Cisco PIX 525 Especificaciones descargar pdf (Pagina 475)

29-9

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 29 Configuring Certificates

Certificate Configuration

Note Whether a trustpoint uses SCEP for obtaining certificates is determined by the use of the enrollment url

command when you configure the trustpoint (see the “Configuring Trustpoints” section on page 29-6).

To obtain certificates with SCEP, perform the following steps:

Step 1 Obtain the CA certificate for the trustpoint you configured.

hostname/contexta(config)# crypto ca authenticate

trustpoint

For example, using trustpoint named Main, which represents a subordinate CA:

hostname/contexta(config)# crypto ca authenticate Main

INFO: Certificate has the following attributes:

Fingerprint: 3736ffc2 243ecf05 0c40f2fa 26820675

Do you accept this certificate? [yes/no]: y

Trustpoint 'Main' is a subordinate CA and holds a non self signed cert.

Trustpoint CA certificate accepted.

Step 2 Enroll the security appliance with the trustpoint. This process retrieves a certificate for signing data and,

depending upon the type of keys you configured, for encrypting data.

Step 3 To perform enrollment, use the crypto ca enroll command. Before entering this command, contact your

CA administrator because the administrator may need to authenticate your enrollment request manually

before the CA grants its certificates.

hostname(config)# crypto ca enroll

trustpoint

If the security appliance does not receive a certificate from the CA within 1 minute (the default) of

sending a certificate request, it resends the certificate request. The security appliance continues sending

a certificate request every 1 minute until a certificate is received.

Note If the fully qualified domain name configured for the trustpoint is not identical to the fully

qualified domain name of the security appliance, including the case of the characters, a warning

appears. If needed, you can exit the enrollment process, make any necessary corrections, and

enter the crypto ca enroll command again.

The following enrollment example performs enrollment with the trustpoint named Main:

hostname(config)# crypto ca enroll Main

% Start certificate enrollment ..

% Create a challenge password. You will need to verbally provide this

% password to the CA Administrator in order to revoke your certificate.

% For security reasons your password will not be saved in the configuration.

% Please make a note of it.

Password: 2b0rn0t2b

Re-enter password: 2b0rn0t2b

% The subject name in the certificate will be: securityappliance.example.com

% The fully-qualified domain name in the certificate will be:

securityappliance.example.com

% Include the device serial number in the subject name? [yes/no]: no

Request certificate from CA [yes/no]: yes

% Certificate request sent to Certificate authority.

1 2 ... 470 471 472 473 474 475 476 477 478 479 480 ... 603 604

Comentarios a estos manuales

Sin comentarios

Cisco PIX 525 Especificaciones Pagina 475

Comentarios a estos manuales