Cisco ASA Series Cli Configuration Manual page 1261

Chapter 1 Configuring the TLS Proxy for Encrypted Voice Inspection
Step 8
Run the CTL Client application to add the server proxy certificate (ccm_proxy) to the CTL file and
install the CTL file on the security appliance. See the Cisco Unified CallManager document for
information on how to configure and use CTL Client:
http://www.cisco.com/univercd/cc/td/doc/product/voice/c_callmg/5_1/nci/p08/secuauth.htm
Note
Creating Trustpoints and Generating Certificates
The Cisco UCM proxy certificate could be self-signed or issued by a third-party CA. The certificate is
exported to the CTL client.
Prerequisites
Import the required certificates, which are stored on the Cisco UCM. See the
UCM" section on page 1-7
Command
Step 1
hostname(config)# crypto key generate rsa label
key-pair-label modulus size
Examples:
hostname(config)# crypto key generate rsa label
ccm_proxy_key modulus 1024
hostname(config)# crypto key generate rsa label
ldc_signer_key modulus 1024
hostname(config)# crypto key generate rsa label
phone_common modulus 1024
Step 2
hostname(config)# crypto ca trustpoint
trustpoint_name
Example:
hostname(config)# ! for self-signed CCM proxy
certificate
hostname(config)# crypto ca trustpoint ccm_proxy
Step 3
hostname(config-ca-trustpoint)# enrollment self
Step 4
hostname(config-ca-trustpoint)# fqdn none
You will need the CTL Client that is released with Cisco Unified CallManager Release 5.1 to
interoperate with the security appliance. See the
more information regarding TLS proxy support.
and the
Configuring the TLS Proxy for Encrypted Voice Inspection
"CTL Client Overview" section on page 1-3
"Importing Certificates from the Cisco UCM" section on page
Purpose
Creates the RSA keypair that can be used for the
trustpoints.
The keypair is used by the self-signed certificate
presented to the local domain containing the Cisco
UP (proxy for the remote entity).
Note
We recommend that you create a different
key pair for each role.
Enters the trustpoint configuration mode for the
specified trustpoint so that you can create the
trustpoint for the Cisco UMA server.
A trustpoint represents a CA identity and possibly a
device identity, based on a certificate issued by the
CA.
Generates a self-signed certificate.
Specifies not to include a fully qualified domain
name (FQDN) in the Subject Alternative Name
extension of the certificate during enrollment.
Cisco ASA Series CLI Configuration Guide
for
"Certificates from the Cisco
1-15.
1-9