Trying to generate a security certificate for our Cisco Cube, an ASR1001 running v15.4(3)S3, and it won't allow me to add an alternative name for the crypto pki trustpoint step. Here is what I am trying to configure...
conf t
crypto pki trustpoint XXX
enrollment terminal
fqdn XXX.YYY.ZZZ.com
subject-name cn=XXX.YYY.ZZZ.com
subject-alt-name XXX.ZZZ.com
subject-alt-name ThematicName.ZZZ.com
revocation-check crl
rsakeypair XXX
The error comes in at the subject-alt-name step, saying
% Ambiguous command: "Subject Alt Name can be configured only for self signed certificates. So, specify the enrollment type as self signed prior to configuring this."
These steps are all laid out in the Cisco document here (https://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise/interoperability-portal/direct-routing-with-cube.pdf) and I have tested these in a lab with a C2921 (which is not supported by Teams Voice so we could only run the commands) and this error did not come up. Is there a limitation on this model or software version?
