Description

This article provides information on generating and installing the SSL certificate to be used for Secure Web Access for Juniper Networks EX Series switches.

HTTPS is the most secure manner of accessing an interface through web management. To access the EX-Series switches through HTTPS, the first step is to install an SSL certificate. There are several ways to achieve this:
 

  • Generate a custom self-signed certificate on the switch. ( KB21718 [juniper.net] )
  • Generate a local certificate on the switch. ( system-generated-certificate )
  • Inserting an SSL certificate generated by OpenSSL on a BSD or Linux system.
  • Inserting a trusted CA certificate by different means.

Note: The first three methods allow you to access J-web through HTTPS. However, as a Certificate authority (CA) does not sign these, they will not offer additional security features and you may get an " Invalid certificate " alarm in some browsers. For more information see: Generating Self-Signed Digital Certificates.

Symptoms

You want to access the EX-Series switches through HTTPS.

Solution

Procedure to generate and install a Linux or BSD SSL certificate on an EX-Series Switches:

  1. Generate an SSL certificate from the Unix server (BSD or Linux or others).

    The following OpenSSL command generates a self-signed SSL certificate in the privacy-enhanced mail (PEM) format. It writes the certificate and an unencrypted 2048-bit RSA private key to the specified file. (In this example, the Unix server created a certificate file named test_Cert.pem).

    root@ubuntu:~# openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout Test_Cert.pem -out Test_Cert.pem

  2. When prompted, type the appropriate information in the identification form. For example, type US for the country name.

  3. Check if the file named test_Cert, pem has been created.

    root@ubuntu:~#$ ls -l test_Cert.pem

    -rw-r--r-- 1 ***** support 2132 Dec 30 21:10 test_Cert.pem

  4. Make sure that this file has the following two sections:

    -----BEGIN RSA PRIVATE KEY-----
    -----END RSA PRIVATE KEY-----
    .and.
    -----BEGIN CERTIFICATE-----
    -----END CERTIFICATE-----

  5. Copy the PEM format self-signed certificate to the target Switch (In this example, it has been is copied to /var/tmp directory of the switch).

    root@switch> file list /var/tmp detail 
    /var/tmp/:
total blocks: 4276224
-rw-r--r--  1 user  group       1362 Oct 16 11:11 trace_debug
-rw-r--r--  1 user  group        108 Aug 9   2016 package.log
-rw-r--r-- 1 juniper wheel      2132 Dec 30 18:51 test_Cert.pem

    root@switch% exit

  6. Create the local X.509 certificate name (In this sample it is cert_01):

    root@switch# set security certificates local cert_01 load-key-file /var/tmp/test_Cert.pem

  7. Enable the HTTPS service with the local certificate named cert_01 on port 443 (default port).

    rppt@switch# set system services web-management https local-certificate cert_01 interface me0.0 port 443

  8. Commit and check the HTTPS under web-management:

    root@switch# run show configuration system services
    web-management {
        https {
            port 443;
            local-certificate cert_01;
            interface me0.0;
                          }
                }
     

  9. Now you can access J-Web by typing the corresponding link on your browser: https://ip_address_of_me0.0 .

Note: All certificates must be in Privacy-Enhanced Mail (PEM) format.
Note: To add certificates via J-Web, refer to KB19595 [juniper.net]

Modification History

2020-03-13: Updated command in step 5 of the solution.
2020-02-18: Added links to related KB and technical documentation as well as clarification notes other minor shape changes.
2022-10-11: Corrected openssl command and increased security to use sha256 and rsa 2048.
2023-09-15: Added certificate format required.

Related Information