Question about SSLM configure

HWangLoyalty_2 — Thu, 02 Apr 2009 18:26:30 GMT

I have a question about our SSLM configure, please see the following example:

service aa-SSL

virtual ipaddr 172.25.17.15 protocol tcp port 443 secondary

server ipaddr 172.24.92.6 protocol tcp port 80

certificate rsa general-purpose trustpoint www.app.aa.com

no nat server

inservice

crypto pki trustpoint www.app.aa.com

revocation-check none

rsakeypair www.app.aa.com

crypto ca import www.app.aa.com pkcs12 tftp:xxx

======================================

Once we finish the configuration, we could find the corresponding cer in SSLM, like:

crypto pki certificate chain www.app.aa.com

My first question is how to remove this cert if we want to decommission aa-ssl environment? Is it only with â€œno crypto pki certificate chain www.app.aa.comâ€

If we have another environment like www.pre.app.aa.com shared the same VIP with www.app.aa.com. My second question is could I create only one ssl entry with wildcard like the following configuration:

service aa-SSL

virtual ipaddr 172.25.17.15 protocol tcp port 443 secondary

server ipaddr 172.24.92.6 protocol tcp port 80

certificate rsa general-purpose trustpoint *.app.aa.com

no nat server

inservice

Please advice! I would appreciate it!

Re: Question about SSLM configure

brispin — Wed, 08 Apr 2009 22:06:37 GMT

You can remove the certificate but you need to be in certificate chain configuration mode to delete certificates. An example configuration is provided here

http://www.cisco.com/en/US/docs/ios/security/command/reference/sec_c5.html#wp1043434

topic Re: Question about SSLM configure in Application Networking

Question about SSLM configure

Re: Question about SSLM configure