Cisco MDS 9000 Series Configuration Manual page 141

Configuring Certificate Authorities and Digital Certificates
Step 2
switch(config)# no crypto ca trustpoint admin-ca
(Optional) Removes the trust point CA.
Step 3 switch(config-trustpoint)# enroll terminal
Specifies manual cut-and-paste certificate enrollment (default).
Note
Step 4
switch(config-trustpoint)# rsakeypair SwitchA
Specifies the label of the RSA key-pair to be associated to this trust point for the purpose of enrollment. It
was generated earlier in the
be specified per CA.
Step 5
switch(config-trustpoint)# no rsakeypair SwitchA
(Optional) Disassociates the RSA key-pair from the trust point (default).
Step 6 switch(config-trustpoint)# end
switch#
Exits trust point configuration submode.
Step 7
switch# copy running-config startup-config
Copies the running configuration to the startup configuration to ensure the configuration is persistent across
reboots.
Authenticating the CA
The configuration process of trusting a CA is complete only when the CA is authenticated to the MDS switch.
The switch must authenticate the CA. It does this by obtaining the self-signed certificate of the CA in PEM
format, which contains the public key of the CA. Because the certificate of the CA is self-signed (the CA
signs its own certificate) the public key of the CA should be manually authenticated by contacting the CA
administrator to compare the fingerprint of the CA certificate.
Note If the CA being authenticated is not a self-signed CA (that is, it is a subordinate CA to another CA, which
itself may be a subordinate to yet another CA, and so on, finally ending in a self-signed CA), then the full list
of the CA certificates of all the CAs in the certification chain needs to be input during the CA authentication
step. This is called the CA certificate chain of the CA being authenticated. The maximum number of certificates
in a CA certificate chain is 10.
To authenticate the certificate of the CA by cutting and pasting the certificate from an e-mail message or a
website, follow these steps:
Procedure
Step 1 switch# configure terminal
Manual cut-and-paste certificate enrollment is the only method supported for enrollment.
Generating an RSA Key-Pair, on page 122
Cisco MDS 9000 Series Security Configuration Guide, Release 8.x
Authenticating the CA
section. Only one RSA key-pair can
123