16-16
Cisco ASA Series Firewall CLI Configuration Guide
Chapter16 Configuring the Cisco Phone Proxy
Configuring the Phone Proxy
Step3 Click Find and it will display all the certificates.
Step4 Find the filename Cisco_Manufacturing_CA. This is the certificate need to verify the IP phone
certificate. Click the .PEM file Cisco_Manufacturing_CA.pem. This will show you the certificate
information and a dialog box that has the option to download the certificate.
Note If the certificate list contains more than one certificate with the filename
Cisco_Manufacturing_CA, make you select the certificate Cisco_Manufacturing_CA.pem—the
one with the .pem file extension.
Step5 Click Download and save the file as a text file.
Step6 On the ASA, create a trustpoint for the Cisco Manufacturing CA and enroll via terminal by entering the
following commands. Enroll via terminal because you will paste the certificate you downloaded in
Step 4.
hostname(config)# crypto ca trustpoint trustpoint_name
hostname(config-ca-trustpoint)# enrollment terminal
Step7 Authenticate the trustpoint by entering the following command:
hostname(config)# crypto ca authenticate trustpoint
Step8 You are prompted to “Enter the base 64 encoded CA Certificate.” Copy the .PEM file you downloaded
in Step 4 and paste it at the command line. The file is already in base-64 encoding so no conversion is
required. If the certificate is OK, you are prompted to accept it: “Do you accept this certificate?
[yes/no].” Enter yes.
Note When you copy the certificate, make sure that you also copy also the lines with BEGIN and
END.
Tip If the certificate is not ok, use the debug crypto ca command to show debug messages for PKI
activity (used with CAs).
Step9 Repeat the Step 1 through Step 8 for the next certificate. Table 1 6-2 shows the certificates that are
required by the ASA.
Table16-2 Certificates Required by the Security Appliance for the Phone Proxy
Certificate Name Required for...
CallManager Authenticating the Cisco UCM during TLS handshake; only
required for mixed-mode clusters.
Cisco_Manufacturing_CA Authenticating IP phones with a Manufacturer Installed Certificate
(MIC).
CAP-RTP-001 Authenticating IP phones with a MIC.
CAP-RTP-002 Authenticating IP phones with a MIC.
CAPF Authenticating IP phones with an LSC.