<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!-- saved from url=(0014)about:internet -->
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
    <meta http-equiv="Content-Style-Type" content="text/css" />
    <meta name="GENERATOR" content="Quadralay WebWorks AutoMap 2003 Platinum Edition Client for FrameMaker 8.6.6597.0" />
    <meta name="TEMPLATEBASE" content="emwebh8-1-17" />
    <meta name="LASTUPDATED" content="08/01/13 14:47:51" />
    <title>Authenticating the CA </title>
    <!-- Copyright 2010-2013, Cisco Systems, Inc. All rights reserved. -->

    <link rel="StyleSheet" href="document.css" type="text/css" />
    <link rel="StyleSheet" href="catalog.css" type="text/css" />


<script> 
    var is_chrome = navigator.userAgent.toLowerCase().indexOf('chrome') > -1; 
   
    if(is_chrome){document.domain=document.domain}
   </script>
    <script type="text/javascript" language="JavaScript1.2" src="expand.js"></script>
    <script type="text/javascript" language="JavaScript1.2" src="page.js"></script>

    <script type="text/javascript" language="JavaScript1.2">
     <!--
      function  WWNoOp() {}
      function  WWNoValue() { return ""; }

      var  VarDropDown;

      if (typeof(HTMLHelp_Object) != "undefined")
      {
        VarDropDown = new WWDropDown_Object();
      }
      else
      {
        VarDropDown = new Object();
        VarDropDown.fAnchorOpen  = WWNoOp;
        VarDropDown.fAnchorClose = WWNoOp;
        VarDropDown.fDIVOpen  = WWNoOp;
        VarDropDown.fDIVClose = WWNoOp;
      }
     // -->
    </script>

  
<SCRIPT language="javascript">
<!--
  self.document.write("<link href='"+top.relPath+"shared/style.css' rel='stylesheet' type='text/css'>");
  myid=1638;
  self.document.write("<script type='text/javascript' language='JavaScript' src='"+top.relPath+"shared/con_utils.js'></scr"+"ipt>");
//-->
</SCRIPT>
</head>

  <body onload="highlightSearchTerms();" bgcolor="#ffffff">

    
    <blockquote>
    <a name="top"></a>

    
    


<a name="wp1073627"> </a><h1 class="pTitle">
Authenticating the CA

</h1>
<a name="wp1073628"> </a><p class="pBody">
The configuration process of trusting a CA is complete only when the CA is authenticated to the MDS 
switch. The switch must authenticate the CA. It does this by obtaining the self-signed certificate of the 
CA in PEM format, which contains the public key of the CA. Because the certificate of the CA is 
self-signed (the CA signs its own certificate) the public key of the CA should be manually authenticated 
by contacting the CA administrator to compare the fingerprint of the CA certificate.

</p>
<a name="wp1073629"> </a><p class="pBodyAutonumNoRule">
<strong>Note	&nbsp;&nbsp;&nbsp;</strong> If the CA being authenticated is not a self-signed CA (that is, it is a subordinate CA to another CA, which 
itself may be a subordinate to yet another CA, and so on, finally ending in a self-signed CA), then the 
full list of the CA certificates of all the CAs in the certification chain needs to be input during the CA 
authentication step. This is called the <em class="cEmphasis">CA certificate chain</em> of the CA being authenticated. The maximum 
number of certificates in a CA certificate chain is 10.

</p>
<a name="wp1118900"> </a><h2 class="pHeading2">
Detailed Steps
</h2>
<a name="wp1118901"> </a><p class="pBody">
To authenticate a CA, follow these steps:

</p>
<div class="pSmartList1"><ol type="1" class="pSmartList1">
<a name="wp1118902"> </a><li class="pSmartList1">Expand <b class="cBold">Switches</b> &gt; <b class="cBold">Security, </b>and then select <b class="cBold">PKI</b> in the Physical Attributes pane. 
</li>
<a name="wp1118903"> </a><li class="pSmartList1">Click the <b class="cBold">Trust Point Actions </b>tab in the Information pane.
</li>
<a name="wp1118904"> </a><li class="pSmartList1">From the Command field drop-down menu, select the appropriate option. 
</li>
<a name="wp1118905"> </a><p class="pListBodyLevel1">
Available options are <b class="cBold">caauth</b>, <b class="cBold">cadelete</b>, <b class="cBold">certreq</b>, <b class="cBold">certimport</b>, <b class="cBold">certdelete</b>, <b class="cBold">pkcs12import</b>, and 
<b class="cBold">pkcs12export</b>. The <b class="cBold">caauth</b> option is provided to authenticate a CA and install its CA certificate or 
certificate chain in a trust point. 

</p>
<a name="wp1118906"> </a><li class="pSmartList1">Click the <span style="font-weight: bold">Browse</span> button in the URL field and select the appropriate import certificate file from the 
<b class="cBold">Bootflash Files </b>dialog box. It is the file name containing the CA certificate or chain in the 
bootflash:filename format.
</li>
<a name="wp1118907"> </a><p class="pListNote1">
<strong>Note	&nbsp;&nbsp;&nbsp;</strong> You can authenticate a maximum of 10 trust points to a specific CA.

</p>
<a name="wp1118908"> </a><p class="pListNote1">
<strong>Note	&nbsp;&nbsp;&nbsp;</strong> If you do not see the required file in the Import Certificate dialog box, make sure that you copy 
the file to bootflash. See <a href="digicert20.html">&quot;Copying Files to Bootflash&quot; topic</a>.

</p>
<a name="wp1118913"> </a><li class="pSmartList1">Click <b style="font-weight: bold" class="cBold">Apply Changes </b><b style="font-weight: normal" class="cBold">to save the changes</b>.
</li>
<a name="wp1118914"> </a><p class="pListBodyLevel1">
Authentication is then confirmed or not confirmed depending on whether or not the certificate can be 
accepted after manual verification of its fingerprint. 

</p>
</ol></div>
<hr /><br><p class="pBody">Copyright 2010-2013, Cisco Systems, Inc. All rights reserved.</p> 

    </blockquote>

  </body>
</html>
