Cisco ASA Series Cli Configuration Manual page 965

Chapter 1 Configuring Digital Certificates
Command
Step 2
lifetime ca-certificate time
Example:
hostname (config-ca-server)# lifetime ca-certificate
365
Step 3
no lifetime ca-certificate
Example:
hostname (config-ca-server)# no lifetime
ca-certificate
Configuring the User Certificate Lifetime
To configure the user certificate lifetime, perform the following commands:
Command
Step 1
crypto ca server
Example:
hostname (config)# crypto ca server
Step 2
lifetime certificate time
Example:
hostname (config-ca-server)# lifetime certificate
60
Configuring Digital Certificates
Purpose
Determines the expiration date included in the
certificate. The default lifetime of a local CA
certificate is three years.
Make sure that you limit the validity period of the
certificate to less than the recommended end date of
03:14:08 UTC, January 19, 2038.
(Optional) Resets the local CA certificate lifetime to
the default value of three years.
The local CA server automatically generates a
replacement CA certificate 30 days before it expires,
which allows the replacement certificate to be
exported and imported onto any other devices for
certificate validation of user certificates that have
been issued by the local CA certificate after the
current local CA certificate has expired. The
following preexpiration syslog message is generated:
%ASA-1-717049: Local CA Server certificate is
due to expire in days days and a replacement
certificate is available for export.
Note
When notified of this automatic rollover, the
administrator must make sure that the new
local CA certificate is imported onto all
required devices before it expires.
Purpose
Enters local ca server configuration mode. Allows
you to configure and manage a local CA.
Sets the length of time that you want user certificates
to remain valid.
Note
Before a user certificate expires, the local CA
server automatically initiates certificate
renewal processing by granting enrollment
privileges to the user several days ahead of
the certificate expiration date, setting renewal
reminders, and delivering an e-mail message
that includes the enrollment username and
OTP for certificate renewal. Make sure that
you limit the validity period of the certificate
to less than the recommended end date of
03:14:08 UTC, January 19, 2038.
Cisco ASA Series CLI Configuration Guide
1-29