Cisco ASA Series Cli Configuration Manual page 977

Chapter 1 Configuring Digital Certificates
END OF CERTIFICATE
Archiving the Local CA Server Certificate and Keypair
To archive the local CA server certificate and keypair, enter the following command:
Command
copy
Example:
hostname# copy LOCAL-CA-SERVER_0001.pl2
tftp://10.1.1.22/user6/
Note
Monitoring Digital Certificates
To display certificate configuration and database information, enter one or more of the following
commands:
Command
show crypto ca server
show crypto ca server cert-db
show crypto ca server certificate
show crypto ca server crl
show crypto ca server user-db
show crypto ca server user-db allowed
show crypto ca server user-db enrolled
show crypto ca server user-db expired
show crypto ca server user-db on-hold
show crypto key name of key
show running-config
Purpose
Copies the local CA server certificate and keypair and all files
from the ASA using either FTP or TFTP.
Note
Make sure that you back up all local CA files as often
as possible.
Purpose
Shows local CA configuration and status.
Shows user certificates issued by the local CA.
Shows local CA certificates on the console in base 64 format and the rollover
certificate when available, including the rollover certificate thumbprint for
verification of the new certificate during import onto other devices.
Shows CRLs.
Shows users and their status, which can be used with the following qualifiers
to reduce the number of displayed records:
•
allowed. Shows only users currently allowed to enroll.
•
enrolled. Shows only users that are enrolled and hold a valid certificate
•
expired. Shows only users holding expired certificates.
•
on-hold. Lists only users without a certificate and not currently allowed
to enroll.
Shows users who are eligible to enroll.
Shows enrolled users with valid certificates.
Shows users with expired certificates.
Shows users without certificates who are not allowed to enroll.
Shows key pairs that you have generated.
Shows local CA certificate map rules.
Monitoring Digital Certificates
Cisco ASA Series CLI Configuration Guide
1-41