Instruction/ maintenance manual of the product OL-16647-01 Cisco Systems
Go to page of 20
CH A P T E R 33-1 Cisco Security Applia nce Command Line Configuratio n Guide OL-16647-01 33 Configuring Certificates Digital certif icates provide digit al identif ication for authenti cation. A digital cert ificate contain s informa tion that id entifies a device or user , such as the name, serial number , compan y , department, or IP address.
33-2 Cisco Security Appliance Command Line Configuration Guide OL-16647-01 Chapter 33 Configuring Certificates CA Certificate Authentication • Add Button —Add a ne w certif icate conf igurat ion to the list. See Add/Install a CA Certif icate . • Edit Button —Modify an existing cert ificat e conf iguration.
33-3 Cisco Security Applia nce Command Line Configuratio n Guide OL-16647-01 Chapter 33 Configuring Certificates CA Certificate Authentication More Options... —F or additional op tions for ne w certif icates, click the Mor e Options... button to display conf iguration opti ons for ne w and existi ng certifi cates.
33-4 Cisco Security Appliance Command Line Configuration Guide OL-16647-01 Chapter 33 Configuring Certificates CA Certificate Authentication Configuration Options for CA Certi ficates Additional conf .
33-5 Cisco Security Applia nce Command Line Configuratio n Guide OL-16647-01 Chapter 33 Configuring Certificates CA Certificate Authentication CRL Retrieval Method Configuration The CRL Retri ev a l Method pan el lets yo u select the method to be used for CRL retrie val.
33-6 Cisco Security Appliance Command Line Configuration Guide OL-16647-01 Chapter 33 Configuring Certificates Identity Certific ates Authentication T o avo id havi ng to retrie v e the same CRL from a CA repeatedly , The security appliance can store retrie ved CRLs local ly , which is called CRL caching.
33-7 Cisco Security Applia nce Command Line Configuratio n Guide OL-16647-01 Chapter 33 Configuring Certificates Identity Certificates Authentication Add/Install an Identity Certificate The Identity Certif icate panel lets you imp ort an exi sting identity certif icate from a file or add a ne w certificate conf iguration fr om an existing fi le.
33-8 Cisco Security Appliance Command Line Configuration Guide OL-16647-01 Chapter 33 Configuring Certificates Identity Certific ates Authentication – The check box Include serial number of the de vice allo ws you to add the security appliance serial number t o the certif icate p arameters.
33-9 Cisco Security Applia nce Command Line Configuratio n Guide OL-16647-01 Chapter 33 Configuring Certificates Identity Certificates Authentication • Issued to — Displays the X.50 0 fields o f the subject DN or certif icate owner and their v alues.
33-10 Cisco Security Appliance Command Line Configuration Guide OL-16647-01 Chapter 33 Configuring Certificates Identity Certific ates Authentication Generate Certificate Signin g Request This pane lets you generate a certif icate signin g request to send to En trust.
33-11 Cisco Security Applia nce Command Line Configuratio n Guide OL-16647-01 Chapter 33 Configuring Certificates Code-Signer Certificates To Add the Identity Certificate: Step 1 In the Identity Certificates panel , click the Add but t on . Step 2 In the Add Identity Cert if icate panel, select Add a new identity certif icate .
33-12 Cisco Security Appliance Command Line Configuration Guide OL-16647-01 Chapter 33 Configuring Certificates Local Certificate Authority • Delete an existing Identity Certificate. See Delete a Code-Signer Certificate . Export an e xisting Identity Certif icate.
33-13 Cisco Security Applia nce Command Line Configuratio n Guide OL-16647-01 Chapter 33 Configuring Certificates Local Certificate Authority Note The local CA provides a certificat e authority on the adaptiv e secur ity appliance for use with SSL VPN connections, both brow ser - and client-based.
33-14 Cisco Security Appliance Command Line Configuration Guide OL-16647-01 Chapter 33 Configuring Certificates Local Certificate Authority Configuring the Local CA Sever The CA Serv er windo w lets you cust omize, modify , and control Local CA server operation.
33-15 Cisco Security Applia nce Command Line Configuratio n Guide OL-16647-01 Chapter 33 Configuring Certificates Local Certificate Authority CA Server Key Size The CA Ke y Size parameter is the size of the used for the serv er certif icate generated fo r the Local CA server .
33-16 Cisco Security Appliance Command Line Configuration Guide OL-16647-01 Chapter 33 Configuring Certificates Local Certificate Authority Publish CRL Interface and Port: T o make the CRL av ailable for HTTP do wnload on a gi ven interface or port. Sel ect an interface from the pull-do wn list.
33-17 Cisco Security Applia nce Command Line Configuratio n Guide OL-16647-01 Chapter 33 Configuring Certificates Local Certificate Authority Enrollment Period The Enrollment Period field specif i es the number of hours an en roll ed user can retriev e a PKCS12 enrollment f ile in order to enroll and retri ev e a user certif icate.
33-18 Cisco Security Appliance Command Line Configuration Guide OL-16647-01 Chapter 33 Configuring Certificates Manage User Certificates Manage User Certificates The Local CA server maintains certificate rene wals, re-issues user certificates, maintains t he Certificate Re vocation List (CRL), and rev o kes or restores pri vil eges as needed.
33-19 Cisco Security Applia nce Command Line Configuratio n Guide OL-16647-01 Chapter 33 Configuring Certificates Manage User Data base Email OTP The Email O TP butt on automatically send s an e-mail noti ce of enrollment permission with a unique one-time passwo rd (O TP) and th e Local CA enrollment w ebpage URL to the ne wly added u ser .
33-20 Cisco Security Appliance Command Line Configuration Guide OL-16647-01 Chapter 33 Configuring Certificates Manage User Database.
An important point after buying a device Cisco Systems OL-16647-01 (or even before the purchase) is to read its user manual. We should do this for several simple reasons:
If you have not bought Cisco Systems OL-16647-01 yet, this is a good time to familiarize yourself with the basic data on the product. First of all view first pages of the manual, you can find above. You should find there the most important technical data Cisco Systems OL-16647-01 - thus you can check whether the hardware meets your expectations. When delving into next pages of the user manual, Cisco Systems OL-16647-01 you will learn all the available features of the product, as well as information on its operation. The information that you get Cisco Systems OL-16647-01 will certainly help you make a decision on the purchase.
If you already are a holder of Cisco Systems OL-16647-01, but have not read the manual yet, you should do it for the reasons described above. You will learn then if you properly used the available features, and whether you have not made any mistakes, which can shorten the lifetime Cisco Systems OL-16647-01.
However, one of the most important roles played by the user manual is to help in solving problems with Cisco Systems OL-16647-01. Almost always you will find there Troubleshooting, which are the most frequently occurring failures and malfunctions of the device Cisco Systems OL-16647-01 along with tips on how to solve them. Even if you fail to solve the problem, the manual will show you a further procedure – contact to the customer service center or the nearest service center
