SSH.COM is one of the most trusted brands in cyber security. We help enterprises and agencies solve the security challenges of digital transformation with innovative access management solutions.
Certificates can be enrolled using the
command-line tool (
ssh-cmpclient-g3.exe on Windows).
To configure Tectia Server to authenticate itself using X.509 certificates, perform the following tasks:
Enroll a certificate for the server.
This can be done with the
tool, for example:
$ ssh-cmpclient-g3 INITIALIZE \ -P generate://ssh2@rsa:1024/hostcert_rsa \ -o /etc/ssh2/hostcert_rsa \ -p 62154:ssh \ -s "C=FI,O=SSH,CN=testserv;dns=testserv.ssh.com" \ http://pki.ssh.com:8080/pkix/ \ 'C=FI, O=Tectia Corporation, CN=Secure Shell Test CA'
Note that the DNS address parameter (
dns) needs to correspond
to the fully qualified domain name of the server.
Remember to define also the SOCKS server (
-S) before the CA
URL, if required.
For more information on the
ssh-cmpclient-g3 syntax, see
Define the private key and the server certificate in the
<params> <hostkey> <private file="/etc/ssh2/hostcert_rsa" /> <x509-certificate file="/etc/ssh2/hostcert_rsa.crt" /> </hostkey> ... </params>
Alternatively, when using the Tectia Server Configuration tool, enter the private key and certificate filenames on the Identity page. See Identity.
ssh-server-ctl to take the new
configuration in use. See ssh-server-ctl(8).
On Windows, just click Apply to take the new settings in use.