Cisco ASA Series Cli Configuration Manual page 971

Chapter 1 Configuring Digital Certificates
Setting Up Enrollment Parameters
To set up enrollment parameters, perform the following commands:
Command
Step 1
crypto ca server
Example:
hostname (config)# crypto ca server
Step 2
otp expiration timeout
Example:
hostname(config-ca-server)# otp expiration 24
Step 3
enrollment-retrieval timeout
Example:
hostname(config-ca-server)# enrollment-retrieval 120
Configuring Digital Certificates
Purpose
Enters local ca server configuration mode. Allows
you to configure and manage a local CA.
Specifies the number of hours that an issued OTP for
the local CA enrollment page is valid. The default
expiration time is 72 hours.
Note
The user OTP to enroll for a certificate on the
enrollment website is also used as the
password to unlock the PKCS12 file that
includes the issued certificate and keypair for
the specified user.
Specifies the number of hours an already-enrolled
user can retrieve a PKCS12 enrollment file.This time
period begins when the user is successfully enrolled.
The default retrieval period is 24 hours. Valid values
for the retrieval period range from 1 to 720 hours. The
enrollment retrieval period is independent of the OTP
expiration period.
After the enrollment retrieval time expires, the user
certificate and keypair are no longer available. The
only way a user may receive a certificate is for the
administrator to reinitialize certificate enrollment
and allow a user to log in again.
Cisco ASA Series CLI Configuration Guide
1-35