Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 471)

29-5

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 29 Configuring Certificates

Certificate Configuration

To prepare a security appliance for certificates, perform the following steps:

Step 1 Ensure that the hostname and domain name of the security appliance are configured correctly. You can

use the show running-config command to view the hostname and domain name as currently configured.

For information about configuring the hostname, see the “Setting the Hostname” section on page 7-2.

For information about configuring the domain name, see the “Setting the Domain Name” section on

page 7-2.

Step 2 Be sure that the security appliance clock is set accurately before configuring the CA. Certificates have

a date and time that they become valid and that they expire. When the security appliance enrolls with a

CA and gets a certificate, the security appliance checks that the current time is within the valid range for

the certificate. If it is outside that range, enrollment fails.

For information about setting the clock, see the “Setting the Date and Time” section on page 7-2.

Configuring Key Pairs

This section includes the following topics:

• Generating Key Pairs, page 29-5

• Removing Key Pairs, page 29-6

Generating Key Pairs

Key pairs can be either RSA keys or DSA keys, as discussed in the “About Key Pairs” section on

page 29-2. You must generate key pairs for the types of certification you want to use.

To generate key pairs, perform the following steps:

Step 1 Generate the types of key pairs needed for your PKI implementation. To do so, perform the following

steps, as applicable:

a. If you want to generate RSA key pairs, use the crypto key generate rsa command.

hostname/contexta(config)# crypto key generate rsa

If you do not use additional keywords this command generates one general purpose RSA key pair.

Because the key modulus is not specified, the default key modulus of 1024 is used. You can specify

other modulus sizes with the modulus keyword. You can also assign a label to each key pair using

the label keyword. The label is referenced by the trustpoint that uses the key pair. If you do not

assign a label, the key pair is automatically labeled <Default-RSA-Key>.

b. If you want to generate DSA key pairs, use the crypto key generate dsa command.

hostname/contexta(config)# crypto key generate dsa label

key-pair-label

This command generates one DSA key pair. Because the key modulus is not specified, the default

key modulus of 1024 is used. You can specify other modulus sizes with the modulus keyword. You

must assign a label to the key pair using the label keyword. When you configure a trustpoint, you

can specify a key pair using its label.

1 2 ... 466 467 468 469 470 471 472 473 474 475 476 ... 603 604

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 471