Configure a PKI trustpoint that specifies a CA server for SCEP-based auto enrollment when the remote access headend uses certificate authentication.
This task configures a PKI trustpoint for certificate enrollment when the remote access headend is configured to use certificate authentication.
Perform this task if the remote access headend is configured to use certificate authentication. In Cisco SD-WAN Manager, use a CLI add-on template for the SD-WAN RA headend device to configure a PKI trustpoint that specifies a CA server for SCEP-based auto enrollment.
Procedure
Configure the PKI trustpoint with the required parameters for certificate enrollment.
Example:
crypto pki trustpoint sdra_trustpoint
auto-enroll renewal_percentage
enrollment url http://ca-ip-address:80
fingerprint ca_certificate_fingerprint
subject-name cn= subj-name-string
revocation-check none
auto-trigger
vrf ca-vrf Example:
crypto pki trustpoint sdra_trustpoint
auto-enroll 80
enrollment url http://10.1.1.11
fingerprint 0123456789ABCDEF0123456789ABCDEF
subject-name cn=sdra_headend_1
revocation-check none
auto-trigger
vrf 1The PKI trustpoint is configured with SCEP-based auto enrollment for certificate authentication.