Cisco ASA 5505 - Manual (Page 1110)

52-22
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter 52 Configuring Cisco Intercompany Media Engine Proxy
Configuring Cisco Intercompany Media Engine Proxy
Configuring TLS within the Local Enterprise, page 52-27 . Performing that task allows for secure TLS
connections between the local Cisco UCM and the local ASA. The instructions in that task describe how
to create trustpoints between the local Cisco UCM and the local ASA.
Prerequisites for Installing Certificates
To create a proxy certificate on the ASA that is trusted by the remote entity, obtain a certificate from a
trusted CA or export it from the remote enterprise ASA.
To export the certificate from the remote enterprise, you enter the following command on the remote
ASA:
hostname(config)# crypto ca export trustpoint identity-certificate
The ASA prompts displays the certificate in the terminal screen. Copy the certificate from the terminal
screen. You will need the certificate text in
Step 5 of this task.
Procedure
To create the trustpoints and generate certificates, perform the following steps:
Command Purpose
Step 1 hostname(config)# crypto key generate rsa label
key-pair-label modulus size
Example:
hostname(config)# crypto key generate rsa label
local-ent-key modulus 2048
On the local ASA, creates the RSA keypair that
can be used for the trustpoints. This is the
keypair and trustpoint for the local entities
signed certificate.
The modulus key size that you select depends on
the level of security that you want to configure
and on any limitations imposed by the CA from
which you are obtaining the certificate. The
larger the number that you select, the higher the
security level will be for the certificate. Most
CAs recommend 2048 for the key modulus size;
however,
Note GoDaddy requires a key modulus size of
2048.
Step 2 hostname(config)# crypto ca trustpoint trustpoint_name
Example:
hostname(config)# crypto ca trustpoint local_ent
Enters the trustpoint configuration mode for the
specified trustpoint so that you can create the
trustpoint for the local entity.
A trustpoint represents a CA identity and
possibly a device identity, based on a certificate
issued by the CA. Maximum name length is 128
characters.
Step 3 hostname(config-ca-trustpoint)# subject-name X.500_name
Example:
hostname(config-ca-trustpoint)# subject-name
cn=Ent-local-domain-name**
Includes the indicated subject DN in the
certificate during enrollment.
Note The domain name that you enter here
must match the domain name that has
been set for the local Cisco UCM.
For information about how to configure
the domain name for Cisco UCM, see the
Cisco Unified Communications
Manager documentation for information.