|
Table Of Contents
Configuring a Certificate Trustpoint Using the Wizard
Setting up a Proxy Service Trustpoint
Configuring a Trustpoint and RSA Key Pair
Configuring SSL Certificate Attributes
Configuring Enrollment Parameters
Selecting a CA Certificate Source
Importing a CA Certificate Chain
Delivering Configuration to an SSL Module
Viewing Trustpoint Configuration Status
Viewing Certificate Signing Request (CSR)
Importing and Exporting Certificates
Importing Certificates from an External PKI System
Exporting Certificates Using the Wizard
Viewing Certificate Export Wizard Summary
Viewing the Certificate Export Status
Exporting Certificates in Bulk Using the Certificate Export Wizard
Selecting Certificates and Format (PEM, PKCS#12)
Specifying the Destination (PEM)
Specifying the Destination (PKCS#12)
Viewing Certificate Trustpoints
Certificate Trustpoint Grouper
Certificate Trustpoint Details
Authenticating and Enrolling Trustpoints
Importing SSL Certificate Trustpoints
Editing Trustpoint Configuration
How Do I Import an SSL Certificate and Private Key to SSLSM?
How do I Import a CA Certificate Chain on the SSLSM?
How do I generate a Certificate Signing Request (CSR)?
How do I import the SSL certificate obtained using CSR?
How Do I Export Certificates and Private Keys from SSLSM?
How Do I Renew an SSL Certificate?
Managing Certificates
A Trustpoint is an association of a CA Certificate, an RSA Key pair, and the corresponding SSL Client and Server Certificate.
The following topics are described in this section:
• Getting started with Wizards
• Importing and Exporting Certificates
• Exporting Certificates in Bulk Using the Certificate Export Wizard
• Viewing Certificate Trustpoints
• Certificate Trustpoint Details
• Editing Trustpoint Configuration
Getting started with Wizards
The details below help you navigate as per the menu.
For more information on Wizards, see Understanding Wizards
Certificate Wizards
The certificate wizards helps you to configure a certificate trustpoint using a wizard, Importing certificates and private keys, and export certificates and private keys.
Configuring a Certificate Trustpoint Using the Wizard
This wizard helps you to configure a certificate Trustpoint, generate the Certificate Signing Request (CSR), and install the SSL certificate obtained using the CSR.
The wizard also helps you to configure certificate authority (CA) Trustpoints and install a CA certificate or a CA certificate chain.
Note If the CA issuing your certificate is a subordinate CA, then you must first install all of the CA certificates in the certification path.
Importing CA Certificate or CA certificate chain
Step 1 Configure a trustpoint name. For details, see Configuring a Trustpoint and RSA Key Pair
Step 2 Specify a CA certificate source. For details, see Selecting a CA Certificate Source
Step 3 Specify a CA certificate. For details, see
• Importing a CA Certificate Chain using Copy and Paste
• Importing a CA Certificate Chain from a TFTP Server
• Importing a CA Certificate Chain from a Local Hard Disk
• Specifying a CA Certificate (PEM)
Step 4 Select Trustpoint setup tasks. For details, see
• Configuring Trustpoint Tasks
• Delivering CLI Commands to the Device, page 1-22
• Viewing Trustpoint Configuration Status
Generating Certificate Signing Request (CSR)
Step 1 Configure Trustpoints and RSA key pair. For details, see Configuring a Trustpoint and RSA Key Pair
Step 2 Configure SSL certificate attributes. For details, see
• Configuring SSL Certificate Attributes
Step 3 Configure enrollment parameters. For details, see
• Configuring Enrollment Parameters
Step 4 Specify a CA certificate (for the copy-paste method only). For details, see
• Specifying a CA Certificate (PEM)
Step 5 Select Trustpoint setup tasks. For details, see
• Configuring Trustpoint Tasks
• Delivering CLI Commands to the Device, page 1-22
• Viewing Certificate Signing Request (CSR)
Importing the SSL certificate
For more details, see How do I import the SSL certificate obtained using CSR?.
Import Certificates and Private Key
This wizard lets you to import certificates and private key to SSLSM from an external public key infrastructure (PKI). You can import certificates in X.509 PEM, X.509 DER, PKCS#7, or PKCS#12 format. The instructions below guides you through the steps based on the format and source of the certificates.
Importing CA Certificate, SSL Certificate and Private Key.
To launch the task, see Importing Certificates from an External PKI System
Importing in PEM format- Local Hard Disk
Step 1 Specify certificate formats and source. For details, see Configuring Certificate Source and Format
Step 2 Specify certificates and private key files. For details, see
• Configuring Certificates and Key Files (PEM - Local Hard Disk)
• Viewing the Certificate Import Status
Importing in PEM format- Copy-and-paste
Step 1 Specify certificate formats and source. For details, see Configuring Certificate Source and Format
Step 2 Specify CA certificate. For more details, see Specifying a CA Certificate (PEM).
Step 3 Specify Private Key Specifying Private Key (PEM Format).
Step 4 Specify SSL certificate. For more details, see:
• Specifying SSL Certificate (PEM Format)
• Viewing the Certificate Import Status
Importing in PEM format- Remote system
Step 1 Specify certificate formats and source. For details, see
• Configuring Certificate Source and Format
Step 2 Specify certificates and private key files.
• Configuring Certificates and Key Files (PEM - Remote System)
• Viewing the Certificate Import Status
Importing in DER, PKCS#12, or PKCS#7
See the following sections:
• Configuring Certificate Source and Format
• Viewing the Certificate Import Status
Importing CA Certificate chain, SSL Certificate and Private Key
To launch the task, see Importing Certificates from an External PKI System
Importing in PEM - Local Hard Disk
Step 1 Specify certificate format and source. For details, see Configuring Certificate Source and Format
Step 2 Specify certificates and private key files. For details, see
• Specifying Certificates and Private Key
• Viewing the Certificate Import Status
Importing in PEM- Copy- and- paste
Step 1 Specify certificate format and source. For details, see Configuring Certificate Source and Format
Step 2 Specify the CA certificates. For details, see Specifying CA Certificates
Step 3 Specify private key. For details, see Specifying Private Key (PEM Format)
Step 4 Specify the SSL certificate. For details, see:
• Specifying SSL Certificate (PEM Format)
• Viewing the Certificate Import Status
Importing in PKCS#12, or PKCS#7
See the following sections:
• Configuring Certificate Source and Format
• Viewing the Certificate Import Status
Export Certificates and Private Keys
This wizard lets you to export certificates and private keys from the SSLSM in PKCS#12 or PEM format. You can export certificates and private keys to an external system (local hard disk or remote server) or to another SSLSM. When exporting the certificates in PEM format, you can optionally choose to export the CA certificates in the certificate chain.
The instructions below guides you through the steps based on the format and source of the certificates.
To launch the task, do the following:
Step 1 Click Setup in the CVDM-SSLSM task bar. The Setup page appears
Step 2 Click Wizards in the left-most pane. The Setup Wizards information appears in the content area.
Step 3 Select Export Certificates and Private Keys, then click Launch the Selected Task. The Certificate Export Wizard appears.
Exporting in PEM format- Local Hard Disk
Step 1 Select the certificates and format. For details, see Selecting Certificates and Format (PEM, PKCS#12).
Step 2 Select a destination. For details, see Specifying the Destination (PEM).
Step 3 Specify the destination details. For details, see:
• Specify Destination Details (PEM - Local Hard Disk)
• Viewing Certificate Export Wizard Summary
• Viewing the Certificate Export Status
Exporting using Copy and Paste method
Step 1 Select the certificates and format. For details, see
• Selecting Certificates and Format (PEM, PKCS#12)
Step 2 Select a destination. For details, see
• Specifying the Destination (PEM)
• Viewing Certificate Export Wizard Summary
• Viewing the Certificate Export Status
Exporting to Remote system
Step 1 Select the certificates and format. For details, see Selecting Certificates and Format (PEM, PKCS#12).
Step 2 Select a destination. For details, see Specifying the Destination (PEM).
Step 3 Specify the destination details. For details, see
• Specify Destination Details (PEM - Remote System)
• Viewing Certificate Export Wizard Summary
• Viewing the Certificate Export Status
Exporting to Redundant SSLSM
Step 1 Select the certificates and format. For details, see Selecting Certificates and Format (PEM, PKCS#12).
Step 2 Select a destination. For details, see Specifying the Destination (PEM).
Step 3 Specify the destination details. For details, see
• Specify Destination Details (PEM - Redundant SSLSM)
• Viewing Certificate Export Wizard Summary
• Viewing the Certificate Export Status
PKCS#12
Step 1 Select the certificates and format. For details, see Selecting Certificates and Format (PEM, PKCS#12).
Step 2 Select a destination. For details, see Specifying the Destination (PKCS#12).
Exporting to Remote system
Step 1 Select the certificates and format. For details, see Selecting Certificates and Format (PEM, PKCS#12).
Step 2 Select a destination. For details, see Specifying the Destination (PKCS#12).
Step 3 Specify the destination details. For details, see
• Specify Destination Details (PKCS#12 - Remote System)
• Viewing Certificate Export Wizard Summary
• Viewing the Certificate Export Status
Exporting to Redundant SSLSM
Step 1 Select the certificates and format. For details, see Selecting Certificates and Format (PEM, PKCS#12).
Step 2 Select a destination. For details, see Specifying the Destination (PKCS#12).
Step 3 Specify the destination details. For details, see
• Specify Destination Details (PKCS#12 - Redundant SSLSM)
• Viewing Certificate Export Wizard Summary
• Viewing the Certificate Export Status
Understanding Wizards
Wizards helps you to configure keys, certificates, and proxy services. You can access Certificate Wizards and Proxy Service Wizards from this page.
Figure 3-1 Wizards page
The following topics are included in this section:
Certificate Wizards
The Certificate Wizards helps you to configure keys and certificates. You can either create certificates and enroll them to the CA or import the certificates and the associated keys from an external PKI system. You can export the certificates and private keys using wizards.
• Configuring a Certificate Trustpoint Using the Wizard
• Importing Certificates from an External PKI System
• Exporting Certificates Using the Wizard
• Exporting Certificates in Bulk Using the Certificate Export Wizard
Proxy Service Wizards
The Certificate Wizards helps you to configure Proxy Services.
• Basic Proxy Service Wizard, page 7-3
• Advanced Proxy Service Wizard, page 7-8
Launching Certificate Wizards
To launch certificate wizards, do one of the following:
Step 1 Click Setup in the task bar. The Setup page appears.
Step 2 Click Wizard in the left-most pane. The Wizards information page appears.
Step 3 Click the Certificate Wizards tab to create a CertificateTrustpoint.
You can select either of the following tasks:
–Configure Certificate Trustpoint
–Import Certificates and Private Key.
–Export Certificates and Private Key.
Step 4 Select one of the tasks, then click Launch the Selected Task. The Trustpoint Setup wizard appears with information on the steps to follow.
Or:
Step 1 Click Setup at the top of the window, click PKI in the left-most pane, and select Certificate Trustpoints from the object Selector.
Step 2 Click the Setup Wizard and select either of the following wizards:
–Configure Certificate Trustpoint
–Import Certificates and Private Key.
–Export Certificates and Private Key.
Configuring a Certificate Trustpoint Using the Wizard
You can use the wizard to configure a certificate Trustpoint, authenticate, and enroll with a CA using the wizard.
To configure a certificate trustpoint:
Step 1 Click Setup in the task bar. The Setup page appears.
Step 2 Click Wizards in the left-most pane. The Wizards information page appears.
Step 3 Click the Certificate Wizards. The Certificate Wizards page appears.
Step 4 Select Configure Certificate Trustpoint, then click Launch the Selected Task. The Trustpoint Configuration dialog box appears. The dialog box provides information on the steps to be followed to configure a Trustpoint.
You can use the wizard to configure either of the following Trustpoints:
•Proxy Service Trustpoint.
•CA Trustpoint.
Step 5 Click Next to continue.
Setting up a Proxy Service Trustpoint
You can use any one of the following options to set up a proxy service trustpoint:
•Create a new proxy service Trustpoint.
•Configure a proxy service Trustpoint using the copy-and-paste method.
To create a new Proxy Service Trustpoint:
Step 1 Click Setup in the task bar. The Setup page appears.
Step 2 Click Wizard in the left-most pane. The Wizards information page appears.
Step 3 Click the Proxy Service Wizards tab to create a proxy service Trustpoint.
Step 4 Configure Trustpoint name and RSA key pair.
Step 5 (Optional) Configure SSL certificate attributes, then click Next.
Step 6 Configure enrollment parameters, then click Next.
Step 7 Select Trustpoint setup tasks, then click Next. The summary dialog box appears.
Step 8 Click Finish. The Deliver Configuration to SSLSM dialog box appears with the details on the CLI commands to be delivered to the module.
Step 9 Click Deliver to deliver the CLI commands. The Trustpoint Configuration Status dialog box appears.
To configure a Proxy Service Trustpoint using the copy-and-paste method:
Step 1 Configure Trustpoint name and RSA key pair.
Step 2 (Optional) Configure SSL certificate attributes, then click Next.
Step 3 Configure enrollment parameters, then click Next.
Step 4 Specify CA certificate, then click Next.
Step 5 Select Trustpoint setup tasks, then click Next. Summary dialog box appears.
Step 6 Click Finish.
Setting up a CA Trustpoint
To configure a CA Trustpoint:
Step 1 Configure Trustpoint Name.
Step 2 Specify CA Certificate source.
To configure a CA Trustpoint using the copy-and-paste method:
Step 1 Configure Trustpoint Name.
Step 2 Specify CA Certificate source.
Step 3 Specify CA Certificate.
Configuring a Trustpoint and RSA Key Pair
The Configure Trustpoint and RSA Key Pair page helps you set up a proxy service Trustpoint or a CA Trustpoint. You can either use an existing key pair for the Trustpoint or generate a new key pair.
Note If you are creating the Trustpoint for the first time, generate a new key pair. You will not be able to use an existing key pair.
The following fields appear:
Configuring SSL Certificate Attributes
The SSL Certificate Attributes wizard page allows you to enter the SSL certificate attributes for the certificate Trustpoint. Even though it is not mandatory to fill any of these fields, we recommend you to fill the common name (CN) field.
The following fields appear on the SSL certificate attributes dialog box:
Configuring Enrollment Parameters
The Configure Enrollment Parameters page of the wizard allows you to specify the enrollment parameters for your certificate authority.
The following field appears in the configure enrollment parameters page:
Field DescriptionCA
The name of the certificate authority.
•If you are configuring enrollment parameters for a new CA, choose the field display as <NEW>.
•If you want to enroll with a CA already configured, select the CA from the list and modify the parameters.
Simple Certificate Enrollment Protocol (SCEP)
Select this to use the SCEP.
CA Server URL
URL of the CA server.
Challenge Password
Enter a Challenge Password.
Confirm the Password
Confirm the challenge password.
Retry Count
Number of retries.
Enable Auto-Enrollment
Select to enable auto-enrollment.
Retry Period (Minutes)
Time to wait for the next retry.
HTTP Proxy
URL of the HTTP proxy to be used for the enrollment.
Port
The port to be used for the enrollment.
TFTP
Select this if you are using TFTP.
CA Server URL
URL of the CA server.
Example: tftp://ipaddress/Certificates/filename
The suffix.ca is appended to the file name.
Copy and Paste / Local Hard Disk
Select this option to Copy-and-Paste the Certificate or specify Certificate from the local Hard Disk.
The TFTP and cut-and-paste feature allows you to generate a certificate request and accept certification authority certificates as well as router certificates. These tasks are accomplished with a TFTP server or manual cut-and-past operations.
You may want to use TFTP or manual cut-and-paste enrollment in the following situations:
•Your certificate authority does not support Simple Certificate Enrollment Protocol (SCEP).
•A network connection between the router and certificate authority is not possible. The router running Cisco IOS software obtains its certificates using a network connection between the router and the certificate authority.
Selecting a CA Certificate Source
The CA Certificate Source page of the wizard allows you to specify the source of the CA certificate. You can import a CA certificate or a CA certificate chain. You can import a certificate chain using X.509 PEM or PKCS#7 format.You can select any of the following formats:
•X.509 PEM
•X.509 DER
•PKCS#7
Note To import the certificate using SCEP, select the PKCS#7 format.
If you have selected X.509PEM, the following options appear:
•Local Hard Disk—Select this option to import the CA certificate from the client machine.
•Copy and Paste—Select this option to import the CA certificate using copy and paste method.
•TFTP—Select this option to import the CA certificate from a TFTP server.
•Select the Import a CA Certificate Chain check box to import the certificate chain.
If you have selected X.509 DER, you need to select the CA Certificate File. Click Browse and browse to the directory where you have the certificate file, then select the file.
If you have selected PKCS#7, the following fields appear:
Click Next to continue.
Importing a CA Certificate Chain
You can specify all the certificates in a certificate chain and the wizard will create CA Trustpoints for each of the CA certificate.
A suffix is added to Trustpoint name based on whether the CA certificate is a root or sub-ordinate CA certificate. You can edit the default Trustpoint name by using the CA Trustpoints tab. As the certificates are added, the status of the certificate and certificate chain is displayed.
To import a CA certificate chain:
Step 1 Configure Trustpoint Name.
Step 2 Specify CA Certificate source as X.509 PEM.
Step 3 Select the source from where you want to import the certificate chain. The options are: Local Hard Disk, Copy and Paste, TFTP.
Step 4 Select Import a CA Certificate Chain check box.
•If you have selected Local Hard Disk, see Importing a CA Certificate Chain from a Local Hard Disk.
•If you have selected Copy and Paste, see Importing a CA Certificate Chain using Copy and Paste.
•If you have selected Local Hard Disk, see Importing a CA Certificate Chain from a TFTP Server.
Importing a CA Certificate Chain from a Local Hard Disk
Step 1 Configure Trustpoint Name.
Step 2 Specify CA Certificate source as X.509 PEM.
Step 3 Select Local Hard Disk.
Step 4 Select Import a CA Certificate Chain check box, then click Next. The Specify CA Certificate page appears.
Step 5 Specify the CA certificates in the CA Certificate Chain
Step 6 Click Next to continue.
To specify the certificates in the certificate chain:
Step 1 Click Add. The Add a Certificate popup window appears.
Step 2 Click Browse to browse to the directory where you have the certificate file and select it.
Step 3 Click OK.
Note When specifying the certificates in the certificate chain, add Root CA through the subordinate CA in accordance with the certificate hierarchy.
Importing a CA Certificate Chain using Copy and Paste
Step 1 Configure Trustpoint Name.
Step 2 Specify CA Certificate source as X.509 PEM.
Step 3 Select Copy and Paste.
Step 4 Select Import a CA Certificate Chain check box, then click Next. The Specify CA Certificate page appears.
Step 5 Specify the CA certificates in the CA Certificate Chain.
Step 6 Click Next to continue.
To specify the certificates in the certificate chain:
Step 1 Click Add. The Add a Certificate popup window appears.
Step 2 Copy and Paste the certificate in PEM format to the Certificate field.
Click Clear to remove the content or click View Details to view the details of the certificate.
Step 3 Click OK to add the certificate.
Note When specifying the certificates in the certificate chain, add Root CA through the subordinate CA in accordance with the certificate hierarchy.
Importing a CA Certificate Chain from a TFTP Server
To import a CA certificate chain from a TFTP server:
Step 1 Configure Trustpoint Name.
Step 2 Specify CA Certificate source as X.509 PEM.
Step 3 Select TFTP.
Step 4 Select Import a CA Certificate Chain check box, then click Next. The Specify CA Certificate page appears.
Specify the CA certificate in the certificate chain. You must specify all certificates in the chain from root CA.
The following fields appear:
Field DescriptionCA Level
Level of CA in the certificate chain.
CA Certificate File
URL (TFTP) of the CA certificate.
Trustpoint Name
Name of the Trustpoint to which the CA certificate is imported.
You can add certificates to the list. To add a CA certificate:
Step 1 Click Add. The Add a Certificate popup window appears.
Step 2 Enter the TFTP Server IP address.
Step 3 Enter the file name. The certificate file name must have a.ca extension.
Note The validity of the certificate or the completeness of the certificate chain is not validated. Please make sure that you specify valid CA certificates and all the certificates are in the certificate chain.
Note When specifying the certificates in the certificate chain, add Root CA through the subordinate CA in accordance with the certificate hierarchy.
Configuring Trustpoint Tasks
The Trustpoint Setup Tasks wizard page allows you to select a Trustpoint configuration task that you want to perform on the certificate Trustpoint.
You can select one of the following tasks:
Viewing Wizard Summary
When you use a wizard to perform a configuration, the wizard's Summary page displays the values that you have configured. You can examine those values and click the wizard's Back button to return to a screen on which you need to make a change. When you have made the changes, click the Finish button to save your changes and leave the wizard.
Delivering Configuration to an SSL Module
This page provides information on the CLI commands you have configured.
Click Deliver to deliver the commands to the module
Click Save to File to save the commands to a file.
Click Deliver Later to deliver the commands at a later point of time.
For more information on delivering CLI commands, see Delivering CLI Commands to the Device, page 1-22
Viewing Trustpoint Configuration Status
The Trustpoint Configuration Status dialog box provides the status details of the Trustpoint configuration tasks. The details displayed vary according to the task you selected. The dialog box displays the status against each task. The configuration performed on the module is displayed in the content area. If any task fails, you can review the task details and take necessary action.
Click OK to view the Certificate Signing Request (CSR). For more information on Certificate Signing Request (CSR), see Viewing Certificate Signing Request (CSR)
For authentication, after displaying the status, the finger print information appears. Verify the finger print displayed and accept the certificate to complete the authentication.
Viewing Certificate Signing Request (CSR)
The Certificate Request dialog box provides information on the certificate requested.
Click Save to File to save the certificate request. The file is saved with the default extension.csr.
Click Cancel to close the dialog box.
Importing and Exporting Certificates
You can use wizards to import and export certificates. This section contains the following information:
• Importing Certificates from an External PKI System
• Exporting Certificates Using the Wizard
• Exporting Certificates in Bulk Using the Certificate Export Wizard
Importing Certificates from an External PKI System
The Certificate Wizard allows you to import Certificates and Private Keys from an external PKI. You can import certificates in X.509 PEM, X.509 DER, PKCS#7, or PKCS#12 format.
To import certificates using Trustpoint Wizard:
Step 1 Click Setup in the CVDM-SSLSM task bar.The Setup page appears
Step 2 Click Wizards in the left-most pane. The dialog box appears.
Step 3 Select Import Certificates and Private Key, then click Launch the Selected Task. The Certificate Import Wizard appears.
You can import files in either of the following formats:
•X.509 PEM file, See Importing PEM File.
•PKCS#12 file, See Importing PKCS#12 File.
•X509 DER file
•PKCS#7 file
Importing PKCS#12 File
You can use an external PKI system to generate a PKCS#12 file and then import this file to the module.
When creating a PKCS#12 file, include the entire certificate chain, from server certificate to root certificate, and public and private keys. You can also generate a PKCS#12 file from the module and export it.
Note Imported key pairs cannot be exported.
If you are using SSH, we recommend using SCP when importing or exporting a PKCS#12 file. SCP authenticates the host and encrypts the transfer session.
To import a PKCS#12 File:
Step 1 Enter certificate format and source, then click Next. The Summary dialog box appears.
Step 2 Click Finish to complete importing the certificate.
Importing PEM File
To import a PEM File:
Step 1 Enter the format and source.
Step 2 Specify the certificate and key Files.
Step 3 Specify the private key.
Step 4 Specify SSL certificate.
Step 5 Click Next. The summary dialog box appears.
Step 6 Click Finish to complete importing the file.
You can copy and paste the CA Certificate in PEM format.
To import a PEM File using the copy-and-paste method:
Step 1 Enter the format and source
Step 2 Copy-and-paste the CA Certificate in PEM format.
Step 3 Click Next. The summary dialog box appears.
Step 4 Click Finish to complete importing the file.
Configuring Certificate Source and Format
The Certificate Source and Format page of the wizard allows you to enter the Trustpoint name, format and source.
You can select any of the following formats and select the source of the certificates and private key:
•X.509 PEM
•PKCS#12
•X.509 DER
•PKCS#7
X.509 PEM
Step 1 Select one of the following PEM formats:
•Local Hard Disk—to import certificates from the client workstation.
•Copy and Paste—to import certificates and key using copy-and-paste method.
•Remote system—to import certificates from a remote system using TFTP, FTP, RCP, or SCP.
Step 2 (Optional) Select Import Certificate Chain to import the certificate chain associated with the Trustpoint. (This option is available only if you select Local Hard Disk or Copy and Paste)
Step 3 Select one of the option, then click Next.
•If you have selected Local Hard Disk and Import Certificate Chain, the next step is specifying certificates and key pairs.
•If you have selected Copy and Paste, and Import Certificate Chain, the next step is specifying CA certificates.
PKCS#12
Step 1 Select PKCS#12, the following fields will be displayed:
X.509 DER
PKCS#7
The wizard will use the following suffixes when creating the CA Trustpoints:
•Root CA Certificate: -rootCA
•Sub-ordinate CA Certificate: -subCA<level>
A passphrase protects a PEM file that contains a private key. The PEM file is encrypted by DES or 3DES.
Enter the details, then click Next.
Specifying Certificates and Private Key
If you have selected to import a certificate chain in X.509 PEM format from the local hard disk you need to specify the CA certificates, SSL (Server/Client) certificate and private key.
You must specify all CA certificates in the chain from the root CA to the issuer of the SSL certificate.
The following fields appear:
Specifying CA Certificates
If you have selected to import a certificate chain in X.509 PEM format using the copy and paste method, you need to specify the CA certificates from the root CA to the issuer of the SSL certificate. The following fields appear:
Click Next to continue.
Configuring Certificates and Key Files (PEM - Local Hard Disk)
The Certificates and Key Files dialog box allows you to specify the location of the certificates and key files.
The following fields are displayed:
Note A passphrase protects a PEM file that contains a private key. The PEM file is encrypted by DES or 3DES. The encryption key is derived from the pass phrase. A PEM file containing a certificate is not encrypted and is not protected by the pass phrase.
Configuring Certificates and Key Files (PEM - Remote System)
The Certificates and Key Files dialog box allows you to specify the location of the certificates and key files.
The following fields appear:
Note A passphrase protects a PEM file that contains a private key. The PEM file is encrypted by DES or 3DES. The encryption key is derived from the pass phrase. A PEM file containing a certificate is not encrypted and is not protected by the pass phrase.
Specifying a CA Certificate (PEM)
This page of the wizard allows you to copy-and-paste the CA certificate in PEM format.
In Certificate Trustpoint Setup Wizard you can browse and specify the CA certificate file.
In Certificate Import Wizard you can select the CA certificate from the CA (Certificate Issuer) drop-down list. If you select any of the CA, the certificate details are displayed.
Click Next to continue.
Specifying Private Key (PEM Format)
Copy and paste the RSA private key in PEM format and enter the passphrase used to protect the key.
Click Next to continue.
Specifying SSL Certificate (PEM Format)
Copy and paste the SSL Certificate in PEM format.
Click Next to continue.
Viewing the Summary
When you use a wizard to perform a configuration, the wizard's Summary screen displays the summary of the certificate you are about to import.
You can examine the values and click the Back button to return to a screen on which you need to make a change. When you have made the changes, click the Finish button to import the certificate and leave the wizard.
Delivering Configuration to SSL Module
This page provides information on the CLI commands you have configured.
Click Deliver to deliver the commands to the module
Click Save to File to save the commands to a file.
Click Deliver Later to deliver the commands at a later point of time.
For more information on delivering CLI commands, see Delivering CLI Commands to the Device, page 1-22
Viewing the Certificate Import Status
The certificate import status dialog box dialog box provides the status details of the Trustpoint configuration tasks. The details displayed vary according to the task you selected. The dialog box displays the status against each task.
The configuration performed on the module is displayed in the content area. If any task fails, you can review the task details and take necessary action.
Exporting Certificates Using the Wizard
You can export certificates using either PKCS#12 file format or privacy-enhanced mail (PEM) file format.
Exporting certificates of more than one Trustpoint
To export certificates of more than one Trustpoint, see Export Certificates and Private Keys.
Exporting certificates of a selected Trustpoint
Step 1 Click Setup at the top of the window, click PKI in the left-most pane, and select Trustpoints from the object Selector. The Trustpoint page appears.
Step 2 Select a Trustpoint node from the logical group. You can group the Trustpoints using Trustpoint Grouper.
Step 3 Select a Trustpoint from the list.
Step 4 Click Operations, then select Export from the popup menu.
Step 5 The Trustpoint Export Wizard appears.
You can export Trustpoints in using PKCS#12 or PEM format.
For more information on exporting Trustpoints in PKCS#12 file format, see Exporting PEM Files.
For more information on exporting Trustpoints in PKCS#12 file format, see Exporting PKCS#12 Files.
Exporting PKCS#12 Files
To export a PKCS#12 File:
Step 1 Enter Certificate Format and Destination, the click Next. The summary page appears.
Step 2 Click Finish to compete exporting the file.
Exporting PEM Files
To export a PEM File:
Step 1 Enter certificate format and destination, the click Next.
You can select any of the following:
•Local Hard Disk—to export certificates and keys to the client workstation.
•Copy-and-Paste—to export certificates and keys using copy-and-paste method.
•Remote System—to export certificates and keys using TFTP, FTP, RCP or SCP.
Step 2 Specify Certificate and Key files. The fields change depending on the source you have selected.
Step 3 Click Finish to complete exporting the files.
Certificate Format and Destination
The Certificate Format and Destination page of the wizard allows you to specify the Trustpoint name and then select the format and destination.
The dialog box displays following fields:
If you select PEM, the following fields appear:
If you select PKCS#12, the following fields appear:
Certificate and Key Pair Files (PEM - Local Hard Disk)
The Certificate and Key Pair Files (PEM Local Hard Disk) page of the wizard allows you to export PEM files from your local hard disk.
The following fields appear:
Certificate and Key Pair Files (PEM - Remote File System)
The Certificate and Key Pair File (PEM Remote File System) page of the wizard allows you to export a PEM file from a remote file system.
This page allows you to protocol, certificate and private key file destination details.
The following fields appear:
Viewing Certificate Export Wizard Summary
When you use a wizard to perform a configuration, the wizard's Summary page displays the values that you have configured. You can examine those values and click the wizard's Back button to return to a screen on which you need to make a change. When you have made the changes, click the Finish button to save your changes and leave the wizard.
Viewing the Certificate Export Status
The certificate export status dialog box dialog box provides the status details of the certificate export tasks. If the task fails, you can review the task details and take necessary action.
Exporting Certificates in Bulk Using the Certificate Export Wizard
The Certificate Export Wizard allows you to select multiple Certificates and Private Keys and export them.
To export certificates using Certificate Export Wizard:
Step 1 Click Setup in the CVDM-SSLSM task bar.The Setup page appears
Step 2 Click Wizards in the left-most pane. The Setup Wizards information appears in the content area.
Step 3 Select Export Certificates and Private Keys, then click Launch the Selected Task. The Certificate Export Wizard appears.
You can export the certificates in either of the following formats:
•X.509 PEM
•PKCS#12
To export certificates and private keys in X.509 PEM format:
Step 1 Select Certificates and Format (X.509).
Step 2 Specify the Destination Details
Step 3 View the Status.
To export certificates and private keys in PKCS#12 format:
Step 1 Select Certificates and Format (X.509).
Step 2 Select the Destination.
Step 3 Specify the Destination details.
Selecting Certificates and Format (PEM, PKCS#12)
This page of the wizard helps you to specify the certificates to be exported and the format in which you want them to be exported.
The certificates are listed in the Certificates table. The following fields are displayed:
Field DescriptionSSL Certificate Subject
The subject of the SSL certificate.
Certificate TrustPoint
The Trustpoint name of the certificate.
Select Export CA Certificate in the Chain to export the CA Certificates in the certificate chain of the selected certificates.
You can add and remove Certificates from the list:
•Click Add to add certificates to the export list. A popup window appears with the list of Trustpoints and Proxy Services. Select the Trustpoint or proxy services from the list, then click OK.
•Select a certificate and click Remove to remove a certificate from the export list.
Select the Format in which you want to export the certificate. You can export the certificates in X.509 PEM format or PKCS#12 format.
If you have selected X.509 PEM format, specify the following:
Field DescriptionEncryption
The following are the encryption options:
3DES
Passphrase
Enter the passphrase.
Confirm Passphrase
Re-enter the passphrase to confirm.
Select the check box against Export CA Certificates in certificate chains to enable the export of the CA certificates in certificate chains.
If you have selected PKCS#12, specify the following:
Field DescriptionPassphrase
Enter the passphrase.
Confirm Passphrase
Re-enter the passphrase to confirm.
Adding Certificates and Trustpoints for exporting
To add certificates and trustpoints to the export list:
Step 1 Click Setup in the CVDM-SSLSM task bar.The Setup page appears
Step 2 Click Wizards in the left-most pane. The Setup Wizards information appears in the content area.
Step 3 Select Export Certificates and Private Keys, then click Launch the Selected Task. The Certificate Export Wizard appears.
Step 4 Click Add. A popup window appears with the list of Trustpoints and Proxy Services.
Step 5 Click the tabs to select Trustpoint or Proxy Services.
Step 6 Select the Trustpoint or Proxy Service from the list.
Step 7 If you select Trustpoint, the following fields appear:
Field DescriptionTrustpoint Name
The name of the Trustpoint.
Subject Name
The name of the subject.
Issuer Name (CA)
The name of the issuer.
Step 8 Select a Trustpoint Name and click OK to add or click Cancel to close the window.
Step 9 If you select Proxy Services, the following fields appear:
Field DescriptionProxy Service Name
The name of the proxy service.
Subject Name
The name of the subject.
Issuer name (CA)
The name of the issuer.
Step 10 Select a Proxy Service Name and click OK to add or click Cancel to close the window.
Specifying the Destination (PEM)
You can select any one of the following destination for theX.509 Format:
•Local Hard Disk—To export the certificate and private key to this client machine.
•Copy and Paste—To export the certificates and private key using copy and paste method.
•Remote System—To export the certificates and private keys to a remote server using TFTP, FTP, SCP, or RCP.
•Redundant SSLSM—To export the certificates and private keys to a redundant SSL services module.
Note Copy and Paste and Remote System options will be disabled if you select more than one certificate.
Specify Destination Details (PEM - Local Hard Disk)
You can specify the destination details using this page.
The following fields are displayed:
If you have selected the Export CA Certificate in Certificate Chains in the step 1 then the CA Certificates in Certificate Chains table with the following details are displayed.
Fields Description Certificate Authority (CA) NameDisplays the chain of certificate authority names.
CA Certificate FileDisplays the chain of CA certificate file names.
Click Next to continue.
Specify Destination Details (Copy and Paste)
This page is enabled only when exporting a single Trustpoint. Once the export is completed, exported certificates and privates keys are displayed. You can copy and paste the certificate and save the file.
Specify Destination Details (PEM - Remote System)
Specify the details of the Remote system where you want the certificates and private keys to be exported.
The following fields are displayed:
To edit the CA certificate, SSL certificate, and, Private Key, select the Trustpoint name in the table and click Edit.
Click Next to continue.
Specify Destination Details (PEM - Redundant SSLSM)
You can export certificates to a redundant SSLSM. The Wizards will use the same Trustpoint name as the selected Trustpoint on the redundant SSLSM. You can edit the names if required.
Note Do not specify a Trustpoint name that already exists in the redundant SSLSM. If the Trustpoint name is already present, the export will fail.
The following fields are displayed:
To edit the redundant SSLSM Trustpoint Name select the row in the table and click Edit.
If you have selected the Export CA Certificate in Certificate Chains in the step 1 then the CA Certificates in Certificate Chains table with the following details are displayed.
To edit the redundant SSLSM Trustpoint Name select the row in the table and click Edit.
Click Next to continue.
Specifying the Destination (PKCS#12)
You can select any one of the following destination for theX.509 Format:
•Remote System—To export the certificates and private keys to a remote server using TFTP, FTP, SCP, or RCP.
•Redundant SSLSM—To export the certificates and private keys to a redundant SSL services module.
Specify Destination Details (PKCS#12 - Remote System)
Specify the details of the Remote system where you want the certificates and private keys to be exported.
The following fields are displayed:
To edit the PKCS#12 files, select the row in the table and click Edit.
Click Next to continue.
Specify Destination Details (PKCS#12 - Redundant SSLSM)
You can export certificates to a redundant SSLSM. The Wizards will use the same Trustpoint name as the selected Trustpoint on the redundant SSLSM. You can edit the names if required.
You need to specify a staging area. The certificates are exported to the staging area and then imported to the redundant SSLSM from the staging area.
Note Do not specify a Trustpoint name that already exists in the redundant SSLSM. If the Trustpoint name is already present, the export will fail.
To edit the PKCS#12 files and Redundant SSLSM Trustpoints, select the SSL Certificate Subject in the table and click Edit.
Click Next to continue.
Viewing Certificate Trustpoints
The Certificate Trustpoint page shows all certificate Trustpoints configured on the SSL Services Module.
Figure 3-2 Public Key Infrastructure Page
To view all Trustpoints:
Step 1 Click Setup at the top of the window, click PKI in the left-most pane, and select Certificate Trustpoints from the object Selector.
The following information is displayed for Trustpoints:
Select a Trustpoint name from the table to view the following Trustpoint status details.
You can launch wizards to configure a Trustpoint. To launch the wizard, click Setup Wizard, then select one of the following options:
•Configure a Certificate Trustpoint...
•Import Certificates from External PKI...
Select a Trustpoint, then click Delete to delete a trustpoint.
Certificate Trustpoint Grouper
You can group Trustpoints based on different common parameters.
To group the Trustpoints:
Step 1 Select one of the options:
•Group by Enrollment Status—to group Trustpoints based on the enrollment status. The Trustpoints are displayed under the following groups.
–SSL Certificates—all Trustpoints that have an SSL Certificate.
–Enrollment Pending—all Trustpoints that have a CA certificate and key pair configured but do not have an SSL certificate.
–CA Certificates—all Trustpoints that have a CA certificate configured but the key pair is not configured. All the CA Trustpoints will be grouped under this group.
–No Certificates—all Trustpoints that do not have any certificate associated with it.
•Group by Expiry—to group Trustpoints based on the expiry date. The Trustpoints are displayed under groups starting with the Trustpoints expiring this month, then next month and so on.
•Group by CA—to group Trustpoints by CA.
•No Grouping—to list all Trustpoints without any group.
Based on your selection, Trustpoints are grouped under the Trustpoints node in the object Selector.
Certificate Trustpoint Details
You can view the configuration and certificate details of a selected Trustpoint.
Figure 3-3 Public Key Infrastructure Details
Step 1 Click Setup at the top of the window, click PKI in the left-most pane, and select Trustpoints from the object Selector. The Trustpoint page appears.
Step 2 Select a Trustpoint object from the logical group. You can group the Truspoints using Trustpoint Grouper. For more on Certificate Trustpoint Grouper, see Certificate Trustpoint Grouper.
Step 3 Click Configuration Tab.
The following fields are displayed:
To view SSL certificate details, click SSL Certificate Tab.
To view CA Certificate details, click CA Certificate Tab.
To view Certificate chain details, click Certificate Chain Tab. The certificate chain is displayed in tree format. Each node displays the subject of the certificate.
You can view the details of each certificate on the chain. The following fields are displayed:
Click Operations and select any one of the following Trustpoint operations:
Trustpoint Operation DescriptionAuthenticate
Select this option to authenticate a CA certificate.You must configure the enrollment method for the Trustpoint to perform this operation.
For more information on authenticating a Trustpoint, see Authenticating Trustpoints
Enroll
Select this option to create a certificate request. You must configure the enrollment method and key pair to perform this operation.
For manual enrollment methods (Copy and Paste/TFTP) a certificate request will be created. For SCEP enrollment, the certificate request will be sent to the CA server.
For SCEP enrollment, you must configure a Challenge Password. If password is not configured, a challenge password dialog box will appear.
For more information on authenticating a Trustpoint, see Enrolling Trustpoints
Authenticate and Enroll
Select this option to authenticate a CA certificate and create a certificate request. For manual enrollment (Copy and Paste/TFTP) a certificate request will be created. For SCEP enrollment, the certificate request will be sent to the CA server.
You must configure enrollment method and key pair for the Trustpoint to perform this operation.
For SCEP enrollment, you must configure a Challenge Password. If password is not configured, a challenge password dialog box will appear.
For more information on authenticating a Trustpoint, see Authenticating and Enrolling Trustpoints
Import SSL Certificate
Select this option to import an SSL certificate issued by the CA for manual enrollment (Copy and Paste/TFTP).
For more information on authenticating a Trustpoint, see Importing SSL Certificate Trustpoints
Renew
Select this option to create a new certificate request. You can optionally regenerate the keys when creating the certificate request.
For manual enrollment methods, a certificate request will be created. For SCEP enrollment, the certificate request will be sent to the CA server.
This option is enabled only for Trustpoints with SSL certificate.
For more information on authenticating a Trustpoint, see Renewing Trustpoints
Export
Select this option to export the certificate and private key associated with the Trustpoint. You can export the certificate only if the private key is exportable.
For more information on authenticating a Trustpoint, see Exporting Trustpoints
To edit the Trustpoint configuration, click Edit. For more information on editing Trustpoints, see Editing Trustpoint Configuration
Authenticating Trustpoints
The Trustpoint Authentication dialog box provides the authentication details and the status.
To authenticate a truspoint, do the following:
Step 1 Click Setup at the top of the window, click PKI in the left-most pane, and select Certificate Trustpoints from the object Selector. The Trustpoint page appears.
Step 2 Select a Trustpoint object from the logical group. You can group the Truspoints using Trustpoint Grouper. The Truspoint details dialog box appears with the configuration information.
Step 3 Click Operations, then select Authenticate. The Authentication dialog box appears.
Enrolling Trustpoints
To enroll a certificate truspoint, do the following:
Step 1 Click Setup at the top of the window, click PKI in the left-most pane, and select Certificate Trustpoints from the object Selector. The Trustpoint page appears.
Step 2 Select a Trustpoint object from the logical group. You can group the Certificate Truspoints using Grouper. The Truspoint details dialog box appears with the Configuration information.
Step 3 Click Operations, then select Enroll.
Authenticating and Enrolling Trustpoints
To authenticate and enroll a certificate truspoint, do the following:
Step 1 Click Setup at the top of the window, click PKI in the left-most pane, and select Certificate Trustpoints from the object Selector. The Trustpoint page appears.
Step 2 Select a Trustpoint object from the logical group. You can group the Certificate Truspoints using Grouper. The Truspoint details dialog box appears with the Configuration information.
Step 3 Click Operations, then select Authenticate and Enroll.
Importing SSL Certificate Trustpoints
To import a SSL Certificate, do the following:
Step 1 Click Setup at the top of the window, click PKI in the left-most pane, and select Certificate Trustpoints from the object Selector. The Trustpoint page appears.
Step 2 Select a Trustpoint object from the logical group. You can group the Certificate Truspoints using Grouper. The Truspoint details dialog box appears with the Configuration information.
Step 3 Click Operations, then select Import SSL Certificate.
Renewing Trustpoints
To renew a certificate trustpoint, do the following:
Step 1 Click Setup at the top of the window, click PKI in the left-most pane, and select Certificate Trustpoints from the object Selector. The Trustpoint page appears.
Step 2 Select a Trustpoint object from the logical group. You can group the Certificate Truspoints using Grouper. The Truspoint details dialog box appears with the Configuration information.
Step 3 Click Operations, then select Renew. The Trustpoint Operation - Renew popup dialog box appears with the following fields:
Step 4 Click OK to make changes.
Exporting Trustpoints
To export a SSL Certificate, do the following:
Step 1 Click Setup at the top of the window, click PKI in the left-most pane, and select Certificate Trustpoints from the object Selector. The Trustpoint page appears.
Step 2 Select a Trustpoint object from the logical group. You can group the Certificate Truspoints using Grouper. The Truspoint details dialog box appears with the Configuration information.
Step 3 Click Operations, then select Export SSL Certificate.
Editing Trustpoint Configuration
Step 1 Click Setup at the top of the window, click PKI in the left-most pane, and select Certificate Trustpoints from the object Selector.
Step 2 Select a Trustpoint from the table, then click Edit. The Trustpoint Edit dialog box appears with the following fields:
Field Action/Description GeneralTrustpoint Name
Name of the Trustpoint.
Key Pair Name
Name of the key pair associated with the Trustpoint.
Click and select one of the following:
•Create and use a new Key Pair
•Select an existing Key Pair
•Regenerate Key Pair
•Clear the Key Pair
Certificate Purpose
Select the purpose of the certificate from the list:
•ssl-client
•ssl-server
Enrollment ConfigurationEnrollment Method
Select one of the following certificate enrollment method:
•SCEP
•TFTP
•Copy and Paste
CA Server URL
Enter the enrollment URL of the certification authority server.
Retry Count
Enter the number of retries.
Retry Period
Enter the interval between the retries.
HTTP Proxy
Enter the IP address of the HTTP proxy.
Port
Enter the port number for the HTTP proxy.
Auto Renewal and Enrollment
Select the checkbox to enable auto renewal and enrollment.
Renewal Percentage (%)
Enter the percentage of renewal. Default is 100%.
Challenge Password
Enter the Challenge Password.
Click and select one of the following options:
•Configure a Challenge Password
•Clear Challenge Password
Regenerate Keys on Re-enrollment
Select this checkbox to regenerate key on re-enrollment.
CRL Configurationx.500 CDP Information
Enter the X.500 CDP information.
You can enter the hostname and port if the CDP is in X.500 DN format. The query takes the information in the following form: ldap://hostname:[port]
For example, if a certificate being validated has the following:
•The X.500 DN is configured with CN=CRL,O=Cisco,C=US
•The associated trustpoint is configured with crl query ldap://10.1.1.1
then the two parts are combined to form the complete URL as follows:
ldap://10.1.1.1/CN=CRL,O=Cisco,C=US.
Note The trustpoint should be associated with the issuer certificate authority certificate of the certificate being validated. If there is no such trustpoint in the database, the complete URL cannot be formed, and CRL download cannot be performed.
CRL Validation
Select the type of CRL validation to be used for the certificate:
•Default—If the trustpoint has been selected to validate a certificate. If the CRL is not in the database or has expired, the SSL module downloads a CRL and saves it to the database for later use. If the CRL download fails, the SSL module rejects the certificate being validated.
•Optional— If the SSL module finds a CRL in the database and has not expired, then the SSL module performs a CRL lookup. If the SSL module does not find CRL, the SSL module accepts the certificate. The SSL module makes no attempt to download a CRL.
•Best-effort—If the SSL module finds a CRL in the database and has not expired, then the SSL module performs a CRL lookup. If the SSL module does not find CRL, the SSL module attempts to download a CRL. However, if the CRL download fails, the SSL module accepts the certificate.
Certificate ACLCertificate ACL
Enter the Certificate ACL information.
Step 3 Modify the values, then click OK.
Selecting Available ACLs
The following information appears:
Select ACLs from the table, then click OK.
Selecting Available Key Pairs
The following information appears:
Select key pairs from the table, then click OK.
Certificate Hierarchy
Certificate Hierarchy helps you to browse through the certificates imported on the SSLSM and visualize the certificate hierarchy. You can also see the validity status and the certificate chain status in the certificate tree.
In the Associated Trustpoints table, you have the hyperlinks to the associated Trustpoints. You can view and configure the trustpoints by clicking the hyperlink.
To view the Certificate Hierarchy:
Step 1 Click Setup at the top of the window, click PKI in the left-most pane, and select Certificate Hierarchy from the object Selector. The certificate tree appears in the content pane.
Step 2 Select a certificate from the certificate hierarchy tree. The details of the selected certificate is displayed in the Certificate Details box and the associated Trustpoint names appears in the Associated Trustpoint box.
Figure 3-4 PKI > Certificate Hierarchy Page
Deleting Certificates
Step 1 Click Setup at the top of the window, click PKI in the left-most pane, and select Trustpoints from the object Selector.
Step 2 Select a Trustpoint from the table.
Step 3 Click Delete.
Challenge Password
Challenge password is required for SCEP enrollment. If you have not configured a challenge password, challenge password dialog will be prompted.
This password is necessary in the event that you ever need to revoke your certificate(s). When you ask the CA administrator to revoke your certificate, you must supply this challenge password as a protection against fraudulent or mistaken revocation requests.
The Challenge Password dialog box has got two fields. Challenge Password and Confirm Password. Enter the password and confirm it. Click OK to continue.
How Do I...
This section describes on how to achieve a task. The following questions are answered:
• How Do I Import an SSL Certificate and Private Key to SSLSM?
• How do I Import a CA Certificate Chain on the SSLSM?
• How do I generate a Certificate Signing Request (CSR)?
• How do I import the SSL certificate obtained using CSR?
• How Do I Export Certificates and Private Keys from SSLSM?
• How Do I Renew an SSL Certificate?
How Do I Import an SSL Certificate and Private Key to SSLSM?
The Certificate Import Wizard helps you to import the SSL certificate and the private key on the SSLSM. If you are importing the SSL certificate and private key from your client machine, you could also import the associated CA certificate chain.
Step 1 Click Setup in the CVDM-SSLSM task bar.The Setup page appears
Step 2 Click Wizards in the left-most pane. The Setup Wizard page appears.
Step 3 Select Import Certificates and Private key, then click Launch the Selected Task. The Certificate Import Wizard appears.
You can import files in any of the following format:
•PKCS#12
•X.509 PEM
•X.509 DER
•PKCS#7
Note When creating a PKCS#12 file, include the entire certificate chain, from server certificate to root certificate, and public and private keys. You can also generate a PKCS#12 file from the module and export it.
Note If you are using SSH, we recommend using SCP when importing or exporting a PKCS#12 file. SCP authenticates the host and encrypts the transfer session.
For details on Certificate Import Wizard, see Import Certificates and Private Key.
How do I Import a CA Certificate Chain on the SSLSM?
The Certificate Trustpoint Setup Wizard helps you to Import a CA certificate chain.
To configure a certificate Trustpoint:
Step 1 Click Setup in the task bar. The Setup page appears.
Step 2 Click Wizard in the left-most pane. The Wizards information page appears.
Step 3 Click the Certificate Wizards. The Certificate Wizards page appears.
Step 4 Select Configure a Certificate Trustpoint, then click Launch the Selected Task to launch the wizard.
You could Import a CA certificate chain using CA certificates in X.509 Privacy Enhanced Mail (PEM) format or PKCS#7 format.
Importing a CA certificate chain in PEM format
To import a CA certificate chain using CA certificates in PEM format, you need to perform the following tasks:
Step 1 Specify a Trustpoint name prefix. When importing a certificate chain, a CA certificate Trustpoint is setup for each of the CA certificates in the certificate chain. Select the CA Trustpoint.
Step 2 Select X.509 PEM from the format options, select the source from which you wish to import the CA certificates and select the Import a CA Certificate Chain option.
Step 3 Specify the CA certificates in the certificate chain. You must specify the CA certificates starting from the root CA certificate (self-signed certificate) to your subordinate CA. A Trustpoint name is automatically generated for the CA Trustpoints based on the prefix specified in Step 1. You can edit the Trustpoint names using the CA Trustpoints tab.Importing a CA certificate chain in PKCS#7 format
Review the summary and click Finish. A status dialog will be launched displaying the status of the certificate Trustpoint setup.
To import a CA certificate chain in PKCS#7 format, perform the following tasks:
Step 1 Specify a Trustpoint name prefix. When importing a certificate chain, a CA certificate Trustpoint will be setup for each of the CA certificates in the certificate chain. Select the CA Trustpoint.
Step 2 Select PKCS#7 from the format options. To import a PKCS#7 file from your client machine select the Local Hard Disk option and specify the PKCS#7 file. The wizard will decode the PKCS#7 file and list all the CA certificates in the file. A default Trustpoint name is automatically generated for each of the CA certificates based on the Trustpoint name prefix specified in Step 1. You can double-click on the row to edit the Trustpoint name.
Step 3 Specify the CA certificates in the certificate chain. You must specify the CA certificates starting from the root CA certificate (self-signed certificate) to your subordinate CA. A Trustpoint name will be automatically generated for the CA Trustpoints based on the prefix specified in Step 1. You can edit the Trustpoint names using the CA Trustpoints tab.
Review the summary and click Finish. A status dialog will be launched displaying the status of the certificate Trustpoint setup.
How do I generate a Certificate Signing Request (CSR)?
To generate a Certificate Signing Request (CSR), do the following tasks:
•If the Certificate Authority (CA) issuing your SSL certificate is a subordinate CA, import all the CA certificates in the certification path. If your CA is a root CA (self-signed CA certificate), you can skip this task.
•Configure a certificate Trustpoint, authenticate the CA certificate corresponding to the issuer of your SSL certificate, and generate a CSR.
The Certificate Trustpoint Setup Wizard helps you perform the above tasks.
Importing a CA certificate chain
Note If the issuing CA certificate is a self-signed certificate, you can skip this step.
For more details, see How do I Import a CA Certificate Chain on the SSLSM?
Configuring a Certificate Trustpoint
To configure a certificate Trustpoint:
Step 1 Click Setup in the task bar. The Setup page appears.
Step 2 Click Wizard in the left-most pane. The Wizards information page appears.
Step 3 Click the Certificate Wizards. The Certificate Wizards page appears.
Step 4 Select Configure a Certificate Trustpoint, then click Launch the Selected Task to launch the wizard.
Step 5 Specify a Trustpoint name and select the Proxy Service Trustpoint option. By default, a new RSA key pair will be generated with the same name as the Trustpoint. Specify the key size. If you already have the RSA key pair on the SSLSM, select the Use an Existing Key Pair option and specify the key pair name.
Step 6 Specify the certificate attributes - subject Distinguished Name (DN), unstructured name, unstructured IP address and, certificate purpose. These attributes are optional.
Step 7 Specify the enrollment method. SSLSM supports three methods of certificate enrollment.
•Automatic Enrollment using Simple Certificate Enrollment Protocol (SCEP)
If SCEP is used, SSLSM sends the certificate request (CSR) to the specified SCEP server. The SSL certificate issued by the CA is automatically imported.
• Manual Enrollment using TFTP
In this method, you must specify a filename on your TFTP server.
For example,
tftp://10.77.241.10/certs/mycert
SSLSM adds file extensions to the filename as follows:
–.ca when downloading the CA certificate from the TFTP server.
For example mycert.ca
–.req when copying the generated CSR to the TFTP server.
For example mycert.req
–.crt when downloading the SSL certificate from the TFTP server.
For example mycert.crt
•Manual Enrollment using Copy-and-Paste
In this method, the CSR is displayed to you. You can copy the CSR and submit it to your CA.
If certificate Trustpoints exists on the SSLSM, and are enrolled with CAs, the CA field lists the corresponding CA names. If you select a CA, the corresponding enrollment configuration is applied to the new Trustpoint.
Step 8 Specify the CA certificate
This step applies only to Copy-and-Paste method. When using the copy-and-paste method, you must specify the certificate of your CA issuing the SSL certificate.
For TFTP method, the SSLSM will download the CA certificate from the TFTP server.
Step 9 Select Authenticate the CA and Generate a CSR option from the setup task options and click Next.
Review the summary and click Finish. A status dialog will be launched displaying the status of the certificate Trustpoint setup.
When authenticating the CA certificate, the MD5 fingerprint of the CA certificate will be displayed. You need to manually verify the fingerprint and accept the certificate. For copy-and-paste method, the CSR will be displayed. For TFTP method, the CSR will be copied to the TFTP server.
How do I import the SSL certificate obtained using CSR?
Importing SSL Certificate using Certificate Trustpoint Setup Wizard
If you are using TFTP enrollment method, copy the SSL certificate obtained using the CSR to the TFTP server. You must use the filename configured in the Trustpoint with a.crt file extension.
Step 1 Specify the name of the certificate Trustpoint that you setup to generate the CSR.
Step 2 Skip this step.
Step 3 Skip this step.
Step 4 Select Import SSL Certificate from the setup task option.
Step 5 This step applies only if you are using copy-and-paste enrollment method. Copy and paste the SSL certificate in PEM format.
Review the summary and click Finish. A wizard status dialog will be launched displaying the status of the SSL certificate import.
Importing SSL Certificate from Trustpoint Details Screen
To import a SSL Certificate, do the following:
Step 1 Click Setup at the top of the window, click PKI in the left-most pane, and select Certificate Trustpoints from the object Selector. The Trustpoint page appears.
Step 2 Select a Trustpoint object from the logical group. The Truspoint details screen appears with the Configuration information.
Step 3 Click Operations, then select Import SSL Certificate.
Review the summary and click Finish. A wizard status dialog will be launched displaying the status of the SSL certificate import.
How Do I Export Certificates and Private Keys from SSLSM?
The Certificate Export Wizard helps you to export the SSL certificate and the private key from the SSLSM. If you are exporting the SSL certificate and private key to your client machine, you could also export the associated CA certificate chain.
For details of Certificate Export Wizard, see Export Certificates and Private Keys.
How Do I Renew an SSL Certificate?
You can renew Certificates and Key pairs.
Step 1 Click Setup at the top of the window, click PKI in the left-most pane, and select Trustpoints from the object Selector. The Trustpoint page appears.
Step 2 Select a Trustpoint node from the logical group. You can group the Truspoints using Trustpoint Grouper.
Step 3 Select a Trustpoint from the list.
Step 4 Click Operations, then select Renew from the popup menu.
Review the summary and click Finish. A status dialog will be launched displaying the status of the certificate Trustpoint setup.
Posted: Fri Apr 15 04:10:59 PDT 2005
All contents are Copyright © 1992--2005 Cisco Systems, Inc. All rights reserved.
Important Notices and Privacy Statement.