Cisco ASA Series Cli Configuration Manual page 947

Chapter 1 Configuring Digital Certificates
Configuring Trustpoints
To configure a trustpoint, perform the following steps:
Command
Step 1
crypto ca trustpoint trustpoint-name
Example:
hostname/contexta(config)# crypto ca trustpoint Main
Step 2
Choose one of the following options:
enrollment url url
Example:
hostname/contexta(config-ca-trustpoint)# enrollment
url http://10.29.67.142:80/certsrv/mscep/mscep.dll
enrollment terminal
Example:
hostname/contexta(config-ca-trustpoint)# enrollment
terminal
Step 3
revocation-check crl none
revocation-check crl
revocation-check none
Example:
hostname/contexta(config-ca-trustpoint)#
revocation-check crl none
hostname/contexta(config-ca-trustpoint)#
revocation-check crl
hostname/contexta(config-ca-trustpoint)#
revocation-check none
Step 4
crl configure
Example:
hostname/contexta(config-ca-trustpoint)# crl
configure
Step 5
email address
Example:
hostname/contexta(config-ca-trustpoint)# email
example.com
Configuring Digital Certificates
Purpose
Creates a trustpoint that corresponds to the CA from
which the ASA needs to receive a certificate. Enters
the crypto ca trustpoint configuration mode, which
controls CA-specific trustpoint parameters that you
may configure starting in Step 3.
Note
When you try to connect, a warning occurs to
indicate that the trustpoint does not contain
an ID certificate when an attempt is made to
retrieve the ID certificate from the trustpoint.
Requests automatic enrollment using SCEP with the
specified trustpoint and configures the enrollment
URL.
Requests manual enrollment with the specified
trustpoint by pasting the certificate received from the
CA into the terminal.
Specifies the available CRL configuration options.
Note
To enable either required or optional CRL
checking, make sure that you configure the
trustpoint for CRL management after
obtaining certificates.
Enters crl configuration mode.
During enrollment, asks the CA to include the
specified e-mail address in the Subject Alternative
Name extension of the certificate.
Cisco ASA Series CLI Configuration Guide
1-11