Managing SSL for SecureAdmin

Ways to manage SSL

You can manage the SSL portion of SecureAdmin in the following ways:

Set up and start SSL
Reinitialize SSL
Disable and enable SSL

About the certificate used by SSL

SSL uses a certificate to provide a secure connection between the storage system and a Web browser. SecureAdmin allows two types of certificates:

Self-signed certificate
A certificate generated by Data ONTAP. Self-signed certificates can be used as is, but they are less secure than certificate-authority signed certificates, because the browser has no way of verifying the signer of the certificate. This means the system could be spoofed by an unauthorized server.
Certificate-authority signed certificate
A certificate-authority signed certificate is a self-signed certificate that is sent to a certificate authority to be signed. The advantage of a certificate-authority signed certificate is that it verifies to the browser that the system is the system to which the client intended to connect.

Setting up and starting SSL

To set up SSL, complete the following steps.

Step	Action
1	Enter the following command: secureadmin setup ssl
2	Enter information when Data ONTAP prompts you. Note To use the default settings, press Enter at each of the prompts. Result Data ONTAP generates a self-signed certificate and keys, and places them in the /etc/keymgr directory.
3	Enter `y` if the information is correct or `n` if any of the information is incorrect. Result If you enter `y`, Data ONTAP generates two files and saves them in the /etc/keymgr directory: A self-signed certificate called secureadmin.der A certificate signing request called secureadmin.pem If you enter `n`, Data ONTAP repeats the prompts.
4	If...	Then...
	You want to use a self-signed certificate	You have successfully installed your certificate. Perform the steps described in Testing your certificate to test your certificate.
	You want to use a certificate- authority-signed certificate	Perform the steps in Installing a certificate-authority-signed certificate to install a certificate-authority-signed certificate. Note You can use the self-signed-certificate Data ONTAP has already installed until you can install your certificate-authority-signed certificate.

Installing a certificate-authority-signed certificate

To install a certificate-authority-signed certificate, complete the following steps.

Step	Action
1	Send the certificate signing request, `secureadmin.pem`, to the certificate authority. This file is found in the `/etc/keymgr/cert` directory on the storage system. Note This process might take a few days.
2	Back up the `secureadmin.pem` file by making a copy.
3	When the certificate authority returns the signed certificate, copy the signed certificate into a temporary location on the storage system.
4	Install the certificate by entering the following command: secureadmin addcert ssl directory_path directory_path is the full path to the certificate. Example The following command installs a certificate called secureadmin.pem, currently located in the tempdir directory, into the /etc/keymgr directory: secureadmin addcert ssl /etc/tempdir/secureadmin.pem
5	Disable SSL by entering the following command: `secureadmin disable ssl`
6	Enable SSL by entering the following command: `secureadmin enable ssl`
7	Perform the steps described in Testing your certificate to test your certificate.

Testing your certificate

To verify that your certificate is installed correctly, complete the following steps.

Note
These steps can verify either a self-signed certificate or a certificate-authority-signed certificate.

Step	Action
1	Start your Web browser.
2	Enter the following URL: *https://systemname/na_admin* systemname is the name of your storage system.
3	Click Secure FilerView. Secure FilerView starts up in a new browser window.
4	Check your browser to verify that you have made a secure connection. Note Most browsers show a small padlock icon in their status bar when they have successfully made a secure connection to the server. If the padlock icon is not displayed, you do not have a secure connection, even if you clicked Secure FilerView.

Reason for reinitializing SSL

You should reinitialize SSL if you change the domain name of the storage system, because the domain name recorded in the certificate becomes obsolete. The result is that the connection is still encrypted, but the storage system is not authenticated. The next time you connect to the system, the browser issues a warning that the domain name of the system does not match the record on the certificate.

Note
Changing the domain name for a storage system that is using SSL can cost time and money because you must have the new certificate signed by a certificate authority.

Reinitializing SSL

To reinitialize SSL, complete the following steps.

Step	Description
1	Disable SecureAdmin by entering the following command: secureadmin disable ssl
2	Run setup to reinitialize SSL by following the steps in Setting up and starting SSL.

Step

Description

Disable SecureAdmin by entering the following command:

secureadmin disable ssl

Run setup to reinitialize SSL by following the steps in Setting up and starting SSL.

Disabling or enabling SSL

To disable or enable SSL, complete the following step.

Note
When you disable SSL, you disallow all administrative requests over HTTPS. Enabling SSL allows administrative requests over HTTPS to succeed.

Step	Action
1	Enter the following command: secureadmin {disable\|enable} ssl Use `disable` to disable SSL or use `enable` to restart SSL.