Installing Certificates on the ACS Appliance

[netopia]

We have a Cisco ACS appliance (Cisco 1113), and are having a little trouble getting certificates to work.

I had some instructions on generating a certificate on a windows server and installing it, but this ultimately resulted in a server that we couldn't reach from anywhere (because nobody had an appropriate client certificate) and I had to reload the server.

We can currently get PEAP to work with our windows clients and the server using a self-signed certificate, but for a wider implementation I'm still not sure what certificates need to be generated, which ones need to be placed on the server, which ones need to go on clients, and how to place them on the server and windows clients.

I realize this is a fairly large question, but the different documents I've seen out there are all slightly contradictory, and in any case are all written with the windows implementation of the cisco ACS in mind.

Any help would be most appreciated.

-Ben

[Jatin Katyal]

You don't need to install ACS-server certificate on the client and why we should install server certificate on the client ...?

There is no validay period that is configured by default for third party certificates. Its in your and CA hand, you may go for 10 years.

This option only comes with self-singed where its 1 year and it can not be changed.

On the client you just need Root CA certificate if you want an option "validate server certificate" to be checked.

Setup client for peap authentication

http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_configuration_example09186a0080545a29.shtml#t20

HTH

Jatin

Do rate helpful posts-

[ngo duyen]

thank you for fast reply. all thing clear. I have just believed all thing bert.lefevre post above

cisco support forum is wonderfull. I can have my answer very fast by searching and asking

[Jatin Katyal]

Glad, we could help you.

I would appreciate if you can mark this thread resolved so that other's can benefit from it.

Rgds,

Jatin

Do rate helpful posts-

[ngo duyen]

I cant do b/c Iam not the owner of this thread.