SSH.COM is one of the most trusted brands in cyber security. We help enterprises and agencies solve the security challenges of digital transformation with innovative access management solutions.
Certificates can be enrolled using the
command-line tool (
ssh-cmpclient-g3.exe on Windows).
To configure SSH Tectia Server to authenticate itself using X.509 certificates, perform the following tasks:
Enroll a certificate for the server.
This can be done with the
tool, for example:
$ ssh-cmpclient-g3 INITIALIZE \ -P generate://ssh2@rsa:1024/hostcert_rsa \ -o /etc/ssh2/hostcert_rsa \ -p 62154:ssh \ -s "C=FI,O=SSH,CN=testserv;dns=testserv.ssh.com" \ http://pki.ssh.com:8080/pkix/ \ 'C=FI, O=SSH Communications Security Corp, CN=Secure Shell Test CA'
Note that the DNS address parameter (
dns) needs to correspond
to the fully qualified domain name of the server.
Remember to define also the SOCKS server (
-S) before the CA
URL, if required.
For more information on the
ssh-cmpclient-g3 syntax, see
Define the private key and the server certificate in the
<params> <hostkey> <private file="/etc/ssh2/hostcert_rsa" /> <x509-certificate file="/etc/ssh2/hostcert_rsa.crt" /> </hostkey> ... </params>
Alternatively, on Windows when using the SSH Tectia Server Configuration tool, enter the private key and certificate filenames on the Identity page. See Identity.
ssh-server-config-tool to take the new
configuration in use. See ssh-server-config-tool(8).
On Windows, click Apply to take the new settings in use.