Cisco PIX 525 Specifikace stáhnout pdf (Strana 481)

29-15

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 29 Configuring Certificates

Certificate Configuration

The key pair imported with the trustpoint is assigned a label matching the name of the trustpoint you

create. For example, if an exported trustpoint used an RSA key labeled <Default-RSA-Key>, creating

trustpoint named Main by importing the PKCS12 creates a key pair named Main, not

<Default-RSA-Key>.

Note If a security appliance has trustpoints that share the same CA, only one of the trustpoints sharing the CA

can be used to validate user certificates. The crypto ca import pkcs12 command can create this

situation. Use the support-user-cert-validation command to control which trustpoint sharing a CA is

used for validation of user certificates issued by that CA.

The following example manually imports PKCS12 data to the trustpoint Main with the passphrase

Wh0zits:

hostname (config)# crypto ca import Main pkcs12 Wh0zits

Enter the base 64 encoded pkcs12.

End with a blank line or the word "quit" on a line by itself:

[ PKCS12 data omitted ]

quit

INFO: Import PKCS12 operation completed successfully

hostname (config)#

Configuring CA Certificate Map Rules

You can configure rules based on the Issuer and Subject fields of a certificate. Using the rules you create,

you can map IPSec peer certificates to tunnel groups with the tunnel-group-map command. The

security appliance supports one CA certificate map, which can contain many rules. For more information

about using CA certificate map rules with tunnel groups, see the “Creating a Certificate Group Matching

Rule and Policy” section on page 23-9.

To configure a CA certificate map rule, perform the following steps:

Step 1 Enter CA certificate map configuration mode for the rule you want to configure. To do so, enter the

crypto ca certificate map command and specify the rule index number. The following example enters

CA certificate map mode for the rule with index number 1.

hostname(config)# crypto ca certificate map 1

hostname(config-ca-cert-map)#

Step 2 Use the issuer-name and subject-name commands to configure the rule. These commands specify tests

that the security appliance can apply to values found in the Issuer or Subject fields of certificates. The

tests can apply to specific attributes or to the whole of the Issuer or Subject fields. You can configure

many tests per rule, and all the tests you specify with these commands must be true for a rule to match

a certificate. Valid operators in the issuer-name and subject-name commands are as follows.

Operator Meaning

eq The field or attribute must be identical to the value given.

ne The field or attribute cannot be identical to the value given.

co Part or all of the field or attribute must match the value given.

nc No part of the field or attribute can match the value given.

1 2 ... 476 477 478 479 480 481 482 483 484 485 486 ... 603 604

Komentáře k této Příručce

Žádné komentáře

Cisco PIX 525 Specifikace Strana 481

Komentáře k této Příručce