Cisco Systems ASA 5510, ASA 5512-X, ASA 5515-X, ASA 5520, ASA 5525-X, ASA 5540, ASA 5545-X, ASA 5550, ASA 5555-X, ASA 5580, ASA 5585-X, ASA 5505 Configuring Digital Certificates , Configuring CA Certificate Authentication

44-10

Cisco ASA 5500 Series Configuration Guide using ASDM

Chapter44 Configuring Digital Certificates

Configuring Digital Certificates

Configuring Digital Certificates

This section describes how to configure local CA certificates. Make sure that you follow the sequence

of tasks listed to correctly configure this type of digital certificate. This section includes the following

topics:

•Configuring CA Certificate Authentication, page44-10

•Configuring CA Certificates for Revocation, page44-12

•Configuring CRL Retrieval Policy, page44-13

•Configuring CRL Retrieval Methods, page44-13

•Configuring OCSP Rules, page44-14

•Configuring Advanced CRL and OCSP Settings, page44-15

Configuring CA Certificate Authentication

The CA Certificates pane displays the available certificates, identified by the issued to and issued by CA

server, the date that the certificate expires, the associated trustpoints, and the certificate usage or

purpose. In the CA Certificates pane, you can perform the following tasks:

•Authenticate self-signed or subordinate CA certificates.

•Install CA certificates on the ASA.

•Create a new certificate configuration.

•Edit an existing certificate configuration.

•Obtain a CA certificate manually and import it.

•Have the ASA use SCEP to contact the CA, and then automatically obtain and install the certificate.

•Display details and issuer information for a selected certificate.

•Access the CRL for an existing CA certificate.

•Remove the configuration of an existing CA certificate.

•Save the new or modified CA certificate configuration.

•Discard any changes and return the certificate configuration to the original settings.

This section includes the following topics:

•Adding or Installing a CA Certificate, page44-10

•Editing or Removing a CA Certificate Configuration, page44-11

•Showing CA Certificate Details, page 44-12

You can add a new certificate configuration from an existing file, by manually pasting a certificate in

PEM format, or by automatic enrollment using SCEP. SCEP is a secure messaging protocol that requires

minimal user intervention and lets you enroll and install certificates using only the VPN Concentrator

Manager.

To add or install a CA certificate, perform the following steps:

Cisco Systems Configuring Digital Certificates , Configuring CA Certificate Authentication