Security Policies; Chained Certificates; Table F-1 Secure Content Accelerator Cryptographic Algorithms - Cisco CSS11501S-C-K9 Configuration Manual

Cisco SSL Configuration Components

Chained Certificates

Security Policies

Table F-1 Secure Content Accelerator Cryptographic Algorithms
Cryptographic Scheme
ARC4-MD5
ARC4-SHA
DES-CBC3-MD5
DES-CBC3-SHA
Cisco 11000 Series Secure Content Accelerator Configuration Guide
F-10
Chained certificates are used in certain circumstances such as when a known,
trusted CA (such as Thawte or VeriSign) provides a certificate to attest that
certificates created by an intermediary CA can be trusted. For example, a company
can create its own certificates for internal use only; however, clients do not accept
the certificates because they were not created by a known CA. When private
certificates are chained with the trusted CA certificate, clients accept them during
SSL negotiations.
The certificate created locally is loaded into the device as a regular certificate; the
locally created public/private key pair is loaded into the device as a key. The
intermediary CA certificate signed by a trusted CA and any other intermediary
certificates are loaded as individual certificate objects that are combined into a
certificate group. An example of configuring a chained certificate via the
configuration manager is presented in Chapter 4. See Chapter 5 for information
about creating and enabling chained certificates using the GUI.
Cisco Secure Content Accelerator can process a wide range of single and
composite cryptography schemes. The following table shows a comparison of the
individual schemes. If you configure the device to use the weak security policy,
all schemes marked as "weak" are used. If you use the strong security policy, all
schemes marked as "strong" are used. The "default" security policy uses the
encryption and message authentication methods commonly available. The "all"
security policy incorporates all listed combinations.
Encryption
1
ARC4 (128)
1
ARC4 (128)
3DES (168)
3DES (168)
Message Key
Authentication Exchange
MD5 RSA (1024)
SHA1 RSA (1024)
MD5 RSA (1024)
SHA1 RSA (1024)
Appendix F SSL Introduction
Security
Policy
Assignments
strong, default, all
strong, default, all
strong, all
strong, fips, all
78-13124-06