IOS and ASA use the same trustpoint model for storing certificates in the configuration. A trustpoint just a container in which certificates are stored. A trust point can hold up to two certificates.
An identity certificate (a certificate that the router owns the corresponding private key)
A certificate authority certificate (a certificate that is signed by another party. The router doesn't own the matching private key)
Once a certificate has been generated and installed into a device it is possible to export the whole certificate chain and private key pair for storage in a secure location. It is important to backup up identity certificates in case of device failure. In a case where you have control over the certificate authority it is trivial to issue another certificate but in cases where there are financial costs (i.e. a certificate issued from Verisign, Thawte, GoDaddy, etc) to reissue another certificate it may be beneficial to import the backed up certificate into the new device.
To backup a certificate via the command line do the following, where TrustPoint1 is the trust point name and cisco123 is the password used to encrypt the output:
ciscoASA(config)# crypto ca export TrustPoint1 pkcs12 cisco123
This will output a long text string. That is a base64 encoded pkcs12. A pkcs12 is a standardized container that carries the identity certificate, it's matching private key, and all the remaining certificates within the chain. Below is an example of the output you should see
ciscoASA(config)# crypto ca import TrustPoint2 pkcs12 cisco123
<paste in the base64 encoded pkcs12>
You can verify the installation by issuing the command "show crypto ca certificates"
RSA keys are stored in the flash in a hidden partition that can not be accessed. On IOS at time of RSA key generation the exportable keyword must be specified. Otherwise the router will be unable to export the key, making the pkcs12 export fail. ASA RSA keys are always exportable and do not have this limitation.
Is there any issue w/ the following configuration:object-group network obj_myinternal_ips network-object host 172.16.23.20 network-objecthost 172.16.23.100 object network obj_myexternal network-object host 192.168.23.200 ...
Hi there, I want to migrate Cisco ASA 5505 to Cisco FTD with Firepower Device Manager (FDM). I know that you can use Cisco's Migration Tool if you are migrating to Cisco FTD with Firepower Management Center (FMC). Is there any "easy" way to migr...
Hi all, Below in the configuration in ASA0, still unable to ping to outside interface gi/2, pls help interface GigabitEthernet1/1nameif insidesecurity-level 0ip address 192.168.1.1 255.255.255.0!interface GigabitEthernet1/2nameif outsidesecurity...
Hi, I am trying to take a configuration back-up on my Primary Admin Node.I see that the backup generation is stuck on 10%, it has been this way for about 5 days now.The ise node is still operating without any issues. I have tried to stop the bac...
Hi All,My company has purchased Firepower 2100 series firewall with ASA image 9.10.1. My query is related to CLI and GUI. Is it the CLI Commands and GUI steps/view will be same as normal ASA and manage by ASDM. Any help will be appreciated