CHAPT ER
44-1
Cisco ASA 5500 Series Configuration Guide using ASDM
44
Configuring Digital Certificates
This chapter describes how to configure digital certificates and includes the following sections:
•Information About Digital Certificates, page44-1
•Licensing Requirements for Digital Certificates, page 44-8
•Prerequisites for Local Certificates, page 44-8
•Guidelines and Limitations, page44-9
•Configuring Digital Certificates, page44-10
•Configuring CA Certificate Authentication, page44-10
•Configuring Identity Certificates Authentication, page44-16
•Configuring Code Signer Certificates, page44-21
•Authenticating Using the Local CA, page 44-23
•Managing the User Database, page44-27
•Managing User Certificates, page44-29
•Monitoring CRLs, page 44-30
•Feature History for Certificate Management, page44-31

Information About Digital Certificates

Digital certificates provide digital identification for authentication. A digital certificate includes
information that identifies a device or user, such as the name, serial number, company, department, or IP
address. CAs are trusted authorities that “sign” certificates to verify their authenticity, thereby
guaranteeing the identity of the device or user. CAs issue digital certificates in the context of a PKI,
which uses public-key or private-key encryption to ensure security.
For authentication using digital certificates, at least one identity certificate and its issuing CA certificate
must exist on an ASA. This configuration allows multiple identities, roots, and certificate hierarchies.
The ASA evaluates third-party certificates against CRLs, also called authority revocation lists, all the
way from the identity certificate up the chain of subordinate certificate authorities.
Descriptions of several different types of available digital certificates follow:
•A CA certificate is used to sign other certificates. It is self-signed and called a root certificate. A
certificate that is issued by another CA certificate is called a subordinate certificate. For more
information, see the “Configuring CA Certificate Authentication” section on page44-10.