How to Generate a CSR on Radware Alteon (WBM and CLI)

This guide shows you how to generate a CSR (Certificate Signing Request) on a Radware Alteon application delivery controller, using either the Web Based Management (WBM) console or the command-line interface (CLI). When Alteon builds the request, it also creates the matching private key inside the device’s certificate repository. That key never leaves the appliance with the CSR, so you import the signed certificate back onto the same Alteon under the same ID. The menu paths below are consistent across the current AlteonOS 3x releases.

Generate the CSR on Alteon

If you have already generated your CSR and received the signed files from the Certificate Authority, skip this section and go straight to how to install an SSL certificate on Alteon. Otherwise, follow either method below. Both produce the same result, so use whichever interface you are comfortable with.

Before you start, have your certificate subject details ready, because a public CA validates them: the exact fully qualified domain name (FQDN) you want to secure, your organization’s full legal name, and the city, state or province, and two-letter country code where it is registered.

Generate a CSR in the web console (WBM)

Step 1: Open the Certificate Repository. Log in to Alteon’s Web Based Management console and go to Configuration > Application Delivery > SSL > Certificate Repository. If you manage the device through Radware APSolute Vision, the same screen is available there for the selected Alteon.

Step 2: Add a certificate entry. Click the + (Add) button, give the entry a unique ID (for example, your domain name), and submit. The repository now shows rows for the Key, the Request (CSR), and the Certificate, each with a status of Not Generated.

Step 3: Generate the request and key. Select the Request (CSR) entry and click Generate. Alteon opens a form for the subject details and the cryptographic settings. Fill it in as follows:

• Common Name: the exact FQDN you are securing, for example www.yourdomain.com (or *.yourdomain.com for a wildcard). This is the only host field the built-in generator captures, so it must match the site precisely.
• Organization, Locality (city), State/Province, and Country: your registered company details. Spell out the state in full and use the two-letter ISO country code. These are required for OV and EV certificates; a DV certificate validates on domain control alone.
• Key size: keep the default of 2048 bits (or choose 3072 or 4096 if your AlteonOS version offers it). The list also includes 512 and 1024; do not pick those, because public CAs reject keys smaller than 2048 bits.
• Hash algorithm: keep the default of SHA-256 (or choose SHA-384 / SHA-512). The list also offers md5 and sha1: never select those, because they are deprecated and CAs reject them.

Click Apply to activate the change, then Save to write it to flash so the key and request survive a reboot.

Step 4: Export the CSR. Open the same entry’s Export action, set the component to the Request (CSR), and export as Text. Copy the entire block, from -----BEGIN CERTIFICATE REQUEST----- to -----END CERTIFICATE REQUEST-----, and paste it into the CSR field on your SSL order. The block looks like this:

-----BEGIN CERTIFICATE REQUEST-----
MIIC...your encoded request...AB==
-----END CERTIFICATE REQUEST-----

Each marker uses five hyphens on each side, with no spaces. Leave the entry in the repository while you wait for the signed certificate: Alteon needs it to pair the issued certificate with its private key when you import it later.

Generate a CSR in the CLI

Connect to Alteon over SSH (or the console) and log in. Enter the request menu for a new ID and create the CSR with the generate command:

/cfg/slb/ssl/certs/request <id>
generate

Replace <id> with your own identifier (for example, your domain name). The generate command then prompts you, one field at a time:

• Key type: the first prompt, with the options rsa and ec and rsa as the default. Press Enter to keep RSA unless you have confirmed your Certificate Authority issues ECDSA certificates for the product you are buying.
• Key size: the options are 512, 1024, 2048, and 4096, with 2048 as the default. Keep 2048 (the minimum a public CA will sign) or enter a larger size; never drop to 1024.
• Hash algorithm: the prompt defaults to sha256, which is what you want; keep it or choose sha384 / sha512. The md5 and sha1 options are obsolete, so do not select them.
• Common name: the FQDN you are securing, for example www.yourdomain.com. This field is mandatory.
• Use certificate default values: answer n so Alteon prompts you for the Organization, Locality, State/Province, and Country, then enter your registered details. Answer y only if you have already set those defaults in the Certificate Repository menu.
• Validation period: if the generator asks for one, it applies only to self-signed certificates and is ignored once a public CA signs your request, so the default is fine.

Once the request is generated, export it as text and copy the PEM block:

/cfg/slb/ssl/certs/export

At the prompts, set the component type to the Certificate Signing Request (CSR), enter the same ID, and choose text so the CSR is printed for you to copy. Finally, commit the new key and request to the configuration:

apply
save

Paste the copied CSR into your SSL order and submit it to the Certificate Authority. Keep the key and the future server certificate under the same ID so they are easy to pair when you install the signed certificate.

Check the CSR before you submit it

It is worth confirming the request carries the right domain and organization before you place the order. Paste the exported block into our online CSR decoder to read back the Common Name, key size, and subject fields Alteon wrote into it. If anything is wrong, generate a new CSR on the device rather than editing the file: the request text is signed by its private key, so any change invalidates it.

Alteon’s built-in generator captures a single Common Name and does not add Subject Alternative Name (SAN) entries. If you need a certificate that covers several hostnames through SAN, prepare the request off the device with our browser-based CSR Generator or with OpenSSL, then import the private key and signed certificate into the repository. Save the private key the generator gives you, because Alteon will not have created it.

After the CA issues your certificate

When the CA validates the CSR, it emails you the signed server certificate and its intermediate (CA) chain. Import the server certificate into the repository under the same ID as the request so it pairs with the existing private key, and import the intermediate CA as its own entry. Importing is only half the job on Alteon: you then create an SSL policy and bind both the policy and the server certificate to the HTTPS virtual service, which is the step that actually puts the certificate on the wire. The full procedure is in our guide on how to install an SSL certificate on Alteon. Once it is live, confirm the chain and expiry with our SSL Checker.