Your browser does not support HTML5 local storage or you have disabled it. Some functionality on this site, including saving your privacy settings and offering you special discounts, uses local storage and may not work with local storage disabled. We recommend allowing the use of local storage in your browser. In some browsers, it is the same setting used for disabling cookies.

SSH Tectia

Certificate Enrollment Using ssh-cmpclient-g3

Certificates can be enrolled using the ssh-cmpclient-g3 command-line tool (ssh-cmpclient-g3.exe on Windows).

To configure SSH Tectia Server to authenticate itself using X.509 certificates, perform the following tasks:

  1. Enroll a certificate for the server.

    This can be done with the ssh-cmpclient-g3 command-line tool, for example:

    $ ssh-cmpclient-g3 INITIALIZE \ 
      -P generate://ssh2@rsa:1024/hostcert_rsa \
      -o /etc/ssh2/hostcert_rsa \
      -p 62154:ssh \
      -s "C=FI,O=SSH,CN=testserv;dns=testserv.ssh.com" \
      http://pki.ssh.com:8080/pkix/ \
      'C=FI, O=SSH Communications Security Corp, CN=Secure Shell Test CA'
    

    Note that the DNS address parameter (dns) needs to correspond to the fully qualified domain name of the server.

    Remember to define also the SOCKS server (-S) before the CA URL, if required.

    For more information on the ssh-cmpclient-g3 syntax, see ssh-cmpclient-g3(1).

  2. Define the private key and the server certificate in the ssh-server-config.xml file:

    <params>
      <hostkey>      
        <private file="/etc/ssh2/hostcert_rsa" />
        <x509-certificate file="/etc/ssh2/hostcert_rsa.crt" />
      </hostkey>
    ...
    </params>
    

    Alternatively, when using the SSH Tectia Server Configuration tool, enter the private key and certificate filenames on the Identity page. See Identity.

  3. Run ssh-server-config-tool to take the new configuration in use. See ssh-server-config-tool(8).

    On Windows, just click Apply to take the new settings in use.

===AUTO_SCHEMA_MARKUP===