Cisco证书颁发机构管理.txt

noteId: 22EBDE3A86774ECBB56281661313EA12 · 原始路径：/ALL/世赛题目（练习） - 笔记/考核/11月份考核（第一次考核）/广东第三届省赛 C模块题目/C-模块/Cisco证书颁发机构管理.txt

CA-Server>

CA-Server>en

CA-Server#conf t

CA-Server(config)#ip domain-name wsc2023.gd

CA-Server(config)#do show clock

*12:03:15.354 UTC Wed Oct 18 2023

CA-Server(config)#

CA-Server(config)#ip http server

CA-Server(config)#crypto key generate rsa modulus 2048 label ROOTCA.key exportable

The name for the keys will be: ROOTCA.key

% The key modulus size is 2048 bits

% Generating 2048 bit RSA keys, keys will be exportable...

[OK] (elapsed time was 1 seconds)

CA-Server(config)#

*Oct 18 12:04:58.491: %SSH-5-ENABLED: SSH 1.99 has been enabled

CA-Server(config)#crypto pki server ROOTCA

CA-Server(cs-server)#issuer-name cn=wsc2023 root ca

CA-Server(cs-server)#hash sha256

CA-Server(cs-server)#grant ?

auto Automatically grant incoming SCEP enrollment requests

none Automatically reject any incoming SCEP enrollment request

ra-auto Automatically grant RA-authorized incoming SCEP enrollment request

CA-Server(cs-server)#exit

CA-Server(config)#do show run | sec pki

crypto pki server ROOTCA

no database archive

issuer-name cn=wsc2023 root ca

hash sha256

CA-Server(config)#crypto pki trustpoint ROOTCA

CA-Server(ca-trustpoint)#rsakeypair ROOTCA.key

CA-Server(ca-trustpoint)#exit

CA-Server(config)#do show run | sec pki

crypto pki server ROOTCA

no database archive

issuer-name cn=wsc2023 root ca

hash sha256

crypto pki trustpoint ROOTCA

revocation-check crl

rsakeypair ROOTCA.key

crypto pki certificate chain ROOTCA

CA-Server(config)#crypto pki server ROOTCA

CA-Server(cs-server)#no shut

CA-Server(cs-server)#no shutdown

%Some server settings cannot be changed after CA certificate generation.

% Please enter a passphrase to protect the private key

% or type Return to exit

Password: [需要输入密码]

Re-enter password: [需要输入密码]

% Certificate Server enabled.

CA-Server(cs-server)#

*Oct 18 12:08:19.701: %PKI-6-CS_ENABLED: Certificate server now enabled.

CA-Server(cs-server)#end

CA-Server#

*Oct 18 12:08:43.210: %SYS-5-CONFIG_I: Configured from console by console

CA-Server#show cry

CA-Server#show crypto pki

CA-Server#show crypto pki ser

CA-Server#show crypto pki server

Certificate Server ROOTCA:

Status: enabled

State: enabled

Server's configuration is locked (enter "shut" to unlock it)

Issuer name: cn=wsc2023 root ca

CA cert fingerprint: 4B92CA25 F7BF277A A5195DC0 FA6052A6

Granting mode is: manual

Last certificate issued serial number (hex): 1

CA certificate expiration timer: 12:08:19 UTC Oct 17 2026

CRL NextUpdate timer: 18:08:19 UTC Oct 18 2023

Current primary storage dir: nvram:

Database Level: Minimum - no cert data written to storage

CA-Server#

CA-Server#show crypto pki certificates verbose

CA Certificate

Status: Available

Version: 3

Certificate Serial Number (hex): 01

Certificate Usage: Signature

Issuer:

cn=wsc2023 root ca

Subject:

cn=wsc2023 root ca

Validity Date:

start date: 12:08:19 UTC Oct 18 2023

end date: 12:08:19 UTC Oct 17 2026

Subject Key Info:

Public Key Algorithm: rsaEncryption

RSA Public Key: (2048 bit)

Signature Algorithm: SHA256 with RSA Encryption

Fingerprint MD5: 4B92CA25 F7BF277A A5195DC0 FA6052A6

Fingerprint SHA1: E8416FD0 DE4A3844 7D61DE17 C1CE4075 F892EBCF

X509v3 extensions:

X509v3 Key Usage: 86000000

Digital Signature

Key Cert Sign

CRL Signature

X509v3 Subject Key ID: D86CFD12 F1B2F30E 6253DF83 A3158BBF DF630210

X509v3 Basic Constraints:

CA: TRUE

X509v3 Authority Key ID: D86CFD12 F1B2F30E 6253DF83 A3158BBF DF630210

Authority Info Access:

Associated Trustpoints: ROOTCA

CA-Server#

CA-Server#show cry

CA-Server#show crypto pki

CA-Server#show crypto pki ser

CA-Server#show crypto pki server ROOTCA re

CA-Server#show crypto pki server ROOTCA requests

Enrollment Request Database:

Subordinate CA certificate requests:
ReqID  State      Fingerprint                      SubjectName

--------------------------------------------------------------

RA certificate requests:
ReqID  State      Fingerprint                      SubjectName

--------------------------------------------------------------

Router certificates requests:
ReqID  State      Fingerprint                      SubjectName

--------------------------------------------------------------

1 pending 1CB667374E39BBDD8093594B8901193C ipaddress=12.1.1.2+hostname=IOS-CLT.wsc2023.gd,cn=ios-clt.wsc2023.gd

CA-Server#cry

CA-Server#crypto pki

CA-Server#crypto pki ser

CA-Server#crypto pki server ROOTCA gr

CA-Server#crypto pki server ROOTCA grant ?

<1-999> Request ID

all all pending requests

CA-Server#crypto pki server ROOTCA grant 1

CA-Server#

CA-Server#conf t

Enter configuration commands, one per line. End with CNTL/Z.

CA-Server(config)#cry

CA-Server(config)#crypto pki

CA-Server(config)#crypto pki ser

CA-Server(config)#crypto pki server ROOTCA

CA-Server(cs-server)#gr

CA-Server(cs-server)#grant aut

CA-Server(cs-server)#grant auto

% The CS config is locked because it is busy or enabled. You need to shut the server off before changing its configuration.

CA-Server(cs-server)#shut

CA-Server(cs-server)#shutdown

Certificate server 'shut' event has been queued for processing.

CA-Server(cs-server)#

*Oct 18 12:21:04.618: %PKI-6-CS_DISABLED: Certificate server now disabled.

CA-Server(cs-server)#gr

CA-Server(cs-server)#grant auto

CA-Server(cs-server)#

*Oct 18 12:21:09.196: %PKI-6-CS_GRANT_AUTO: All enrollment requests will be automatically granted.

CA-Server(cs-server)#no shut

CA-Server(cs-server)#no shutdown

Certificate server 'no shut' event has been queued for processing.

CA-Server(cs-server)#

*Oct 18 12:21:14.156: %PKI-6-CS_ENABLED: Certificate server now enabled.

CA-Server(cs-server)#end

CA-Server#show cry

CA-Server#show crypto pk

*Oct 18 12:21:15.991: %SYS-5-CONFIG_I: Configured from console by console

CA-Server#show crypto pki

CA-Server#show crypto pki ser

CA-Server#show crypto pki server st

CA-Server#show crypto pki server

Certificate Server ROOTCA:

Status: enabled

State: enabled

Server's configuration is locked (enter "shut" to unlock it)

Issuer name: cn=wsc2023 root ca

CA cert fingerprint: 4B92CA25 F7BF277A A5195DC0 FA6052A6

Granting mode is: auto

Last certificate issued serial number (hex): 2

CA certificate expiration timer: 12:08:19 UTC Oct 17 2026

CRL NextUpdate timer: 18:08:19 UTC Oct 18 2023

Current primary storage dir: nvram:

Database Level: Minimum - no cert data written to storage

CA-Server#

CA-Server#crypto pki expo

CA-Server#crypto pki ex

CA-Server#conf t

Enter configuration commands, one per line. End with CNTL/Z.

CA-Server(config)#ex

CA-Server(config)#cry

CA-Server(config)#crypto pki

CA-Server(config)#crypto pki ex

CA-Server(config)#crypto pki export ?

WORD Trustpoint label to associate keys and certs with

CA-Server(config)#crypto pki export ROOTCA ?

pem Export to PEM files

pkcs12 Export to PKCS12 file

CA-Server(config)#crypto pki export ROOTCA pem

CA-Server(config)#crypto pki export ROOTCA pem ?

terminal Export via the terminal (cut-and-paste)

url Export via the file systems

CA-Server(config)#crypto pki export ROOTCA pem ter

CA-Server(config)#crypto pki export ROOTCA pem terminal

% The specified trustpoint is not enrolled (ROOTCA).

% Only export the CA certificate in PEM format.

% CA certificate:

-----BEGIN CERTIFICATE-----

MIIDEjCCAfqgAwIBAgIBATANBgkqhkiG9w0BAQsFADAaMRgwFgYDVQQDEw93c2My

MDIzIHJvb3QgY2EwHhcNMjMxMDE4MTIwODE5WhcNMjYxMDE3MTIwODE5WjAaMRgw

FgYDVQQDEw93c2MyMDIzIHJvb3QgY2EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw

ggEKAoIBAQCnAGGUb3CZggWwowIoHAk9QMdCNKPxwEAwLwkiXTnppMoM+aztcV+o

l9H0WzH4M3j9aAvwtwzTeWfk8veItKqT+khcD1Yxq92CcSN4SqmH+Ju78PSyD7Qo

jpy61HhXuRZi//wuq9JQxfbhwxhm6Twrg5Y1lYOyLHRlI9NRvGFo4J1ukdBtmlDp

SLANDthcVKCFETSxhgcQMFWzh0/VxmMi/0JjZCSVrhWLS0j/7bAy7KBKBeRqcBF+

yOhPUsuvYImHOliCzRxrTd4skuqDJHA/6WF2wbh5ADkC15qjjcBo/S0YwJnvi0/G

cAwmvyQuutPYOZ561Hmk/duqOvjj1BC7AgMBAAGjYzBhMA8GA1UdEwEB/wQFMAMB

Af8wDgYDVR0PAQH/BAQDAgGGMB8GA1UdIwQYMBaAFNhs/RLxsvMOYlPfg6MVi7/f

YwIQMB0GA1UdDgQWBBTYbP0S8bLzDmJT34OjFYu/32MCEDANBgkqhkiG9w0BAQsF

AAOCAQEAEw6K2Z1aTG+9Q3oF2vlfgo6A9OpchSyyeC0vQjT0pytjf7+x+2ZqAzzV

JAyxmElx4ttBo0tlEp9uqQaORe/tEhkrxP+W+VKiZ5M9Z80gnoUI6gE6GbvwaCqJ

uOr7J6b0jbMdJxiWLzZ02j5BanhebWoaBEtG0NLtyl8mgb4A8Q2jUSlTK1TodMQP

ZFn1N/i2rQi5nv8suZV6Yc95nWELA0vqfCC4mfMlNyyNkjK7VdUJfpSXpYJQ/fV1

wMKXe3hhdk8GXeW7yodymDNvvjb85tco3Azu82ufbufhfq557jERgdq+rp5rooVj

IkTicl80NgpDdBz4Y5O/3akQyL/jOw==

-----END CERTIFICATE-----

CA-Server(config)#

-----------------

IOS-CLT#ping 8.8.8.8

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 2/2/2 ms

IOS-CLT#show clo

IOS-CLT#show clock

*12:03:22.678 UTC Wed Oct 18 2023

IOS-CLT#

IOS-CLT#conf t

Enter configuration commands, one per line. End with CNTL/Z.

IOS-CLT(config)#dom

IOS-CLT(config)#ip dom

IOS-CLT(config)#ip domain n

IOS-CLT(config)#ip domain name wsc2023.gd

IOS-CLT(config)#cry

IOS-CLT(config)#crypto key

IOS-CLT(config)#crypto key ge

IOS-CLT(config)#crypto key generate rsa

IOS-CLT(config)#crypto key generate rsa mo

IOS-CLT(config)#crypto key generate rsa modulus 2048 la

IOS-CLT(config)#crypto key generate rsa modulus 2048 label ISO-CLT.key ?

encryption Generate a general purpose RSA key pair for signing and

encryption

exportable Allow the key to be exported

general-keys Generate a general purpose RSA key pair for signing and

encryption

on create key on specified device.

signature Generate a general purpose RSA key pair for signing and

encryption

storage Store key on specified device

usage-keys Generate separate RSA key pairs for signing and encryption

IOS-CLT(config)#crypto key generate rsa modulus 2048 label ISO-CLT.key EX

IOS-CLT(config)#$generate rsa modulus 2048 label ISO-CLT.key EXportable

The name for the keys will be: ISO-CLT.key

% The key modulus size is 2048 bits

% Generating 2048 bit RSA keys, keys will be exportable...

[OK] (elapsed time was 1 seconds)

IOS-CLT(config)#

*Oct 18 12:11:06.464: %SSH-5-ENABLED: SSH 1.99 has been enabled

IOS-CLT(config)#

IOS-CLT(config)#CRY

IOS-CLT(config)#cry

IOS-CLT(config)#crypto pki

IOS-CLT(config)#crypto pki tr

IOS-CLT(config)#crypto pki trustpoi

IOS-CLT(config)#crypto pki trustpoint CA

IOS-CLT(ca-trustpoint)#EN

IOS-CLT(ca-trustpoint)#en

IOS-CLT(ca-trustpoint)#enrollment ur

IOS-CLT(ca-trustpoint)#enrollment url http:?

WORD    http:  A URL beginning with this prefix

IOS-CLT(ca-trustpoint)#EN

IOS-CLT(ca-trustpoint)#en

IOS-CLT(ca-trustpoint)#enrollment ur

IOS-CLT(ca-trustpoint)#enrollment url ?

WORD HTTP URL

archive: Enroll via archive: file system

flash0: Enroll via flash0: file system

flash1: Enroll via flash1: file system

flash2: Enroll via flash2: file system

flash3: Enroll via flash3: file system

flash: Enroll via flash: file system

ftp: Enroll via ftp: file system

http: Enroll via http: file system

https: Enroll via https: file system

null: Enroll via null: file system

nvram: Enroll via nvram: file system

pram: Enroll via pram: file system

rcp: Enroll via rcp: file system

scp: Enroll via scp: file system

security: Enroll via security: file system

snmp: Enroll via snmp: file system

system: Enroll via system: file system

tftp: Enroll via tftp: file system

tmpsys: Enroll via tmpsys: file system

IOS-CLT(ca-trustpoint)#enrollment url http

IOS-CLT(ca-trustpoint)#enrollment url http://8.8.8.8

IOS-CLT(ca-trustpoint)#sub

IOS-CLT(ca-trustpoint)#subject-n

IOS-CLT(ca-trustpoint)#subject-name cn=ios-clt.wsc2023.gd

IOS-CLT(ca-trustpoint)#rsa

IOS-CLT(ca-trustpoint)#rsakeypair ISO-CLT.key

IOS-CLT(ca-trustpoint)#?

CA Trust Point configuration commands:

authorization Authorization parameters.

auto-enroll Automatically enroll this router identity

certificate certificate options

chain-validation Validation parameters

crl CRL options

default Set a command to its defaults

eckeypair Specify eckeypair for this identity

eku Configure EKU parameters

enrollment Enrollment parameters

exit Exit from certificate authority trustpoint entry mode

fingerprint CA Certificate Fingerprint

fqdn include fully-qualified domain name

hash Hash algorithm

http-proxy HTTP proxy server

ip-address include ip address

ip-extension RFC3779 IP extension for device certificate request

match Match a certificate attibutes/maps

no Negate a command or set its defaults

ocsp OCSP parameters

on create keypair on device.

password revocation password

IOS-CLT(ca-trustpoint)#re

IOS-CLT(ca-trustpoint)#re?

redundancy  regenerate  revocation-check

IOS-CLT(ca-trustpoint)#revo

IOS-CLT(ca-trustpoint)#revocation-check ?

crl Revocation check by CRL

none Ignore revocation check

ocsp Revocation check by OCSP

IOS-CLT(ca-trustpoint)#revocation-check non

IOS-CLT(ca-trustpoint)#revocation-check none

IOS-CLT(ca-trustpoint)#exit

IOS-CLT(config)#do show run | sec pki

crypto pki trustpoint CA

enrollment url http://8.8.8.8:80

subject-name cn=ios-clt.wsc2023.gd

subject-alt-name ios-clt.wsc2023.gd

revocation-check none

rsakeypair ISO-CLT.key

crypto pki certificate chain CA

IOS-CLT(config)#cry

IOS-CLT(config)#crypto pki

IOS-CLT(config)#crypto pki auth

IOS-CLT(config)#crypto pki authenticate CA

Certificate has the following attributes:

Fingerprint MD5: 4B92CA25 F7BF277A A5195DC0 FA6052A6

Fingerprint SHA1: E8416FD0 DE4A3844 7D61DE17 C1CE4075 F892EBCF

% Do you accept this certificate? [yes/no]: yes

Trustpoint CA certificate accepted.

IOS-CLT(config)#

IOS-CLT(config)#do show run

Building configuration...

Current configuration : 5143 bytes

! Last configuration change at 11:27:36 UTC Wed Oct 18 2023

version 15.9
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption

hostname IOS-CLT

boot-start-marker

boot-end-marker

no aaa new-model

mmi polling-interval 60
no mmi auto-configure
no mmi pvc
mmi snmp-timeout 180

no ip domain lookup
ip domain name wsc2023.gd
ip cef
no ipv6 cef

multilink bundle-name authenticated

crypto pki trustpoint CA

enrollment url http://8.8.8.8:80

subject-name cn=ios-clt.wsc2023.gd

subject-alt-name ios-clt.wsc2023.gd

revocation-check none

rsakeypair ISO-CLT.key

crypto pki certificate chain CA

certificate ca 01

30820312 308201FA A0030201 02020101 300D0609 2A864886 F70D0101 0B050030

1A311830 16060355 0403130F 77736332 30323320 726F6F74 20636130 1E170D32

33313031 38313230 3831395A 170D3236 31303137 31323038 31395A30 1A311830

16060355 0403130F 77736332 30323320 726F6F74 20636130 82012230 0D06092A

864886F7 0D010101 05000382 010F0030 82010A02 82010100 A7006194 6F709982

05B0A302 281C093D 40C74234 A3F1C040 302F0922 5D39E9A4 CA0CF9AC ED715FA8

97D1F45B 31F83378 FD680BF0 B70CD379 67E4F2F7 88B4AA93 FA485C0F 5631ABDD

82712378 4AA987F8 9BBBF0F4 B20FB428 8E9CBAD4 7857B916 62FFFC2E ABD250C5

F6E1C318 66E93C2B 83963595 83B22C74 6523D351 BC6168E0 9D6E91D0 6D9A50E9

48B00D0E D85C54A0 851134B1 86071030 55B3874F D5C66322 FF426364 2495AE15

8B4B48FF EDB032EC A04A05E4 6A70117E C8E84F52 CBAF6089 873A5882 CD1C6B4D

DE2C92EA 8324703F E96176C1 B8790039 02D79AA3 8DC068FD 2D18C099 EF8B4FC6

700C26BF 242EBAD3 D8399E7A D479A4FD DBAA3AF8 E3D410BB 02030100 01A36330

61300F06 03551D13 0101FF04 05300301 01FF300E 0603551D 0F0101FF 04040302

0186301F 0603551D 23041830 168014D8 6CFD12F1 B2F30E62 53DF83A3 158BBFDF

63021030 1D060355 1D0E0416 0414D86C FD12F1B2 F30E6253 DF83A315 8BBFDF63

0210300D 06092A86 4886F70D 01010B05 00038201 0100130E 8AD99D5A 4C6FBD43

7A05DAF9 5F828E80 F4EA5C85 2CB2782D 2F4234F4 A72B637F BFB1FB66 6A033CD5

240CB198 4971E2DB 41A34B65 129F6EA9 068E45EF ED12192B C4FF96F9 52A26793

3D67CD20 9E8508EA 013A19BB F0682A89 B8EAFB27 A6F48DB3 1D271896 2F3674DA

3E416A78 5E6D6A1A 044B46D0 D2EDCA5F 2681BE00 F10DA351 29532B54 E874C40F

6459F537 F8B6AD08 B99EFF2C B9957A61 CF799D61 0B034BEA 7C20B899 F325372C

8D9232BB 55D5097E 9497A582 50FDF575 C0C2977B 7861764F 065DE5BB CA877298

336FBE36 FCE6D728 DC0CEEF3 6B9F6EE7 E17EAE79 EE311181 DABEAE9E 6BA28563

2244E272 5F34360A 43741CF8 6393BFDD A910C8BF E33B

quit

redundancy

IOS-CLT(config)#cry

IOS-CLT(config)#crypto pki

IOS-CLT(config)#crypto pki en

IOS-CLT(config)#crypto pki enroll CA

% Start certificate enrollment ..

% Create a challenge password. You will need to verbally provide this

password to the CA Administrator in order to revoke your certificate.

For security reasons your password will not be saved in the configuration.

Please make a note of it.

Password:

Re-enter password:

% The subject name in the certificate will include: cn=ios-clt.wsc2023.gd

% The subject name in the certificate will include: IOS-CLT.wsc2023.gd

% Include the router serial number in the subject name? [yes/no]: no

% Include an IP address in the subject name? [no]: yes

Enter Interface name or IP Address[]: 12.1.1.2

Request certificate from CA? [yes/no]: yes

% Certificate request sent to Certificate Authority

% The 'show crypto pki certificate verbose CA' commandwill show the fingerprint.

IOS-CLT(config)#

*Oct 18 12:16:56.553: CRYPTO_PKI: Certificate Request Fingerprint MD5: 1CB66737 4E39BBDD 8093594B 8901193C

*Oct 18 12:16:56.556: CRYPTO_PKI: Certificate Request Fingerprint SHA1: 9DC88472 97469A59 6F30F9A4 C366BB9B 77724E9D

IOS-CLT(config)#

*Oct 18 12:17:57.853: %PKI-6-CERTRET: Certificate received from Certificate Authority

IOS-CLT(config)#

IOS-CLT(config)#end

IOS-CLT#

*Oct 18 12:18:17.787: %SYS-5-CONFIG_I: Configured from console by console

IOS-CLT#

IOS-CLT#show cry

IOS-CLT#show crypto pki

IOS-CLT#show crypto pki ce

IOS-CLT#show crypto pki certificates ?

WORD Trustpoint Name

storage show certificate storage location

verbose Display in verbose mode

| Output modifiers

IOS-CLT#show crypto pki certificates CA ?

| Output modifiers

IOS-CLT#show crypto pki certificates CA

Certificate

Status: Available

Certificate Serial Number (hex): 02

Certificate Usage: General Purpose

Issuer:

cn=wsc2023 root ca

Subject:

Name: IOS-CLT.wsc2023.gd

IP Address: 12.1.1.2

ipaddress=12.1.1.2+hostname=IOS-CLT.wsc2023.gd

cn=ios-clt.wsc2023.gd

Validity Date:

start date: 12:17:43 UTC Oct 18 2023

end date: 12:17:43 UTC Oct 17 2024

Associated Trustpoints: CA

CA Certificate

Status: Available

Certificate Serial Number (hex): 01

Certificate Usage: Signature

Issuer:

cn=wsc2023 root ca

Subject:

cn=wsc2023 root ca

Validity Date:

start date: 12:08:19 UTC Oct 18 2023

end date: 12:08:19 UTC Oct 17 2026

Associated Trustpoints: CA

IOS-CLT#conf t

Enter configuration commands, one per line. End with CNTL/Z.

IOS-CLT(config)#cry

IOS-CLT(config)#crypto pki

---------------

ASA-CLT(config)# crypto key generate rsa label SSLVPN.key MOdulus 2048

INFO: The name for the keys will be: SSLVPN.key

Keypair generation process begin. Please wait...

ASA-CLT(config)# CRY

ASA-CLT(config)# CRYpto ca

ASA-CLT(config)# CRYpto ca tr

ASA-CLT(config)# CRYpto ca trustpoi

ASA-CLT(config)# CRYpto ca trustpoint SSLVPN

ASA-CLT(config-ca-trustpoint)# en

ASA-CLT(config-ca-trustpoint)# enr

ASA-CLT(config-ca-trustpoint)# enrollment pro

ASA-CLT(config-ca-trustpoint)# enrollment protocol sc

ASA-CLT(config-ca-trustpoint)# enrollment protocol scep ur

ASA-CLT(config-ca-trustpoint)# enrollment protocol scep url http://8.8.8.8

ASA-CLT(config-ca-trustpoint)# sub

ASA-CLT(config-ca-trustpoint)# subject-name cn=sslvpn.wsc2023.gd

ASA-CLT(config-ca-trustpoint)# key

ASA-CLT(config-ca-trustpoint)# keyp

ASA-CLT(config-ca-trustpoint)# keypair SSLVPN.key

ASA-CLT(config-ca-trustpoint)# fq

ASA-CLT(config-ca-trustpoint)# fqdn no

ASA-CLT(config-ca-trustpoint)# fqdn none

ASA-CLT(config-ca-trustpoint)# exit

ASA-CLT(config)# cry

ASA-CLT(config)# crypto ca auth

ASA-CLT(config)# crypto ca authenticate SSLVPN

INFO: Certificate has the following attributes:

Fingerprint: 4b92ca25 f7bf277a a5195dc0 fa6052a6

Do you accept this certificate? [yes/no]: yes

WARNING: CA certificates can be used to validate VPN connections,

by default.  Please adjust the validation-usage of this

trustpoint to limit the validation scope, if necessary.

Trustpoint CA certificate accepted.

ASA-CLT(config)#

ASA-CLT(config)# cry

ASA-CLT(config)# crypto ca

ASA-CLT(config)# crypto ca en

ASA-CLT(config)# crypto ca enroll SSLVPN

WARNING: The certificate enrollment is configured with an fqdn

that differs from the system fqdn. If this certificate will be
used for VPN authentication this may cause connection problems.

Would you like to continue with this enrollment? [yes/no]: yes

% Start certificate enrollment ..

% Create a challenge password. You will need to verbally provide this

password to the CA Administrator in order to revoke your certificate.

For security reasons your password will not be saved in the configuration.

Please make a note of it.

Password:

Re-enter password:

% The subject name in the certificate will be: cn=sslvpn.wsc2023.gd

% The fully-qualified domain name will not be included in the certificate

% Include the device serial number in the subject name? [yes/no]: no

Request certificate from CA? [yes/no]: yes

% Certificate request sent to Certificate Authority

ASA-CLT(config)#

ASA-CLT(config)# The certificate has been granted by CA!

ASA-CLT(config)#

ASA-CLT(config)# show cry

ASA-CLT(config)# show crypto ce

ASA-CLT(config)# show crypto ca ce

ASA-CLT(config)# show crypto ca certificates ?

exec mode commands/options:

WORD Trustpoint Name

| Output modifiers

<cr>

ASA-CLT(config)# show crypto ca certificates SSLVPN

CA Certificate

Status: Available

Certificate Serial Number: 01

Certificate Usage: Signature

Public Key Type: RSA (2048 bits)

Signature Algorithm: RSA-SHA256

Issuer Name:

CN=wsc2023 root ca

Subject Name:

CN=wsc2023 root ca

Validity Date:

start date: 12:08:19 UTC Oct 18 2023

end date: 12:08:19 UTC Oct 17 2026

Storage: config

Associated Trustpoints: SSLVPN

Certificate

Status: Available

Certificate Serial Number: 03

Certificate Usage: General Purpose

Public Key Type: RSA (2048 bits)

Signature Algorithm: RSA-SHA256

Issuer Name:

CN=wsc2023 root ca

Subject Name:

CN=sslvpn.wsc2023.gd

Validity Date:

start date: 12:27:34 UTC Oct 18 2023

end date: 12:27:34 UTC Oct 17 2024

Storage: config

Associated Trustpoints: SSLVPN

ASA-CLT(config)# cry

ASA-CLT(config)# crypto ca