Cisco CP-7911G-CH1, System Administrator Manual, Page: 197 / 322

Configuring Secure SRST for SCCP and SIP
How to Configure Secure Unified SRST
197
Cisco Unified SCCP and SIP SRST System Administrator Guide
OL-13143-04
Step 8
Copy all of the contents that appear between “-----BEGIN CERTIFICATE-----” and “-----END
CERTIFICATE-----” to a location where you can retrieve it later.
Step 9 Repeat Steps 5 to 8 for CiscoManufactureCA, CiscoRootCA2048, and CAPF.
Cisco Unified Communications Manager 6.0 and Later Versions
From Cisco Unified Communications Operating System Administration, download all certificates listed
under CAPF-trust, including Cisco_Manufacturing_CA, Cisco_Root_CA_2048, CAP-RTP-001,
CAP-RTP-002, CAPF, and CAPF-
xxx . Also download any CAPF- xxx certificates that are listed under
CallManager-trust and not under CAPF-trust.
For instructions on downloading certificates, see the “Security” chapter in the appropriate version of
Cisco Unified Communications Operating System Administration Guide.
Authenticating the Imported Certificates on the Cisco Unified SRST Router
To authenticate certificates on the Cisco Unified SRST router, perform these steps.
Restrictions
HTTP automatic enrollment from Cisco Unified Communications Manager through a virtual web server
is not supported.
SUMMARY STEPS
1.
crypto pki trustpoint name
2. revocation-check none
3.
enrollment terminal
4. exit
5.
crypto pki authenticate name
DETAILED STEPS
Command or Action Purpose
Step 1
crypto pki trustpoint name
Example:
Router (config)# crypto pki trustpoint CAPF
Declares the CA that your router should use and enters
ca-trustpoint configuration mode.
• name : Enter the name of each certificate individually
(for example, CAPF, CiscoCA, CiscoManufactureCA,
and CiscoRootCA2048).
Step 2
revocation-check none
Example:
Router(ca-trustpoint)# revocation-check none
Checks the revocation status of a certificate using the
selected method.
•
Using the none keyword is mandatory for this task.
The keyword none means that a revocation check is
not performed and the certificate is always accepted.
Step 3
enrollment terminal
Example:
Router(ca-trustpoint)# enrollment terminal
Specifies manual cut-and-paste certificate enrollment.