Crypto Ca Authenticate - Cisco Nexus 7000 Series Command Reference Manual

crypto ca authenticate

crypto ca authenticate
To associate and authenticate a certificate of the certificate authority (CA) and configure its CA certificate
(or certificate chain), use the crypto ca authenticate command. To remove the association and authentication,
use the no form of this command.
crypto ca authenticate trustpoint-label
no crypto ca authenticate trustpoint-label
Syntax Description
trustpoint-label
Command Default
None
Command Modes
Global configuration
Command History
Release
4.1(2)
Usage Guidelines
You can use this command to authenticate the CA to the Cisco NX-OS device by obtaining the self-signed
certificate of the CA that contains the public key of the CA. Because the CA signs its own certificate, you
should manually authenticate the public key of the CA by contacting the CA administrator when you execute
this command. The CA certificate or certificate chain must be available in Privacy Enhanced Mail (PEM)
(base-64) encoded format.
Use this command when you initially configure certificate authority support for the device. First create the
trustpoint using the crypto ca trustpoint command using the CA certificate fingerprint published by the CA.
You must compare the certificate fingerprint displayed during authentication with the one published by the
CA and accept the CA certificate only if it matches.
If the CA to authenticate is a subordinate CA (it is not self-signed), then another CA certifies it, which in turn
may be certified by yet another CA, and so on, until there is a self-signed CA. In this case, the subordinate
CA has a CA certificate chain. You must enter the entire chain during CA authentication. The maximum
length that the CA certificate chain supports is ten.
The trustpoint CA is the certificate authority that you configure on the device as the trusted CA. The device
accepts any peer certificate if it is signed by a locally trusted CA or its subordinates.
The trustpoint configuration that you create with the crypto ca trustpoint command persists across device
reboots only if you save it explicitly using the copy running-config startup-config command. The certificates
and CRL associated to a trustpoint are automatically persistent when you save the trustpoint configuration in
Cisco Nexus 7000 Series Security Command Reference
108
Name of the trustpoint. The name The name is
alphanumeric, case sensitive, and has a maximum
length of 64 characters.
Modification
This command was introduced.
C Commands