Cisco PIX 525 Dokumentacja Pobierz pdf (Strona 479)

29-13

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 29 Configuring Certificates

Certificate Configuration

Step 4 Configure the retrieval policy with the policy command. The following keywords for this command

determine the policy.

• cdp—CRLs are retrieved only from the CRL distribution points specified in authenticated

certificates.

Note SCEP retrieval is not supported by distribution points specified in certificates.

• static—CRLs are retrieved only from URLs you configure.

• both—CRLs are retrieved from CRL distribution points specified in authenticated certificates and

from URLs you configure.

Step 5 If you used the keywords static or both when you configured the CRL policy, you need to configure

URLs for CRL retrieval, using the url command. You can enter up to 5 URLs, ranked 1 through 5.

hostname/contexta(config-ca-crl)# url

URL

where

is the rank assigned to the URL. To remove a URL, use the no url n command.

Step 6 Configure the retrieval method with the protocol command. The following keywords for this command

determine the retrieval method.

• http—Specifies HTTP as the CRL retrieval method.

• ldap—Specifies LDAP as the CRL retrieval method.

• scep—Specifies SCEP as the CRL retrieval method.

Step 7 Configure how long the security appliance caches CRLs for the current trustpoint. To specify the number

of minutes the security appliance waits before considering a CRL stale, enter the following command.

hostname/contexta(config-ca-crl)# cache-time

where n is the number of minutes. For example, to specify that CRLs should be cached for seven hours,

enter the following command.

hostname/contexta(config-ca-crl)# cache-time 420

Step 8 Configure whether the security appliance requires the NextUpdate field in CRLs. For more information

about how the security appliance uses the NextUpdate field, see the “About CRLs” section on page 29-3.

Do one of the following:

• To require the NextUpdate field, enter the enforcenextupdate command. This is the default setting.

• To allow the NextUpdate field to be absent in CRLs, enter the no enforcenextupdate command.

Step 9 If you specified LDAP as the retrieval protocol, perform the following steps:

a. Enter the following command to identify the LDAP server to the security appliance:

hostname/contexta(config-ca-crl)# ldap-defaults

server

You can specify the server by DNS hostname or by IP address. You can also provide a port number

if the server listens for LDAP queries on a port other than the default of 389. For example, the

following command configures the security appliance to retrieve CRLs from an LDAP server whose

hostname is ldap1.

hostname/contexta(config-ca-crl)# ldap-defaults ldap1

1 2 ... 474 475 476 477 478 479 480 481 482 483 484 ... 603 604

Komentarze do niniejszej Instrukcji

Brak uwag

Cisco PIX 525 Dokumentacja Strona 479

Komentarze do niniejszej Instrukcji