The Brocade ADX offers 2 ways to configure SSL. These are,

• SSL - Allows for SSL termination at the loadbalancer so that unencrypted traffic can be sent onto the backend servers. This is also known as client side encryption/decryption.
• SSL Proxy - Allows for the Brocade ADX to decrypt and then re-encrypt the traffic prior to sending it onto the backend servers.

Self Signed

In order to create a self signed certificate (on the Brocade ADX) the following syntax is used:

ssl genrsa filename.key 2048 password
ssl gencert certkey.key signkey key.key password filename.crt

ssl profile <profile-name>
  allow-self-signed-cert

CSR

The benefit of generating a Certificate Signing Request is that the private key never leaves the LoadBalancer.

Prior to creating a CSR a key pair is created, i.e a public and a private key. Once the CSR is generated, the CSR is created using a base-64 encoded PEM format. This CSR includes the various details previously entered DN, email etc and is then sent to the CA for signing.

How is it Signed ?

The CA takes an md5 of the certificate. This hash is then encrypted using the CA`s private key.

Create Key Pair / CSR

ssl genrsa filename.key 2048 password
ssl gencsr filename.key

Transfer Certificate

Copy and paste the public certificate into a text file. This is then sent to the CA.

Transferring Certificate / Keys

The following steps show the commands required for copying certificate/keys to the Brocade ADX using scp.

Note : Any intermediate certificates should be appended to the public certificate before it is transferred to the ADX.

ip dns domain-name [domain name]
crypto key generate dsa
ip ssh
ip ssh scp enable

scp file.key admin@[adx ip address]:sslkeypair:filename.key:password:pem
scp file.cert admin@[adx ip address]:sslcert:filename.cert:pem

SSL Profiles

In order to terminate SSL on a virtual server a SSL profile is created and assigned to the necessary Virtual Server.

ssl profile <profile name>
  keypair-file <private-key>.key
  certificate-file <cert-file>.cer
  cipher-suite all-cipher-suites
  session-cache server
  enable-certificate-chaining

server virtual vi1 [ip]
  port default disable
  port ssl
  port ssl tcp-only
  port ssl ssl-terminate <profile name>
  bind ssl rs1 http rs2 http

Show Commands

• show ssl key *
• show ssl cert *
• ssl clear cert xxx.cert
• ssl clear key xxx.cert