Switch Certificate signing from Microsoft CA

[mel-ghazali]

Hello Dears

any one can tell me the procedures of signing switch certificate from Microsoft CA. as the configuration of this part is not clear in the configuration guides.

This is because I need to cover the vulnerabilities regarding the switch certificate.

[Deepak Kumar]

Hi,

Visit at below support form:

https://supportforums.cisco.com/t5/vpn/installing-ssl-certificate-s-on-ios/td-p/1527611

Regards,

Deepak Kumar

[mel-ghazali]

the command "Crypto ca trustpoint " is not valid

[Karsten Iwen]

Use the command "crypto pki trustpoint XXX". If that is also not available, you need to change your IOS to one that supports crypto. These have an "k9"in the name.

[mel-ghazali]

I created a web certificate from the ca and then I issued crypto pki import TrustPointName from tftp, then creates the trustpoints. then I used this trustpoint in the http by " ip http secure-trustpoint TrustPointName "

[ITexpert]

Hello Guys,

I see these commands on my switches too, whats the purpose of issuing certificate on switches.

I never issue certificate to switch.

Thanks,

Lovejit

[Karsten Iwen]

There are two typical use-cases for certificates on the switch:

1. Device-management with the GUI.
2. Web-Authentication for users entering the network.

If you don't have one of these use-cases, you typically don't need these certificates.

[ITexpert]

Hello Karsten,

I thing GUI management we can do through CCP as well, Do we need certificate for that too?

@Karsten Iwen So after deploying certificate and doing Web Authentication it will work only for Domain Users, or it will work for local users too?

@Deepak Kumar @Richard Burts

Thanks,
Lovejit