Cisco ASA Series Cli Configuration Manual page 1296

Configuring Cisco Unified Presence Proxy for SIP Federation
Command
Step 8
hostname(config-ca-trustpoint)# exit
Step 9
hostname(config)# crypto ca authenticate trustpoint
Example:
hostname(config)# crypto ca authenticate ent_y_ca
Enter the base 64 encoded CA certificate.
End with a blank line or the word "quit" on a line
by itself
MIIDRTCCAu+gAwIBAgIQKVcqP/KW74VP0NZzL+JbRTANBgkqhkiG
9w0BAQUFADCB
[ certificate data omitted ]
/7QEM8izy0EOTSErKu7Nd76jwf5e4qttkQ==
What to Do Next
Once you have created the trustpoints and installed the certificates for the local and remote entities on
the ASA, create the TLS proxy instance. See
Creating the TLS Proxy Instance
Because either server can initiate the TLS handshake (unlike IP Telephony or Cisco Unified Mobility,
where only the clients initiate the TLS handshake), you must configure by-directional TLS proxy rules.
Each enterprise can have an ASA as the TLS proxy.
Create TLS proxy instances for the local and remote entity initiated connections respectively. The entity
that initiates the TLS connection is in the role of "TLS client". Because the TLS proxy has a strict
definition of "client" and "server" proxy, two TLS proxy instances must be defined if either of the
entities could initiate the connection.
Command
Step 1
! Local entity to remote entity
hostname(config)# tls-proxy proxy_name
Example:
hostname(config)# tls-proxy ent_x_to_y
Step 2
hostname(config-tlsp)# server trust-point proxy_name
Example:
hostname(config-tlsp)# server trust-point
ent_y_proxy
Step 3
hostname(config-tlsp)# client trust-point
proxy_trustpoint
Example:
hostname(config-tlsp)# client trust-point ent_x_cert
Cisco ASA Series CLI Configuration Guide
1-12
Chapter 1
Purpose
Exits from the CA Trustpoint configuration mode.
Installs and authenticates the CA certificates
associated with a trustpoint created for the local
entity.
The ASA prompts you to paste the base-64
formatted CA certificate onto the terminal.
Creating the TLS Proxy Instance, page
Purpose
Creates the TLS proxy instance.
Specifies the proxy trustpoint certificate presented
during TLS handshake.
The certificate must be owned by the ASA (identity
certificate).
Where the proxy_name for the server trust-point
command is the remote entity proxy name.
Specifies the trustpoint and associated certificate
that the ASA uses in the TLS handshake when the
ASA assumes the role of the TLS client.
The certificate must be owned by the ASA (identity
certificate).
Where the proxy_trustpoint for the client
trust-point command is the local entity proxy.
Configuring Cisco Unified Presence
1-12.