crypto ca authenticate command

[Cisco Freak]

Hi All,

Can anyone please explain me the actual purpose of ' crypto ca  authenticate' command. I have read that this to trust the CA certificate.

What would happen if we are not authenticating a trustpoint?

CF

[Aditya Ganjoo]

Hi,

This command allows you to install the CA certificate and if you do not use this command you would be missing the certificate chain on the device and would face certificate validation errors.

Regards,

Aditya

Please rate helpful posts and mark correct answers.

[Cisco Freak]

Hi Aditya,

Consider this situation: CA certficate -> Intermediate CA certificate -> Client Certificate.

In a situation like this, we are installing the Intermediate CA certificate with the 'cryptop ca authenticate' command right?

Do we have to install the CA certificate as well?

CF

[Aditya Ganjoo]

Yes we need to install all the three certificates and that's what we call as an entire certificate chain.

Regards,

Aditya

Please rate helpful posts and mark correct answers.

[Dina Odeh]

Hi, 

I agree with Aditya. The Root CA certificate should be installed on a separate trust-point and the intermediate one should be installed on the Client certificate trust-point, 

[Cisco Freak]

One more question.

 If I have mapped device certificate and the intermediate certificate to the trustpoint1 and mapped root CA certificate to trustpoint2, do I have to do any other config to link trustpoint1 and trustpoint2 ?

CF

[Dina Odeh]

No, you don't need to do that. 

Could you tell me what is this certificate used for ? 

[Cisco Freak]

I am installing a certificate in an ASA which will act as the VPN FW.

[Dina Odeh]

Okay fine. 

Apply please the trust-point that have the ASA and intermediate certificate on the outside interface not the root one.