Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 474)

29-8

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 29 Configuring Certificates

Certificate Configuration

• serial-number—During enrollment, asks the CA to include the security appliance serial number in

the certificate.

• ip-address ip-address—During enrollment, asks the CA to include the IP address of the security

appliance in the certificate.

• password string—Specifies a challenge phrase that is registered with the CA during enrollment.

The CA typically uses this phrase to authenticate a subsequent revocation request.

• keypair name—Specifies the key pair whose public key is to be certified.

• id-cert-issuer—Indicates whether the system accepts peer certificates issued by the CA associated

with this trustpoint.

• accept-subordinates—Indicates whether CA certificates subordinate to the CA associated with the

trustpoint are accepted if delivered during phase one IKE exchange when not previously installed

on the device.

• support-user-cert-validation—If enabled, the configuration settings to validate a remote user

certificate can be taken from this trustpoint, provided that this trustpoint is authenticated to the CA

that issued the remote certificate.

• exit—Leaves the mode.

Step 4 Save the trustpoint configuration. To do so, save the running configuration by entering the write

memory command.

Obtaining Certificates

The security appliance needs a CA certificate for each trustpoint and one or two certificates for itself,

depending upon the configuration of the keys used by the trustpoint. If the trustpoint uses separate RSA

keys for signing and encryption, the security appliance needs two certificates, one for each purpose. In

other key configurations, only one certificate is needed.

The security appliance supports enrollment with SCEP and with manual enrollment, which lets you paste

a base-64-encoded certificate directly into the terminal. For site-to-site VPNs, you must enroll each

security appliance. For remote access VPNs, you must enroll each security appliance and each remote

access VPN client.

This section includes the following topics:

• Obtaining Certificates with SCEP, page 29-8

• Obtaining Certificates Manually, page 29-10

Obtaining Certificates with SCEP

This procedure provides steps for configuring certificates using SCEP. These steps should be repeated

for each trustpoint you configure for automatic enrollment. When you have completed this procedure,

the security appliance will have received a CA certificate for the trustpoint and one or two certificates

for signing and encryption purposes. If you use DSA keys, the certificate received is for signing only. If

you use general-purpose RSA keys, the certificate received is for signing and encryption. If you use

separate RSA keys for signing and encryption, the security appliance receives separate certificates for

each purpose.

1 2 ... 469 470 471 472 473 474 475 476 477 478 479 ... 603 604

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 474