HP Cisco MDS 9124 Cisco MDS 9000 Family Command Reference Guide - Release 4.x - Page 268

crypto ca enroll Chapter 4 C Commands Send documentation comments to [email protected] crypto ca enroll To request a certificate for the switch's RSA key pair created for this trust point CA, use the crypto ca enroll command in configuration mode. crypto ca enroll trustpoint-label Syntax Description trustpoint-label Specifies the name of the trust point. The maximum size is 64 characters. Defaults None. Command Modes Configuration mode. Command History Release 3.0(1) Modification This command was introduced. Usage Guidelines An MDS switch can enroll with the trust point CA to get an identity in the form of a certificate. You can enroll your switch with multiple trust points, thereby getting a separate identity certificate from each. When enrolling with a trust point, you must specify an RSA key pair to be certified. This key pair must be generated and associated to the trust point before generating the enrollment request. The association between the trust point, key pair, and identity certificate is valid until it is explicitly removed by deleting the identity certificate first, followed by disassociating the key pair, and deleting the CA certificates (in any order), and finally deleting the trust point itself, in that order only. Use the crypto ca enroll command to generate a request to obtain an identity certificate from each of your trust points corresponding to authenticated CAs. The certificate signing request (CSR) generated is per Public-Key Cryptography Standards (PKCS) #10 standard, and is displayed in PEM format. Cut and paste it and submit it to the corresponding CA through e-mail or the CA website. The CA administrator issues the certificate and makes it available to you either through the website or by sending it in e-mail. You need to import the obtained identity certificate to the corresponding trust point using the crypto ca import trustpoint-label certificate command. The challenge password is not saved with the configuration. This password is required in the event that your certificate needs to be revoked, so you must remember this password. Examples The following example generates a certificate request for an authenticated CA: switch# config t switch(config)# crypto ca enroll myCA Create the certificate request .. Create a challenge password. You will need to verbally provide this password to the CA Administrator in order to revoke your certificate. For security reasons your password will not be saved in the configuration. Please make a note of it. Password:nbv123 4-128 Cisco MDS 9000 Family Command Reference OL-18089-01, Cisco MDS NX-OS Release 4.x