cc/td/doc/product/iaabu/csvpnc
hometocprevnextglossaryfeedbacksearchhelp
PDF

Table of Contents

Configuring Entrust Digital Certificates

Configuring Entrust Digital Certificates

This appendix provides additional information on requesting digital certification from the Entrust CA server and configuring ca-identity configuration commands on your gateway. Use this appendix with "Configuring Digital Certification," and the enrollment procedures on the Entrust web site.

Entrust Certificate Authority

This CA requires that both IPSec peers transact with a Registration Authority (RA), which then forwards the requests through to the CA. Both the remote IPSec peer and the local IPSec peer must be configured with the both the CA and RA public keys. The CA and RA public keys are signature and encryption key pairs, which must be generated and enrolled for authentication to occur.

For information on configuring Entrust CA, see the following URLs:


Note While Cisco Secure VPN Client supports Entrust, the Entrust enrollment method is subject to change over time. Please see the Entrust web site at http://www.entrust.com  for the current enrollment method.


Figure A-1: Entrust CA Server Topology


Configuring Entrust CA Identity on the Gateway

This step corresponds to the "Declaring the CA" section in "Configuring Digital Certification."

To enroll your certificate with a CA, perform the following tasks, as described in Table A-1:


Table A-1: Declare the CA
Command Purpose
hq_sanjose(config)# crypto ca identity example.com

To declare the CA your router should use, enter the crypto ca identity global configuration command. This command invokes the ca-identity (cfg-ca-id) configuration mode.

In this example, example.com is defined as the domain name for which this certificate is requested.

hq_sanjose(cfg-ca-id)# enrollment mode ra

To indicate compatibility with the CA's Registration Authority (RA) system, enter the enrollment mode ra ca-identity configuration command.

hq_sanjose(cfg-ca-id)# enrollment url http://entrust-ca

To specify the CA's location where your router should send certificate requests by indicating the CA's enrollment URL, enter the enrollment url ca-identity configuration command.

In this example, http://entrust-ca is specified as the CA server.

hq_sanjose(cfg-ca-id)# query url http://entrust-ca

To specify Lightweight Directory Access Protocol (LDAP) support, enter the query url ca-identity configuration command. This command is required if your CA supports both RA and LDAP. LDAP is a query protocol used when the router retrieves certificates and CRLs. The default query protocol is Certificate Enrollment Protocol (CEP).

In this example, http://entrust-ca is specified as the LDAP server.

hq_sanjose(cfg-ca-id)# crl optional

To allow other peers' certificates to still be accepted by your router even if the appropriate Certificate Revocation List (CRL) is not accessible to your router, use the crl optional ca-identity configuration command.

hq_sanjose(cfg-ca-id)# exit

To exit ca-identity (cfg-ca-id) configuration mode, enter the exit ca-identity configuration command.


hometocprevnextglossaryfeedbacksearchhelp
Posted: Thu Jul 27 18:04:05 PDT 2000
Copyright 1989-2000©Cisco Systems Inc.