1-10
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring the TLS Proxy for Encrypted Voice Inspection
Configuring the TLS Proxy for Encrypted Voice Inspection
What to Do Next
Once you have created the trustpoints and generated the certificates, create the internal CA to sign the
LDC for Cisco IP Phones. See
Creating an Internal CA, page 1-10
Creating an Internal CA
Create an internal local CA to sign the LDC for Cisco IP Phones.
This local CA is created as a regular self-signed trustpoint with
proxy-ldc-issuer
enabled. You can use
the embedded local CA LOCAL-CA-SERVER on the ASA to issue the LDC.
Step 5
hostname(config-ca-trustpoint)#
subject-name
X.500_name
Example:
hostname(config-ca-trustpoint)#
subject-name
cn=EJW-SV-1-Proxy
Includes the indicated subject DN in the certificate
during enrollment
Cisco IP Phones require certain fields from the
X.509v3 certificate to be present to validate the
certificate via consulting the CTL file.
Consequently, the
subject-name
entry must be
configured for a proxy certificate trustpoint. The
subject name must be composed of the ordered
concatenation of the CN, OU and O fields. The CN
field is mandatory; the others are optional.
Note
Each of the concatenated fields (when
present) are separated by a semicolon,
yielding one of the following forms:
CN=xxx;OU=yyy;O=zzz
CN=xxx;OU=yyy
CN=xxx;O=zzz
CN=xxx
Step 6
hostname(config-ca-trustpoint)#
keypair
keyname
Example:
hostname(config-ca-trustpoint)#
keypair
ccm_proxy_key
Specifies the key pair whose public key is to be
certified.
Step 7
hostname(config-ca-trustpoint)#
exit
Exits from the CA Trustpoint configuration mode.
Step 8
hostname(config)#
crypto ca enroll
trustpoint
Example:
hostname(config)#
crypto ca enroll ccm_proxy
Starts the enrollment process with the CA and
specifies the name of the trustpoint to enroll with.
Command
Purpose
Command
Purpose
Step 1
hostname(config)#
crypto ca trustpoint
trustpoint_name
Example:
hostname(config)#
! for the internal local LDC
issuer
hostname(config)#
crypto ca trustpoint ldc_server
Enters the trustpoint configuration mode for the
specified trustpoint so that you can create the
trustpoint for the LDC issurer.
Step 2
hostname(config-ca-trustpoint)#
enrollment self
Generates a self-signed certificate.
Summary of Contents for 5505 - ASA Firewall Edition Bundle
Page 28: ...Glossary GL 24 Cisco ASA Series CLI Configuration Guide ...
Page 61: ...P A R T 1 Getting Started with the ASA ...
Page 62: ......
Page 219: ...P A R T 2 Configuring High Availability and Scalability ...
Page 220: ......
Page 403: ...P A R T 2 Configuring Interfaces ...
Page 404: ......
Page 499: ...P A R T 2 Configuring Basic Settings ...
Page 500: ......
Page 533: ...P A R T 2 Configuring Objects and Access Lists ...
Page 534: ......
Page 601: ...P A R T 2 Configuring IP Routing ...
Page 602: ......
Page 745: ...P A R T 2 Configuring Network Address Translation ...
Page 746: ......
Page 845: ...P A R T 2 Configuring AAA Servers and the Local Database ...
Page 846: ......
Page 981: ...P A R T 2 Configuring Access Control ...
Page 982: ......
Page 1061: ...P A R T 2 Configuring Service Policies Using the Modular Policy Framework ...
Page 1062: ......
Page 1093: ...P A R T 2 Configuring Application Inspection ...
Page 1094: ......
Page 1191: ...P A R T 2 Configuring Unified Communications ...
Page 1192: ......
Page 1333: ...P A R T 2 Configuring Connection Settings and QoS ...
Page 1334: ......
Page 1379: ...P A R T 2 Configuring Advanced Network Protection ...
Page 1380: ......
Page 1475: ...P A R T 2 Configuring Modules ...
Page 1476: ......
Page 1549: ...P A R T 2 Configuring VPN ...
Page 1550: ......
Page 1965: ...P A R T 2 Configuring Logging SNMP and Smart Call Home ...
Page 1966: ......
Page 2059: ...P A R T 2 System Administration ...
Page 2060: ......
Page 2098: ...1 8 Cisco ASA Series CLI Configuration Guide Chapter 1 Troubleshooting Viewing the Coredump ...
Page 2099: ...P A R T 2 Reference ...
Page 2100: ......