Cisco 500 Series, Configuration Manual

Page: 878 / 1140

39-24
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 39 Configuring Certificates
The Local CA
hostname (config-ca-server)# lifetime crl 72
hostname(config-ca-server)#
If the cdp-url command is set to serve the CRL directly from the Local CA security appliance, use the
publish-crl CLI command to open a port on an interface to make the CRL accessible from that interface.
The publish-crl command is detailed in the following section.
CRL Downloading
To make the CRL available for HTTP download on a given interface or port, use the publish-crl
command in config-ca-server mode. The specified interface and port are used to listen for incoming
requests for the CRL. Interface options are:
The optional port option can be any port number in a range of 1-65535, and TCP port 80 is the HTTP
default port number. For example, to specify port 70 for outside access to the CRL, use the following
command:
hostname(config)# crypto ca server
hostname (config-ca-server)# publish-crl outside 70
hostname(config-ca-server)#
The CDP URL can be configured to utilize the IP address of an interface, and the path of the CDP URL
and the file name can be configured also. For example, the CDP URL could be configured to be:
http://10.10.10.100/user8/my_crl_file
In this case only the interface with that IP address configured listens for CRL requests, and when a
request comes in, the security appliance matches the path /user8/my_crl_file to the configured CDP
URL. When the path matches, the security appliance returns the CRL file stored in storage. Note that the
protocol must be http, so the prefix is http://.
Note
If you do not specify a publish-crl command, the CRL is not accessible from the CDP location because
the publish-crl command is required in order to open an interface for downloading the CRL file.
Enrolling Local CA Users
Each user who wishes to be enrolled as a Local CA user must be added to the Local CA server user
database. User enrollment is initiated by the Local CA administrator who adds new users to the database
with the
crypto ca server user-db add command.
Next, the administrator issues a crypto ca server user-db allow... command, and, if email-OTP is
specified, the Local CA Server e-mails a one-time-password and username to the new user to enable
enrollment. The e-mail, an automatically generated message, contains the enrollment URL of the
security appliance.
Figure 39-2 shows a sample e-mail to a new user.
inside name of interface
GigabitEthernet0/1
management name of interface Management0/0
outside name of interface
GigabitEthernet0/0