Brocade Communications Systems ServerIron ADX 12.4.00a - Manual (Page 179)

ServerIron ADX Security Guide 165
53-1002440-03
Basic SSL profile configuration
6
Specifying a keypair file
Each SSL profile must be associated with an RSA key-pair file that was previously defined using the
genrsa command. The following example uses the keypair-file command to associate the key pair
file named "rsakey" with the "profile1" SSL profile.
ServerIronADX(config)# ssl profile profile1
ServerIronADX(config-ssl-profile-profile1)# keypair-file rsakey
Syntax: keypair-file <keypair-file-name>
The <keypair-file-name> variable is an ASCII string a keypair file that was generated using the
genrsa command.
Specifying a cipher suite
By specifying cipher suites under an SSL profile, you can control the security strength of the SSL
handshakes. The ServerIronADX can accept a new SSL handshake from the client only if the list of
cipher suites presented by the client includes a cipher suite configured under the SSL profile.
The following example specifies that all cipher suites are configured under the "profile1" SSL
profile.
ServerIronADX(config)# ssl profile profile1
ServerIronADX(config-ssl-profile-profile1)# cipher-suite all-cipher-profiles
Syntax: cipher-suite rsa-export-with-des40-cbc-sha | rsa-export-with-rc4-40-md5 |
rsa-with-3des-ede-cbc-sha | rsa-with-aes-128-sha | rsa-with-aes-256-sha |
rsa-with-des-cbc-sha | rsa-with-rc4-128-md5 | rsa-with-rc4-128-sha | all-cipher-suites
Use the rsa-export-with-des40-cbc-sha parameter to specify that cipher suite.
Use the rsa-export-with-rc4-40-md5 parameter to specify that cipher suite.
Use the rsa-with-3des-ede-cbc-sha parameter to specify that cipher suite.
Use the rsa-with-aes-128-sha parameter to specify that cipher suite.
Use the rsa-with-aes-256-sha parameter to specify that cipher suite.
Use the rsa-with-des-cbc-sha parameter to specify that cipher suite.
Use the rsa-with-rc4-128-md5 parameter to specify that cipher suite.
Use the rsa-with-rc4-128-sha parameter to specify that cipher suite.
Use the all-cipher-suites parameter to specify all cipher suites including the other parameters used
in this command.
NOTE
The export cipher suites work only if the asymmetric key pair strength is less than or equal to 512
bits. This is consistent with the export rules. If the RSA key pair strength is greater than 512 bits,
then SSL handshake requests that contain export cipher suites do not work.
Configuring Multiple Cipher Suites
Among the cipher suite options, is one that specifies all cipher suites. You can also specify more
than one cipher inside an SSL profile without specifying all options. This is shown in the following
example.