44-2
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter44 Configuring Digital Certificates
Information About Digital Certificates
•CAs also issue identity certificates, which are certificates for specific systems or hosts. For more
information, see the “Configuring Identity Certificates Authentication” section on page44-16.
•Code-signer certificates are special certificates that are used to create digital signatures to sign code,
with the signed code itself revealing the certificate origin. For more information, see the
“Configuring Code Signer Certificates” section on page44-21.
The local CA integrates an independent certificate authority feature on the ASA, deploys certificates,
and provides secure revocation checking of issued certificates. The local CA provides a secure,
configurable, in-house authority for certificate authentication with user enrollment through a website
login page.
For more information, see the “Authenticating Using the Local CA” section on page44-23, the
“Managing the User Database” section on page 44-27, and the “Managing User Certificates” section on
page 44-29.
Note CA certificates and identity certificates apply to both site-to-site VPN connections and remote access
VPN connections. Procedures in this document refer to remote access VPN use in the ASDM GUI.
CAs are responsible for managing certificate requests and issuing digital certificates. A digital certificate
includes information that identifies a user or device, such as a name, serial number, company,
department, or IP address. A digital certificate also includes a copy of the public key for the user or
device. A CA can be a trusted third party, such as VeriSign, or a private (in-house) CA that you establish
within your organization.
Tip For an example of a scenario that includes certificate configuration and load balancing, see the following
URL: https://supportforums.cisco.com/docs/DOC-5964.
This section includes the following topics:
•Public Key Cryptography, page44-2
•Certificate Scalability, page44-3
•Key Pairs, page44-3
•Trustpoints, page44-4
•Revocation Checking, page44-5
•The Local CA, page 44-7
Public Key Cryptography
Digital signatures, enabled by public key cryptography, provide a way to authenticate devices and users.
In public key cryptography, such as the RSA encryption system, each user has a key pair containing both
a public and a private key. The keys act as complements, and anything encrypted with one of the keys
can be decrypted with the other.
In simple terms, a signature is formed when data is encrypted with a private key. The signature is
attached to the data and sent to the receiver. The receiver applies the public key of the sender to the data.
If the signature sent with the data matches the result of applying the public key to the data, the validity
of the message is established.
This process relies on the receiver having a copy of the public key of the sender and a high degree of
certainty that this key belongs to the sender, not to someone pretending to be the sender.