topic Okay fine. in Network Security

crypto ca authenticate command

Cisco Freak — Tue, 12 Mar 2019 07:51:55 GMT

Hi All,

Can anyone please explain me the actual purpose of ' crypto ca authenticate' command. I have read that this to trust the CA certificate.

What would happen if we are not authenticating a trustpoint?

Hi,

Aditya Ganjoo — Wed, 08 Jun 2016 23:48:57 GMT

Hi,

This command allows you to install the CA certificate and if you do not use this command you would be missing the certificate chain on the device and would face certificate validation errors.

Regards,

Aditya

Please rate helpful posts and mark correct answers.

Hi Aditya,

Cisco Freak — Thu, 09 Jun 2016 19:31:00 GMT

Hi Aditya,

Consider this situation: CA certficate -> Intermediate CA certificate -> Client Certificate.

In a situation like this, we are installing the Intermediate CA certificate with the 'cryptop ca authenticate' command right?

Do we have to install the CA certificate as well?

Yes we need to install all

Aditya Ganjoo — Thu, 09 Jun 2016 23:52:16 GMT

Yes we need to install all the three certificates and that's what we call as an entire certificate chain.

Regards,

Aditya

Please rate helpful posts and mark correct answers.

Hi,

Dina Odeh — Mon, 13 Jun 2016 08:37:17 GMT

Hi,

I agree with Aditya. The Root CA certificate should be installed on a separate trust-point and the intermediate one should be installed on the Client certificate trust-point,

One more question.

Cisco Freak — Mon, 13 Jun 2016 16:03:02 GMT

One more question.

If I have mapped device certificate and the intermediate certificate to the trustpoint1 and mapped root CA certificate to trustpoint2, do I have to do any other config to link trustpoint1 and trustpoint2 ?

No, you don't need to do that

Dina Odeh — Mon, 13 Jun 2016 16:05:00 GMT

No, you don't need to do that.

Could you tell me what is this certificate used for ?

I am installing a certificate

Cisco Freak — Mon, 13 Jun 2016 16:49:51 GMT

I am installing a certificate in an ASA which will act as the VPN FW.

Okay fine.

Dina Odeh — Mon, 13 Jun 2016 18:06:23 GMT

Okay fine.

Apply please the trust-point that have the ASA and intermediate certificate on the outside interface not the root one.