Cisco ASA 5505 - Manual (Page 859)

41-41
Cisco ASA 5500 Series Configuration Guide using the CLI
Chapter 41 Configuring Digital Certificates
Monitoring Digital Certificates
END OF CERTIFICATE
Archiving the Local CA Server Certificate and Keypair
To archive the local CA server certificate and keypair, enter the following command:
Monitoring Digital Certificates
To display certificate configuration and database information, enter one or more of the following
commands:
Command Purpose
copy
Example:
hostname# copy LOCAL-CA-SERVER_0001.pl2
tftp://10.1.1.22/user6/
Copies the local CA server certificate and keypair and all files
from the ASA using either FTP or TFTP.
Note Make sure that you back up all local CA files as often
as possible.
Command Purpose
show crypto ca server Shows local CA configuration and status.
show crypto ca server cert-db Shows user certificates issued by the local CA.
show crypto ca server certificate Shows local CA certificates on the console in base 64 format and the rollover
certificate when available, including the rollover certificate thumbprint for
verification of the new certificate during import onto other devices.
show crypto ca server crl Shows CRLs.
show crypto ca server user-db Shows users and their status, which can be used with the following qualifiers
to reduce the number of displayed records:
• allowed. Shows only users currently allowed to enroll.
• enrolled. Shows only users that are enrolled and hold a valid certificate
• expired. Shows only users holding expired certificates.
• on-hold. Lists only users without a certificate and not currently allowed
to enroll.
show crypto ca server user-db allowed Shows users who are eligible to enroll.
show crypto ca server user-db enrolled Shows enrolled users with valid certificates.
show crypto ca server user-db expired Shows users with expired certificates.
show crypto ca server user-db on-hold Shows users without certificates who are not allowed to enroll.
show crypto key name of key Shows key pairs that you have generated.
show running-config Shows local CA certificate map rules.