha256 | rsa-
sha512} key-len key_length
Generates a self-signed x509 certificate.