Cisco ASA 5505 - Manual (Page 832)

41-14
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter 41 Configuring Digital Certificates
Configuring Digital Certificates
policy both
Example:
hostname (config-ca-crl)# policy both
Configures retrieval policy. CRLs are retrieved from
CRL distribution points specified in authenticated
certificates and from URLs that you configure.
To continue, go to Step 4.
Step 4 url n url
Example:
hostname (config-ca-crl)# url 2
http://www.example.com
If you used the keywords static or both when you
configured the CRL policy, you must configure
URLs for CRL retrieval. You can enter up to five
URLs, ranked 1 through 5. The n is the rank assigned
to the URL. To remove a URL, use the no url n
command.
Step 5 protocol http | ldap | scep
Example:
hostname (config-ca-crl)# protocol http
Configures the retrieval method. Specifies HTTP,
LDAP, or SCEP as the CRL retrieval method.
Step 6 cache-time refresh-time
Example:
hostname (config-ca-crl)# cache-time 420
Configures how long the ASA caches CRLs for the
current trustpoint. refresh-time is the number of
minutes that the ASA waits before considering a
CRL stale.
Step 7 Do one of the following:
enforcenextupdate
Example:
hostname (config-ca-crl)# enforcenextupdate
Requires the NextUpdate field in CRLs. This is the
default setting.
no enforcenextupdate
Example:
hostname (config-ca-crl)# no enforcenextupdate
Allows the NextUpdate field to be absent in CRLs.
Step 8 ldap-defaults server
Example:
hostname (config-ca-crl)# ldap-defaults ldap1
Identifies the LDAP server to the ASA if LDAP is
specified as the retrieval protocol. You can specify
the server by DNS hostname or by IP address. You
can also provide a port number if the server listens
for LDAP queries on a port other than the default of
389.
Note If you use a hostname instead of an IP
address to specify the LDAP server, make
sure that you have configured the ASA to use
DNS.
Step 9 ldap-dn admin-DN password
Example:
hostname (config-ca-crl)# ldap-dn
cn=admin,ou=devtest,o=engineering c00lRunZ
Allows CRL retrieval if the LDAP server requires
credentials.
Command Purpose