Cisco PIX 525 Especificaciones descargar pdf (Pagina 469)

29-3

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 29 Configuring Certificates

Public Key Cryptography

Separate signing and encryption keys helps reduce exposure of the keys. This is because SSL uses

a key for encryption but not signing but IKE uses a key for signing but not encryption. By using

separate keys for each, exposure of the keys is minimized.

About Trustpoints

Trustpoints let you manage and track CAs and certificates. A trustpoint is a representation of a CA or

identity pair. A trustpoint contains the identity of the CA, CA-specific configuration parameters, and an

association with one enrolled identity certificate.

After you have defined a trustpoint, you can reference it by name in commands requiring that you specify

a CA. You can configure many trustpoints.

Note If a security appliance has trustpoints that share the same CA, only one trustpoint sharing the CA can be

used to validate user certificates. Use the support-user-cert-validation command to control which

trustpoint sharing a CA is used for validation of user certificates issued by that CA.

For automatic enrollment, a trustpoint must be configured with an enrollment URL and the CA that the

trustpoint represents must be available on the network and must support SCEP.

You can export and import the keypair and issued certificates associated with a trustpoint in PKCS12

format. This is useful if you wish to manually duplicate a trustpoint configuration on a different security

appliance.

About CRLs

CRLs provide the security appliance with a means of determining whether a certificate that is within its

valid time range has been revoked by its issuing CA. You can configure the security appliance to make

CRL checks mandatory when authenticating a certificate. You can also make the CRL check optional,

which allows the certificate authentication to succeed when the CA is unavailable to provide updated

CRL data.

CRL configuration is a part of the configuration of each trustpoint you define. The security appliance

can retrieve CRLs from CAs using HTTP, SCEP, or LDAP. CRLs retrieved for each trustpoint are cached

for a length of time configurable for each trustpoint.

When the security appliance has cached a CRL for more than the length of time it is configured to cache

CRLs, the security appliance considers the CRL too old to be reliable, or “stale”. The security appliance

attempts to retrieve a newer version of the CRL the next time a certificate authentication requires that

the stale CRL is checked.

The security appliance caches CRLs for a length of time determined by the following two factors:

• The number of minutes specified with the cache-time command. The default value is 60 minutes.

• The NextUpdate field in the CRLs retrieved, which may be absent from CRLs. You control whether

the security appliance requires and uses the NextUpdate field with the enforcenextupdate

command.

1 2 ... 464 465 466 467 468 469 470 471 472 473 474 ... 603 604

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 469