Cisco PIX 525 Spécifications télécharger pdf (Page 473)

29-7

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 29 Configuring Certificates

Certificate Configuration

Step 2 Specify the enrollment method to be used with this trustpoint.

Note If the trustpoint uses DSA keys, enrollment must be manual. The security appliance does not

support automatic enrollment for certification with DSA keys.

To specify the enrollment method, do one of the following items:

• To specify SCEP enrollment, use the enrollment url command to configure the URL to be used for

SCEP enrollment with the trustpoint you declared. For example, if the security appliance requests

certificates from trustpoint Main using the URL http://10.29.67.142:80/certsrv/mscep/mscep.dll,

then the command would be as follows:

hostname/contexta(config-ca-trustpoint)# enrollment url

http://10.29.67.142:80/certsrv/mscep/mscep.dll

• To specify manual enrollment, use the enrollment terminal command to indicate that you will paste

the certificate received from the CA into the terminal.

Step 3 As needed, specify other characteristics for the trustpoint. The characteristics you need to define depend

upon your CA and its configuration. You can specify characteristics for the trustpoint using the following

commands. Refer to the Cisco Security Appliance Command Reference for complete descriptions and

usage guidelines of these commands.

• crl required | optional | nocheck—Specifies CRL configuration options. When you enter the crl

command with the optional keyword included within the command statement, certificates from

peers can still be accepted by your security appliance even if the CRL is not accessible to your

security appliance.

Note If you chose to enable required or optional CRL checking, be sure you configure the

trustpoint for CRL managemen2t, which should be completed after you have obtained

certificates. For details about configuring CRL management for a trustpoint, see the

“Configuring CRLs for a Trustpoint” section on page 29-12.

• crl configure—Enters CRL configuration mode.

• default enrollment—Returns all enrollment parameters to their system default values. Invocations

of this command do not become part of the active configuration.

• enrollment retry period —(Optional) Specifies a retry period in minutes. This characteristic only

applies if you are using SCEP enrollment.

• enrollment retry count—(Optional) Specifies a maximum number of permitted retries. This

characteristic only applies if you are using SCEP enrollment.

• enrollment terminal—Specifies cut and paste enrollment with this trustpoint.

• enrollment url URL—Specifies automatic enrollment (SCEP) to enroll with this trustpoint and

configures the enrollment URL.

• fqdn fqdn—During enrollment, asks the CA to include the specified fully qualified domain name in

the Subject Alternative Name extension of the certificate.

• email address—During enrollment, asks the CA to include the specified email address in the

Subject Alternative Name extension of the certificate.

• subject-name X.500 name—During enrollment, asks the CA to include the specified subject DN in

the certificate.

1 2 ... 468 469 470 471 472 473 474 475 476 477 478 ... 603 604

Commentaires sur ces manuels

Pas de commentaire

Cisco PIX 525 Spécifications Page 473

Commentaires sur ces manuels