CCNP Security SISAS 300-208 Official Cert Guide (2015)

---

Step 3. Click Next from the Welcome screen, as shown in Figure C-4.

Figure C-4 The Dogtag certificate system Welcome screen.

Step 4. Create a new security domain. Name that security domain ISE BYOD Domain and click Next, as shown in Figure C-5.

Figure C-5 Create the security domain.

Step 5. Name the subsystem Certificate Authority and click Next, as shown in Figure C-6.

Figure C-6 The subsystem name is Certificate Authority.

Step 6. Select Make This a Self-Signed Root CA Within This New PKI Hierarchy, as shown in Figure C-7.

Figure C-7 Make this a self-signed root CA.

Of course, this could become a subordinate CA of an existing CA. However, that is not the focus of this appendix.

Step 7. The internal database is the Directory Server (ds389) that we installed earlier. All the settings should be filled in correctly, as shown in Figure C-8. Add the Directory Manager password created earlier in Example C-12.

Figure C-8 Add the directory manager password.

Step 8. Generate the key pairs. The default of RSA with SHA256 and a key size of 2048 bits will work fine. Click Next, as shown in Figure C-9. As always, please reference your corporate security policy to ensure that these values are sufficient.

Figure C-9 Generate the key pairs.

Step 9. The certificate subject names can be left at their default values, as shown in Figure C-10. Click Next.

Figure C-10 Default subject names.

Step 10. If an action is needed, it will appear in red. If no actions are required, click Next, as shown in Figure C-11.

Figure C-11 Required actions will be in red.

Step 11. Provide a password and export the CA’s key pair, as shown in Figure C-12. Store the key pair in a secure location. If you must restore this CA from a backup, this key pair will be required. Furthermore, compromise of this key pair would be equivalent to a compromise of this entire PKI infrastructure. Protect this key pair with the utmost care.

Figure C-12 Export and securely store the key pairs.

Step 12. The new root CA certificate will be imported into your browser or your system certificate store. You can select for which purposes the certificate should be trusted, as shown in Figure C-13.

Figure C-13 Trust the certificate.

Step 13. Create an administrative certificate to identify you (the administrator) to the CA for administrative purposes, as shown in Figure C-14.

Figure C-14 Administrator certificate.

Step 14. You must now install that certificate into your browser, as shown in Figure C-15, so your browser will identify you when connecting to the CA. Be sure you back up and store this key in a secure location because you will not be able to administer the CA without this certificate.

Figure C-15 Import the administrator certificate.

Step 15. You are finished with the GUI-based configuration, as shown in Figure C-16.

Figure C-16 Done.