Cisco Systems 6500 manual Subject-name line, Usage ike ssl-client ssl-server, Vrf vrf

Chapter 2 Commands for the Catalyst 6500 Series Switch WebVPN Module

crypto pki trustpoint

Table 2-1 Certificate-Authority Trustpoint Submode Commands (continued)

Command	Purpose and Guidelines	Defaults
subject-name line	(Optional) Configures the host name of the
	WebVPN gateway.
usage {ike ssl-client ssl-server}	(Optional) Specifies the intended use for the
	certificate.
vrf vrf	Name of the VPN routing and forwarding instance
	(VRF) to use for enrollment and obtaining CRLs.

You should declare one trustpoint to be used by the module for each certificate.

The trustpoint-labelvalue should match the key-labelvalue of the keys; however, this is not a requirement.

When you specify the IP address of the WebVPN gateway that will use this certificate, some web browsers compare the IP address in the SSL server certificate with the IP address that might appear in the URL. If the IP addresses do not match, the browser may display a dialog box and ask the client to accept or reject this certificate.

When specifying the subject-nameline value, use these guidelines:

•The subject-namecommand uses the Lightweight Directory Access Protocol (LDAP) format.

•Arguments specified in the subject name must be enclosed in quotation marks if they contain a comma. For example, O=“Cisco, Inc.”

•Some browsers compare the common name (CN) field of the subject name in the SSL server certificate with the hostname that might appear in the URL. If the names do not match, the browser may display a dialog box and ask the client to accept or reject the certificate. Also, some browsers will reject the SSL session setup and close the session if the CN field is not defined in the certificate.

Examples	This example shows how to declare the trustpoint PROXY1 and verify connectivity:
	webvpn(config)# crypto pki trustpoint PROXY1
	webvpn(ca-trustpoint)# rsakeypair PROXY1
	webvpn(ca-trustpoint)#enrollment url http://exampleCA.cisco.com
	webvpn(ca-trustpoint)# ip-address 10.0.0.1
	webvpn(ca-trustpoint)# password password
	webvpn(ca-trustpoint)# serial-number
	webvpn(ca-trustpoint)#subject-name C=US; ST=California; L=San Jose; O=Cisco; OU=Lab;
	CN=host1.cisco.com
	webvpn(ca-trustpoint)# end
	webvpn# ping example.cisco.com
	Type escape sequence to abort.
	Sending 5, 100-byte ICMP Echos to 20.0.0.1, timeout is 2 seconds:
	!!!!!
	Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms
	webvpn#

Catalyst 6500 Series Switch WebVPN Module Command Reference—Release 1.1

2-30 OL-7310-01