Solved: Re: how to delete old trustpoint and keypair created in ASDM

james.king14 · ‎09-20-2023

Would like to know how to delete old or unused keypair(s) and trustpoints in ASA.

rustpoint Godaddy_2024:
Subject Name:
cn=Starfield Secure Certificate Authority - G2
ou=http://certs.starfieldtech.com/repository/
o=Starfield Technologies\, Inc.
l=Scottsdale
st=Arizona
c=US
Serial Number: 07
Certificate configured.

Trustpoint SSL-GD2024:
Subject Name:
cn=Starfield Secure Certificate Authority - G2
ou=http://certs.starfieldtech.com/repository/
o=Starfield Technologies\, Inc.
l=Scottsdale
st=Arizona
c=US
Serial Number: 07
Certificate configured.

Milos_Jovanovic · ‎09-25-2023

Hi @james.king14,

I'm not much of an ASDM user, so I don't know all the tricks. I would expect to see CA certificates here, as this is CA section. If you are looking into deleting identity certificate, you should click one field lower. However, ASA is usually linking CA certificate along with identity certificate (there are rare cases where those two are not tied up together). One CA can be linked to multiple identity certificates also.

You can use CLI command "show crypto ca trustpoints" to check all of the configured/imported certificates on your ASA. Over there, you can see the associated keys also, which can then be deleted with "crypto key zeroize rsa label key_name".

Kind regards,

Milos

View solution in original post

Milos_Jovanovic · ‎09-21-2023

Hi @james.king14,

You should be able to go to Configuration / Device Management / Certificate Management and to pick either Identity or CA certificate you want to delete.

Kind regards,

Milos

james.king14 · ‎09-25-2023

Hello Milos,

I tried that already and found that under the ASDM the CA certs are going under the CA named cert which is same as last year. Star Point from Godaddy.

james.king14 · ‎09-25-2023

Also How do you discard the enrollled Keypairs?

Milos_Jovanovic · ‎09-25-2023

Hi @james.king14,

I'm not much of an ASDM user, so I don't know all the tricks. I would expect to see CA certificates here, as this is CA section. If you are looking into deleting identity certificate, you should click one field lower. However, ASA is usually linking CA certificate along with identity certificate (there are rare cases where those two are not tied up together). One CA can be linked to multiple identity certificates also.

You can use CLI command "show crypto ca trustpoints" to check all of the configured/imported certificates on your ASA. Over there, you can see the associated keys also, which can then be deleted with "crypto key zeroize rsa label key_name".

Kind regards,

Milos

james.king14 · ‎09-26-2023

Hi Milos

First let me state that you “crypto zeroize” statement works wonder.
Thanks you for that solution. Can you remind me, how to get rid of old
trustpoints!

Milos_Jovanovic · ‎09-26-2023

CLI rules!

You can list all trustpoints with command "show crypto ca trustpoints", and then simply delete selected one with "no crypto ca trustpoint MyTPoint".

Kind regards,

Milos