Home » HP Manuals » Storage Devices » HP Cisco MDS 9124 » Manual Viewer

HP Cisco MDS 9124 Cisco MDS 9000 Family Command Reference - Cisco MDS SAN-OS R - Page 282

crypto ca trustpoint

Add to My Manuals
Save this manual to your list of manuals

Page 282 highlights

crypto ca trustpoint Chapter 4 C Commands Send documentation comments to [email protected] crypto ca trustpoint To create a trust point certificate authority (CA) that the switch should trust, and enter trust point configuration submode (config-trustpoint), use the crypto ca trustpoint command in configuration mode. To remove the trust point, use the no form of the command. crypto ca trustpoint trustpoint-label no crypto ca trustpoint trustpoint-label Syntax Description trustpoint-label Specifies the name of the trust point. The maximum size is 64 characters. Defaults None. Command Modes Configuration mode. Command History Release 3.0(1) Modification This command was introduced. Usage Guidelines Trust points have the following characteristics: • A trust point corresponds to a single CA, which an MDS switch trusts for peer certificate verification for any application. • A CA must be explicitly associated to a trust point using the CA authentication process using the crypto ca authenticate command. • An MDS switch can have many trust points and all applications on the switch can trust a peer certificate issued by any of the trust point CAs. • A trust point is not restricted to a specific application. • The MDS switch can optionally enroll with a trust point CA to get an indemnity certificate for itself. You do not need to designate one or more trust points to an application. Any application should be able to use any certificate issued by any trust point as long as the certificate purpose satisfies application requirement. You do not need more than one identity certificate from a trust point or more than one key pair to be associated to a trust point. A CA certifies a given identity (name) only once and does not issue multiple certificates with the same subject name. If you need more than one identity certificate for a CA, define another trust point for the same CA, associate another key pair to it, and have it certified, provided CA allows multiple certificates with same subject name. 4-128 Cisco MDS 9000 Family Command Reference OL-16217-01, Cisco MDS SAN-OS Release 3.x

Section	Page
Cisco MDS 9000 Family Command Reference	1
Contents	3
New and Changed Information	33
Preface	63
CLI Overview	75
About the Switch Prompt	76
About the CLI Command Modes	77
Understanding CLI Command Hierarchy	78
EXEC Mode Options	79
Configuration Mode Options	81
Navigating Through CLI Commands	87
Getting Help	87
Command Completion	87
Using the no and Default Forms of Commands	88
Port Names and Port Mapping	88
Entering CLI Commands	90
Viewing Switch Configurations	90
Saving a Configuration	93
Clearing a Configuration	93
Searching and Filtering CLI Output	94
Multiple Filter Commands	95
Searching and Filtering CLI Output Examples	95
Displaying Users	98
Sending Messages to Users	98
Using the ping Command	98
Using traceroute	99
Setting the Switch’s Shell Timeout	99
Setting the Switch’s Terminal Timeout	100
Setting the Switch’s Terminal Type	100
Setting the Switch’s Terminal Length	100
Setting the Switch’s Terminal Width	101
Displaying Terminal Settings	101
Using CLI Variables	101
User-Defined CLI Session Variables	101
User-Defined CLI Persistent Variables	102
System Defined Variables	103
Using Command Aliases	104
Defining Command Aliases	104
About Flash Devices	104
Internal bootflash:	105
External CompactFlash (Slot0)	105
Formatting Flash Disks and File Systems	105
Initializing bootflash:	106
Formatting Slot0:	106
Using the File System	106
Setting the Current Directory	107
Displaying the Current Directory	107
Listing the Files in a Directory	108
Creating a New Directory	108
Deleting an Existing Directory	108
Moving Files	108
Copying Files	109
Deleting Files	109
Displaying File Contents	109
Saving Command Output to a File	110
Directing show Command Output to a File	110
Compressing and Uncompressing Files	110
Displaying the Last Line in a File	111
Executing Commands Specified in a Script	111
Setting the Delay Time	112
Role-Based CLI	112
Using Valid Formats and Ranges	113
Using Debug Commands	114
Generating debug Command Output	115
Redirecting debug and Error Message Output	115
A Commands	121
aaa accounting logsize	122
aaa accounting default	123
aaa authentication dhchap default	124
aaa authentication iscsi default	125
aaa authentication login	126
aaa authentication login password-aging enable	128
aaa group server	129
abort	131
active equals saved	132
alert-group	133
arp	135
attach	136
attachpriv	137
attribute qos	138
authentication	139
autonomous-fabric-id (IVR topology database configuration)	141
autonomous-fabric-id (IVR service group configuration)	143
autonomous-fabric-id database	145
auto-volgrp	146
B Commands	147
banner motd	148
boot	150
bport	152
bport-keepalive	153
broadcast	154
C Commands	155
callhome	156
callhome test	158
cd	159
cdp	160
cfs distribute	162
cfs ipv4 distribute	164
cfs ipv4 mcast-address	166
cfs ipv6 distribute	168
cfs ipv6 mcast-address	170
cfs region	172
channel mode active	174
channel-group	175
cimserver	176
cimserver clearcertificate	178
cimserver loglevel	179
class	180
clear accounting log	182
clear arp-cache	183
clear callhome session	184
clear cdp	185
clear cores	186
clear counters (EXEC mode)	187
clear counters (SAN extension N port configuration mode)	188
clear crypto ike domain ipsec sa	189
clear crypto sa domain ipsec	190
clear debug-logfile	191
clear device-alias	192
clear dpvm	193
clear fabric-binding statistics	194
clear fcanalyzer	195
clear fcflow stats	196
clear fcns statistics	197
clear fcs statistics	198
clear fctimer session	199
clear fc-redirect config vt	200
clear fc-redirect decommission-switch	201
clear ficon	203
clear fspf counters	204
clear install failure-reason	205
clear ip access-list counters	206
clear ips arp	207
clear ips stats	208
clear ips stats fabric interface	209
clear ipv6 access-list	210
clear ipv6 neighbors	211
clear islb session	212
clear ivr fcdomain database	213
clear ivr service-group database	214
clear ivr zone database	215
clear license	216
clear line	217
clear logging	218
clear ntp	219
clear port-security	220
clear processes log	222
clear qos statistics	223
clear radius session	224
clear rlir	225
clear rmon alarms	227
clear rmon all-alarms	228
clear rmon hcalarms	229
clear rmon log	230
clear role session	231
clear rscn session vsan	232
clear rscn statistics	233
clear santap module	234
clear ssm-nvram santap module	235
clear scheduler logfile	236
clear screen	237
clear scsi-flow statistics	238
clear sdv	239
clear snmp hostconfig	240
clear ssh hosts	241
clear system reset-reason	242
clear tacacs+ session	243
clear tlport alpa-cache	244
clear user	245
clear vrrp	246
clear zone	247
cli alias name	248
cli var name (EXEC)	250
cli var name (configuration)	252
clock	253
clock set	255
cloud discover	256
cloud discovery	257
cloud-discovery enable	259
cluster	260
code-page	261
commit	263
contract-id	264
configure terminal	265
copy	266
copy licenses	269
copy ssm-nvram standby-sup	270
crypto ca authenticate	271
crypto ca crl request	273
crypto ca enroll	275
crypto ca export	277
crypto ca import	279
crypto ca test verify	281
crypto ca trustpoint	282
crypto global domain ipsec security-association lifetime	284
crypto ike domain ipsec	285
crypto ike domain ipsec rekey sa	286
crypto ike enable	287
crypto ipsec enable	288
crypto key generate rsa	289
crypto key zeroize rsa	291
crypto map domain ipsec (configuration mode)	293
crypto map domain ipsec (interface configuration submode)	295
crypto transform-set domain ipsec	296
customer-id	298
D Commands	299
data-pattern-file	300
deadtime (radius group configuration)	301
deadtime (tacacs+ group configuration)	302
delete	303
delete ca-certificate	305
delete certificate	306
delete crl	308
deny (IPv6-ACL configuration)	309
destination interface	312
destination-profile	314
device-alias (IVR fcdomain database configuration submode)	316
device-alias (SDV virtual device configuration submode)	317
device-alias abort	318
device-alias commit	319
device-alias database	320
device-alias distribute	321
device-alias import fcalias	322
device-alias name	323
dir	324
disable	326
discover	327
discover custom-list	328
discover scsi-target	329
distribute	331
do	332
dpvm abort	334
dpvm activate	335
dpvm auto-learn	336
dpvm commit	338
dpvm database	339
dpvm database copy active	340
dpvm database diff	341
dpvm distribute	343
dpvm enable	344
dscp	345
duplicate-message throttle	346
Debug Commands	347
debug aaa	348
debug all	350
debug biosd	351
debug bootvar	352
debug callhome	353
debug cert-enroll	355
debug cdp	357
debug cfs	359
debug cimserver	361
debug cloud	362
debug core	364
debug device-alias	365
debug dpvm	367
debug dstats	369
debug ethport	370
debug exceptionlog	372
debug fabric-binding	373
debug fc-tunnel	375
debug fc2	377
debug fc2d	380
debug fcc	382
debug fcdomain	384
debug fcfwd	386
debug fcns	388
debug fcs	390
debug fcsp-mgr	392
debug fdmi	394
debug ficon	396
debug flogi	398
debug fm	400
debug fspf	401
debug hardware arbiter	404
debug idehsd	405
debug ike	406
debug ilc_helper	407
debug ipacl	408
debug ipconf	409
debug ipfc	410
debug ips	411
debug ipsec	413
debug isns	415
debug ivr	417
debug klm	419
debug license	421
debug logfile	422
debug mcast	424
debug mip	426
debug module	427
debug ntp	428
debug npv	429
debug obfl	431
debug platform	432
debug plog	434
debug port	435
debug port-channel	437
debug port-resources	438
debug qos	440
debug radius	441
debug rd-reg	443
debug rdl errors	444
debug rib	445
debug rlir	446
debug rscn	447
debug san-ext-tuner	448
debug scsi-flow	450
debug scsi-target	452
debug sdv	453
debug security	455
debug sensor	456
debug sme	457
debug snmp	459
debug span	461
debug system health	463
debug tacacs+	465
debug tcap	467
debug tlport	468
debug ttyd	469
debug vni	470
debug vrrp	471
debug vsan	473
debug wr-reg	475
debug wwn	476
debug xbar	478
debug xbar_driver	479
debug xbc	480
debug zone	481
E Commands	483
email-contact	484
enable	485
encryption	486
end	487
enrollment terminal	488
exit	489
F Commands	491
fabric	492
fabric-binding activate	493
fabric-binding database copy	495
fabric-binding database diff	496
fabric-binding database vsan	497
fabric-binding enable	499
fabric-membership	500
fcalias clone	501
fcalias name	502
fcalias rename	503
fcanalyzer	504
fcc enable	506
fcc priority	507
fcdomain	508
fcdomain abort vsan	511
fcdomain commit vsan	512
fcdomain distribute	513
fcdomain rcf-reject	514
fcdroplatency	515
fcflow stats	517
fcid-allocation	519
fcid-last-byte	521
fcinterop fcid-allocation	522
fcinterop loop-monitor	523
fcip enable	524
fcip profile	525
fcns proxy-port	526
fcns reject-duplicate-pwwn vsan	527
fcping	528
fc-redirect version2 enable	530
fcroute	532
fcrxbbcredit extended enable	534
fcs plat-check-global vsan	535
fcs register	536
fcs virtual-device-add	537
fcsp	538
fcsp dhchap	540
fcsp enable	543
fcsp timeout	544
fctimer	545
fctimer abort	546
fctimer commit	547
fctimer distribute	548
fctrace	549
fc-tunnel	550
ficon enable	552
ficon logical-port assign port-numbers	554
ficon port default-state prohibit-all	555
ficon slot assign port-numbers	556
ficon swap	558
ficon-tape-accelerator vsan	560
ficon vsan (EXEC mode)	562
ficon vsan (configuration mode)	564
file	565
find	566
flex-attach virtual-pwwn	567
flex-attach virtual-pwwn auto	568
flex-attach virtual-pwwn interface	569
format	570
fspf config vsan	572
fspf cost	574
fspf dead-interval	575
fspf enable vsan	576
fspf hello-interval	577
fspf passive	578
fspf retransmit-interval	579
G Commands	581
group	582
gzip	583
gunzip	585
H Commands	587
hash	588
host	589
hw-module logging onboard	591
I Commands	593
identity	594
in-order-guarantee	596
initiator	597
install all	598
install clock-module	604
install license	606
install module bios	607
install module epld	608
install module loader	610
install ssi	611
interface	612
interface bay \| ext	614
interface fc	615
interface fc-tunnel	617
interface fcip	619
interface gigabitethernet	622
interface iscsi	624
interface mgmt	626
interface port-channel	627
interface sme	629
interface sme (Cisco SME cluster node configuration submode)	630
interface vsan	632
ip access-group	633
ip access-list	635
ip address (FCIP profile configuration submode)	638
ip address (interface configuration)	639
ip-compression	640
ip default-gateway	642
ip default-network	643
ip domain-list	644
ip domain-lookup	645
ip domain-name	646
ip name-server	647
ip route	648
ip routing	649
ips netsim delay-ms	650
ips netsim delay-us	651
ips netsim drop nth	652
ips netsim drop random	654
ips netsim enable	656
ips netsim max-bandwidth-kbps	657
ips netsim max-bandwidth-mbps	658
ips netsim qsize	659
ips netsim reorder	660
ipv6 access-list	662
ipv6 address	663
ipv6 address autoconfig	665
ipv6 enable	666
ipv6 nd	667
ipv6 route	669
ipv6 routing	671
ipv6 traffic-filter	672
iscsi authentication	673
iscsi duplicate-wwn-check	675
iscsi dynamic initiator	677
iscsi enable	679
iscsi enable module	680
iscsi import target fc	681
iscsi initiator idle-timeout	682
iscsi initiator ip-address	683
iscsi initiator name	685
iscsi interface vsan-membership	686
iscsi save-initiator	688
iscsi virtual-target name	690
islb abort	693
islb commit	694
islb distribute	695
islb initiator	697
islb save-initiator	699
islb virtual-target name	701
islb vrrp	703
islb zoneset activate	705
isns	706
isns distribute	708
isns esi retries	709
isns profile name	710
isns reregister	711
isns-server enable	712
ivr abort	713
ivr commit	714
ivr copy active-service-group user-configured-service-group	715
ivr copy active-topology user-configured-topology	716
ivr copy active-zoneset full-zoneset	717
ivr copy auto-topology user-configured-topology	718
ivr distribute	719
ivr enable	720
ivr fcdomain database autonomous-fabric-num	721
ivr nat	722

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1,000
1,001
1,002
1,003
1,004
1,005
1,006
1,007
1,008
1,009
1,010
1,011
1,012
1,013
1,014
1,015
1,016
1,017
1,018
1,019
1,020
1,021
1,022
1,023
1,024
1,025
1,026
1,027
1,028
1,029
1,030
1,031
1,032
1,033
1,034
1,035
1,036
1,037
1,038
1,039
1,040
1,041
1,042
1,043
1,044
1,045
1,046
1,047
1,048
1,049
1,050
1,051
1,052
1,053
1,054
1,055
1,056
1,057
1,058
1,059
1,060
1,061
1,062
1,063
1,064
1,065
1,066
1,067
1,068
1,069
1,070
1,071
1,072
1,073
1,074
1,075
1,076
1,077
1,078
1,079
1,080
1,081
1,082
1,083
1,084
1,085
1,086
1,087
1,088
1,089
1,090
1,091
1,092
1,093
1,094
1,095
1,096
1,097
1,098
1,099
1,100
1,101
1,102
1,103
1,104
1,105
1,106
1,107
1,108
1,109
1,110
1,111
1,112
1,113
1,114
1,115
1,116
1,117
1,118
1,119
1,120
1,121
1,122
1,123
1,124
1,125
1,126
1,127
1,128
1,129
1,130
1,131
1,132
1,133
1,134
1,135
1,136
1,137
1,138
1,139
1,140
1,141
1,142
1,143
1,144
1,145
1,146
1,147
1,148
1,149
1,150
1,151
1,152
1,153
1,154
1,155
1,156
1,157
1,158
1,159
1,160
1,161
1,162
1,163
1,164
1,165
1,166
1,167
1,168
1,169
1,170
1,171
1,172
1,173
1,174
1,175
1,176
1,177
1,178
1,179
1,180
1,181
1,182
1,183
1,184
1,185
1,186
1,187
1,188
1,189
1,190
1,191
1,192
1,193
1,194
1,195
1,196
1,197
1,198
1,199
1,200
1,201
1,202
1,203
1,204
1,205
1,206
1,207
1,208
1,209
1,210
1,211
1,212
1,213
1,214
1,215
1,216
1,217
1,218
1,219
1,220
1,221
1,222
1,223
1,224
1,225
1,226
1,227
1,228
1,229
1,230
1,231
1,232
1,233
1,234
1,235
1,236
1,237
1,238
1,239
1,240
1,241
1,242
1,243
1,244
1,245
1,246
1,247
1,248
1,249
1,250
1,251
1,252
1,253
1,254
1,255
1,256
1,257
1,258
1,259
1,260
1,261
1,262
1,263
1,264
1,265
1,266
1,267
1,268
1,269
1,270
1,271
1,272
1,273
1,274
1,275
1,276
1,277
1,278
1,279
1,280
1,281
1,282
1,283
1,284
1,285
1,286
1,287
1,288
1,289
1,290
1,291
1,292
1,293
1,294
1,295
1,296
1,297
1,298
1,299
1,300
1,301
1,302
1,303
1,304
1,305
1,306
1,307
1,308
1,309
1,310
1,311
1,312
1,313
1,314
1,315
1,316
1,317
1,318
1,319
1,320
1,321
1,322
1,323
1,324
1,325
1,326
1,327
1,328
1,329
1,330
1,331
1,332
1,333
1,334
1,335
1,336
1,337
1,338
1,339
1,340
1,341
1,342
1,343
1,344
1,345
1,346
1,347
1,348
1,349
1,350
1,351
1,352
1,353
1,354
1,355
1,356
1,357
1,358
1,359
1,360
1,361
1,362
1,363
1,364
1,365
1,366
1,367
1,368
1,369
1,370
1,371
1,372
1,373
1,374
1,375
1,376
1,377
1,378
1,379
1,380
1,381
1,382
1,383
1,384
1,385
1,386
1,387
1,388
1,389
1,390
1,391
1,392
1,393
1,394
1,395
1,396
1,397
1,398
1,399
1,400
1,401
1,402
1,403
1,404
1,405
1,406
1,407
1,408
1,409
1,410
1,411
1,412
1,413
1,414
1,415
1,416
1,417
1,418
1,419
1,420
1,421
1,422
1,423
1,424
1,425
1,426
1,427
1,428
1,429
1,430
1,431
1,432
1,433
1,434
1,435
1,436
1,437
1,438
1,439
1,440
1,441
1,442
1,443
1,444
1,445
1,446
1,447
1,448
1,449
1,450
1,451
1,452
1,453
1,454
1,455
1,456
1,457
1,458
1,459
1,460
1,461
1,462
1,463
1,464
1,465
1,466
1,467
1,468
1,469
1,470
1,471
1,472
1,473
1,474
1,475
1,476
1,477
1,478
1,479
1,480
1,481
1,482
1,483
1,484
1,485
1,486
1,487
1,488
1,489
1,490
1,491
1,492
1,493
1,494
1,495
1,496
1,497
1,498
1,499
1,500
1,501
1,502
1,503
1,504
1,505
1,506
1,507
1,508
1,509
1,510
1,511
1,512
1,513
1,514
1,515
1,516
1,517
1,518
1,519
1,520
1,521
1,522
1,523
1,524
1,525
1,526
1,527
1,528
1,529
1,530
1,531
1,532
1,533
1,534
1,535
1,536
1,537
1,538
1,539
1,540
1,541
1,542
1,543
1,544
1,545
1,546
1,547
1,548
1,549
1,550

Match case Limit results 1 per page

Send documentation comments to [email protected]

4-128

Cisco MDS 9000 Family Command Reference

OL-16217-01, Cisco MDS SAN-OS Release 3.x

Chapter 4

C Commands

crypto ca trustpoint

To create a trust point certificate authority (CA) that the switch should trust, and enter trust point

configuration submode (config-trustpoint), use the

crypto ca trustpoint

command in configuration

mode. To remove the trust point, use the

form of the command.

crypto ca trustpoint

trustpoint-label

no crypto ca trustpoint

trustpoint-label

Syntax Description

Defaults

None.

Command Modes

Configuration mode.

Command History

Usage Guidelines

Trust points have the following characteristics:

•

A trust point corresponds to a single CA, which an MDS switch trusts for peer certificate verification

for any application.

•

A CA must be explicitly associated to a trust point using the CA authentication process using the

crypto ca authenticate

command.

•

An MDS switch can have many trust points and all applications on the switch can trust a peer

certificate issued by any of the trust point CAs.

•

A trust point is not restricted to a specific application.

•

The MDS switch can optionally enroll with a trust point CA to get an indemnity certificate for itself.

You do not need to designate one or more trust points to an application. Any application should be able

to use any certificate issued by any trust point as long as the certificate purpose satisfies application

requirement.

You do not need more than one identity certificate from a trust point or more than one key pair to be

associated to a trust point. A CA certifies a given identity (name) only once and does not issue multiple

certificates with the same subject name. If you need more than one identity certificate for a CA, define

another trust point for the same CA, associate another key pair to it, and have it certified, provided CA

allows multiple certificates with same subject name.

trustpoint-label

Specifies the name of the trust point. The maximum size is 64

characters.

Release

Modification

3.0(1)

This command was introduced.