Cisco CP-7911G-CH1 System Administrator Manual page 188

How to Configure Secure Unified SRST
Command or Action
Step 5
grant auto
Example:
Router (cs-server)# grant auto
Step 6
no shutdown
Example:
Router (cs-server)# no shutdown
Examples
The following example reflects one way of generating a CA:
Router(config)# crypto pki server srstcaserver
Router(cs-server)# database level complete
Router(cs-server)# database url nvram
Router(cs-server)# issuer-name CN=srstcaserver
Router(cs-server)# grant auto
% This will cause all certificate requests to be automatically granted.
Are you sure you want to do this? [yes/no]: y
Router(cs-server)# no shutdown
% Once you start the server, you can no longer change some of
% the configuration.
Are you sure you want to do this? [yes/no]: y
% Generating 1024 bit RSA keys ...[OK]
% Certificate Server enabled.
Autoenrolling and Authenticating the Secure Cisco Unified SRST Router to the CA Server
The secure Cisco Unified SRST Router needs to define a trustpoint; that is, it must obtain a device
certificate from the CA server. The procedure is called certificate enrollment. Once enrolled, the secure
Cisco Unified SRST Router can be recognized by Cisco Unified Communications Manager as a secure
SRST router.
There are three options to enroll the secure Cisco Unified SRST Router to a CA server: autoenrollment,
cut and paste, and TFTP. When the CA server is a Cisco IOS certificate server, autoenrollment can be
used. Otherwise, manual enrollment is required. Manual enrollment refers to cut and paste or TFTP.
Use the enrollment url command for autoenrollment and the crypto pki authenticate command to
authenticate the SRST router. Full instructions for the commands can be found in the
Authority Interoperability Commands
Certificate Enrollment Enhancements
section on page
SUMMARY STEPS
1.
2.
3.
4.
Cisco Unified SCCP and SIP SRST System Administrator Guide
188
190.
crypto pki trustpoint name
enrollment url url
revocation-check method1
exit
Purpose
Allows an automatic certificate to be issued to any
requestor.
• This command is used only during enrollment and will
be removed in the
Enrollment" section on page
Enables the Cisco IOS certificate server.
You should issue this command only after you have
•
completely configured your certificate server.
documentation. An example of autoenrollment is available in the
feature. A sample configuration is provided in the
Configuring Secure SRST for SCCP and SIP
"Disabling Automatic Certificate
190.
Certification
"Examples"
OL-13143-04