ASA trustpoint objects | Manage objects | Cisco Security Cloud Control: Secure Firewall ASA Management

An overview of ASA trustpoint objects, including identity certificates, trusted CA certificates, CSR handling, export, edit, and deletion tasks.

A trustpoint object lets you add digital certificates and install them on one or more managed ASA devices. A trustpoint object can contain an identity pair, an identity certificate only, or a CA certificate only. An identity pair includes an identity certificate and the issuer CA certificate.

You can configure many trustpoints in an ASA device. Supported certificate formats are PKCS12, PEM, and DER.

Add an identity certificate object by using PKCS12

This procedure creates an internal certificate identity or internal identity certificate by uploading a certificate file or pasting existing certificate text into a text box. You can generate as many identity certificates as you want.

You can upload a file encoded in PKCS12 format. A PKCS12 is a single file that holds the CA server certificate, any intermediate certificates, and the private key in one encrypted file. A PKCS#12, or PFX, file holds a server certificate, intermediate certificates, and a private key in one encrypted file. Enter the Passphrase value for decryption.

Procedure

	1.	From the Security Cloud Control Home page, click Firewall.
	2.	In the left pane, click Objects.
	3.	Click and select ASA > Trustpoints.
	4.	Enter an Object Name for the certificate. The name is used in the configuration as an object name only, it does not become part of the certificate itself.
	5.	In the Certificate Type step, select Identity Certificate.
	6.	In the Import Type step, select Upload to upload the certificate file. The Enrollment step is set to Terminal.
	7.	In the Certificate Contents step, enter the PKCS12 format details. A PKCS#12, or PFX, file holds a server certificate, intermediate certificates, and a private key in one encrypted file. Enter the Passphrase value for decryption.
	8.	Click Continue.
	9.	In the Advanced Options step, you can configure the following: In the Revocation tab, you can configure the following: Enable Certificate Revocation Lists (CRL) — Check to enable CRL checking. By default the Use CRL distribution point from the certificate check box is selected to obtain the revocation lists distribution URL from the certificate. Cache Refresh Time (in minutes) — Enter the number of minutes between cache refreshes. The default is 60 minutes. The range is 1-1440 minutes. To avoid having to retrieve the same CRL from a CA repeatedly, the ASA can store retrieved CRLs locally, which is called CRL caching. The CRL cache capacity varies by platform and is cumulative across all contexts. If an attempt to cache a newly retrieved CRL would exceed its storage limits, the ASA removes the least recently used CRL until more space becomes available. Enable Online Certificate Status Protocol (OCSP) — Check to enable OCSP checking. OCSP Server URL—The URL of the OCSP server checking for revocation if you require OCSP checks. This URL must start with `http://`. Disable Nonce Extension — Enable the check box which cryptographically binds requests with responses to avoid replay attacks. This process works by matching the extension in the request to that in the response, ensuring that they are the same. Uncheck the Disable Nonce Extension check box if the OCSP server you are using sends pregenerated responses that do not include this matching nonce extension. Evaluation Priority — Specify whether to evaluate the revocation status of a certificate first in CRL or OSCP. Consider the certificate valid if revocation information cannot be reached— Select this check box to consider the certificate to be a valid certificate if revocation information is unreachable. For more information on revocation check, see the "Digital Certificates" chapter in the "Basic Settings" book of the Cisco ASA Series General Operations ASDM Configuration, X.Y document. Click the Others tab: Use CA Certificate for the Validation of — Specify the type of connections that can be validated by this CA. IPSec Client — Validates certificate presented by remote SSL servers. SSL Client — Validates certificates presented by incoming SSL connections. SSL Server — Validates certificates presented by incoming IPSec connections. Use Identity Certificate for — Specify how the enrolled ID certificate can be used. SSL & IPSec — Use for authenticating SSL & IPSec connections Code Signer — Code signer certificates are special certificates whose associated private keys are used to create digital signatures. The certificates used to sign code are obtained from a CA, with the signed code itself revealing the certificate origin. Other Options: Enable CA flag in basic constraints extension — Select this option if this certificate should be able to sign other certificates. The basic constraints extension identifies whether the subject of the certificate is a Certificate Authority (CA), in which case the certificate can be used to sign other certificates. The CA flag is part of this extension. Accept certificates issued by this CA — Select this option to indicate that the ASA should accept certificates from the specified CA. Ignore IPSec Key Usage — Select this option if you do not want to validate values in the key usage and extended key usage extensions of IPsec remote client certificates. You can suppress key usage checking on IPsec client certificates. By default, this option is not enabled.
	10.	Click Add.

Create a self-signed ASA identity certificate object

This procedure describes steps for generating a self-signed certificate for your ASA by entering the appropriate certificate field values in a wizard. You can generate as many self-signed certificates as you want.

To create a Self-Signed identity certificate object, perform these steps:

Procedure

	1.	From the Security Cloud Control Home page, click Firewall.
	2.	In the left pane, click Objects.
	3.	Click and select ASA > Trustpoints.
	4.	Enter an Object Name for the certificate. The name is used in the configuration as an object name only; it does not become part of the certificate itself.
	5.	In the Identity Certificate step, select Identity Certificate.
	6.	In the Import Type step, select New to upload the certificate file and click Continue.
	7.	In the Enrollment step, select Self-Signed and click Continue. The Certificates Content step appears. Read Self-Signed and CSR Certificate Generation Based on Certificate Contents to understand the CN and SANS content in the Self-Signed certificate that is being generated.
	8.	In the Certificate Contents step, configure the following: Country (C)— Select the country code from the drop-down list. State or Province (ST)—The state or province to include in the certificate. Locality or City (L)—The locality to include in the certificate, such as the name of the city. Organization (O)—The organization or company name to include in the certificate. Organizational Unit (Department) (OU)—The name of the organization unit (for example, a department name) to include in the certificate. Common Name (CN)—The X.500 common name to include in the certificate. This could be the name of the device, web site, or another text string. This element is usually required for successful connections. For example, you must include a CN in the internal certificate used for remote access VPN. Email Address (EA)— The e-mail address associated with the identity certificate. IP Address— The ASA IP address on the network in four-part dotted-decimal notation. Device's FQDN— An unambiguous domain name, to indicate the position of the node in the DNS tree hierarchy. Include Device's Serial Number— Select the check box if you want to add the ASA serial number to the certificate parameters. Click the Key tab. Choose the RSA or ECDSA key type. Key Size: If the key pair does not exist, defines the desired key size (modulus), in bits. The recommended key size for RSA is 1024 and for ECDSA is 348. The larger the modulus size, the more secure the key. However, keys with larger modulus sizes take longer to generate (a minute or more when larger than 512 bits) and longer to process when exchanged. Click Continue.
	9.	In the Advanced Options step, you can configure the following: In the Revocation tab, you can configure the following: Enable Certificate Revocation Lists (CRL) — Check to enable CRL checking. By default the Use CRL distribution point from the certificate check box is selected to obtain the revocation lists distribution URL from the certificate. Cache Refresh Time (in minutes) — Enter the number of minutes between cache refreshes. The default is 60 minutes. The range is 1 to 1440 minutes. To avoid having to retrieve the same CRL from a CA repeatedly, the ASA can store retrieved CRLs locally, which is called CRL caching. The CRL cache capacity varies by platform and is cumulative across all contexts. If an attempt to cache a newly retrieved CRL would exceed its storage limits, the ASA removes the least recently used CRL until more space becomes available. Enable Online Certificate Status Protocol (OCSP) — Check to enable OCSP checking. OCSP Server URL — The URL of the OCSP server checking for revocation if you require OCSP checks. This URL must start with `http://`. Disable Nonce Extension — Enable the check box which cryptographically binds requests with responses to avoid replay attacks. This process works by matching the extension in the request to that in the response, ensuring that they are the same. Uncheck the Disable Nonce Extension check box if the OCSP server you are using sends pregenerated responses that do not include this matching nonce extension. Evaluation Priority — Specify whether to evaluate the revocation status of a certificate first in CRL or OSCP. Consider the certificate valid if revocation information cannot be reached — Select this check box to consider the certificate to be a valid certificate if revocation information is unreachable. For more information on revocation check, see the "Digital Certificates" chapter in the "Basic Settings" book of the Cisco ASA Series General Operations ASDM Configuration, X.Y document. Click the Others tab: Use CA Certificate for the Validation of — Specify the type of connections that can be validated by this CA. IPSec Client — Validates certificate presented by remote SSL servers. SSL Client — Validates certificates presented by incoming SSL connections. SSL Server — Validates certificates presented by incoming IPSec connections. Use Identity Certificate for — Specify how the enrolled ID certificate can be used. SSL & IPSec — Use for authenticating SSL & IPSec connections Code Signer — Code signer certificates are special certificates whose associated private keys are used to create digital signatures. The certificates used to sign code are obtained from a CA, with the signed code itself revealing the certificate origin. Other Options: Enable CA flag in basic constraints extension — Select this option if this certificate should be able to sign other certificates. The basic constraints extension identifies whether the subject of the certificate is a Certificate Authority (CA), in which case the certificate can be used to sign other certificates. The CA flag is part of this extension. The presence of these items in a certificate i Accept certificates issued by this CA — Select this option to indicate that the ASA should accept certificates from the specified CA. Ignore IPSec Key Usage — Select this option if you do not want to validate values in the key usage and extended key usage extensions of IPsec remote client certificates. You can suppress key usage checking on IPsec client certificates. By default, this option is not enabled.
	10.	Click Add.

Add an ASA identity certificate object for a Certificate Signing Request (CSR)

The Certification Authority (CA) server information and enrollment parameters are required to generate Certificate Signing Requests (CSRs) and obtain Identity Certificates from the specified CA. You need to select either Rivest-Shamir-Adleman (RSA) or Elliptic Curve Digital Signature Algorithm (ECDSA) key type to generate the request.

Create a trustpoint object by providing identification information and optionally uploading a CA certificate obtained from a CA.

Procedure

	1.	From the Security Cloud Control Home page, click Firewall.
	2.	In the left pane, click Objects.
	3.	Click and select ASA > Trustpoints.
	4.	Enter an Object Name for the certificate. The name is used in the configuration as an object name only; it does not become part of the certificate itself.
	5.	In the Identity Certificate step, select Identity Certificate.
	6.	In the Import Type step, select New to upload the certificate file and click Continue.
	7.	In the Enrollment step, select Manual.
	8.	(optional) You can paste or upload the CA certificate obtained from your CA. You can leave the field empty.
	9.	Click Continue. The Certificates Content step appears. Read Self-Signed and CSR Certificate Generation Based on Certificate Contents to understand the CN and SANS content in the Signed certificate that is being generated.
	10.	In the Certificate Contents step, configure the following: Country (C)— Select the country code from the drop-down list. State or Province (ST)—The state or province to include in the certificate. Locality or City (L)—The locality to include in the certificate, such as the name of the city. Organization (O)—The organization or company name to include in the certificate. Organizational Unit (Department) (OU)—The name of the organization unit (for example, a department name) to include in the certificate. Common Name (CN)—The X.500 common name to include in the certificate. This could be the name of the device, web site, or another text string. This element is usually required for successful connections. For example, you must include a CN in the internal certificate used for remote access VPN. Email Address (EA)— The e-mail address associated with the identity certificate. IP Address— The ASA IP address on the network in four-part dotted-decimal notation. Subject Alternative Name (SAN)— This field will be part of Certificate Subject DN as 'unstructuredName' as well. We recommend you use this field if the certificate is used for multiple domains or IP addresses. Use Device Host Name: Host name of the device is used. Custom: Device's FQDN— An unambiguous domain name, to indicate the position of the node in the DNS tree hierarchy. Note We recommend the values specified in CN and Custom FQDN are the same. Include Device's Serial Number— Select the check box if you want to include the serial number of ASA in the certificate. The CA uses the serial number to either authenticate certificates or to later associate a certificate with a particular device. If you are in doubt, include the serial number, as it is useful for debugging purposes. Click the Key tab. Choose the RSA or ECDSA key type. Key Size: If the key pair does not exist, defines the desired key size (modulus), in bits. The recommended key size for RSA is 1024 and for ECDSA is 348. The larger the modulus size, the more secure the key. However, keys with larger modulus sizes take longer to generate (a minute or more when larger than 512 bits) and longer to process when exchanged. Click Continue.
	11.	In the Advanced Options step, you can configure the following: In the Revocation tab, you can configure the following: Enable Certificate Revocation Lists (CRL) — Check to enable CRL checking. By default, the Use CRL distribution point from the certificate check box is selected to obtain the revocation lists distribution URL from the certificate. Cache Refresh Time (in minutes) — Enter the number of minutes between cache refreshes. The default is 60 minutes. The range is 1 to 1440 minutes. To avoid having to retrieve the same CRL from a CA repeatedly, the ASA can store retrieved CRLs locally, which is called CRL caching. The CRL cache capacity varies by platform and is cumulative across all contexts. If an attempt to cache a newly retrieved CRL would exceed its storage limits, the ASA removes the least recently used CRL until more space becomes available. Enable Online Certificate Status Protocol (OCSP) — Check to enable OCSP checking. OCSP Server URL—The URL of the OCSP server checking for revocation if you require OCSP checks. This URL must start with `http://`. Disable Nonce Extension — Enable the check box which cryptographically binds requests with responses to avoid replay attacks. This process works by matching the extension in the request to that in the response, ensuring that they are the same. Uncheck the Disable Nonce Extension check box if the OCSP server you are using sends pregenerated responses that do not include this matching nonce extension. Evaluation Priority — Specify whether to evaluate the revocation status of a certificate first in CRL or OSCP. Consider the certificate valid if revocation information cannot be reached— Select this check box to consider the certificate to be a valid certificate if revocation information is unreachable. For more information on revocation check, see the "Digital Certificates" chapter in the "Basic Settings" book of the Cisco ASA Series General Operations ASDM Configuration, X.Y document. Click the Others tab: Use CA Certificate for the Validation of — Specify the type of connections that can be validated by this CA. IPSec Client — Validates certificate presented by remote SSL servers. SSL Client — Validates certificates presented by incoming SSL connections. SSL Server — Validates certificates presented by incoming IPSec connections. Use Identity Certificate for — Specify how the enrolled ID certificate can be used. SSL & IPSec — Use for authenticating SSL & IPSec connections Code Signer — Code signer certificates are special certificates whose associated private keys are used to create digital signatures. The certificates used to sign code are obtained from a CA, with the signed code itself revealing the certificate origin. Other Options: Enable CA flag in basic constraints extension — Select this option if this certificate should be able to sign other certificates. The basic constraints extension identifies whether the subject of the certificate is a Certificate Authority (CA), in which case the certificate can be used to sign other certificates. The CA flag is part of this extension. The presence of these items in a certificate i Accept certificates issued by this CA — Select this option to indicate that the ASA should accept certificates from the specified CA. Ignore IPSec Key Usage — Select this option if you do not want to validate values in the key usage and extended key usage extensions of IPsec remote client certificates. You can suppress key usage checking on IPsec client certificates. By default, this option is not enabled.
	12.	Click Add. This creates a trustpoint certificate object.

Add a trusted CA certificate object for ASA

Obtain a trusted CA certificate from an external certificate authority, or create one using your own internal CA, for example, with OpenSSL tools. You can upload a file encoded in one of the following supported formats:

Distinguished Encoding Rules (DER)
Privacy-enhanced Electronic Mail (PEM)

Procedure

	1.	From the Security Cloud Control Home page, click Firewall.
	2.	In the left pane, click Objects.
	3.	Click and select ASA > Trustpoints.
	4.	Enter an Object Name for the certificate. The name is used in the configuration as an object name only; it does not become part of the certificate itself.
	5.	In the Certificate Type step, select Trusted CA Certificate.
	6.	In the Certificate Contents step, paste the certificate contents in the text box or upload the CA certificate file as explained in the wizard.
	7.	Click Continue. The wizard advances to step 4. The certificate must follow these guidelines: The name of the server in the certificate must match the server Hostname / IP Address. For example, if you use 10.10.10.250 as the IP address but ad.example.com in the certificate, the connection fails. The certificate must be an X509 certificate in PEM or DER format. The certificate you paste must include the BEGIN CERTIFICATE and END CERTIFICATE lines. For example: -----BEGIN CERTIFICATE----- MIIFgTCCA2mgAwIBAgIJANvdcLnabFGYMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNV BAYTAlVTMQswCQYDVQQIDAJUWDEPMA0GA1UEBwwGYXVzdGluMRQwEgYDVQQKDAsx OTIuMTY4LjEuMTEUMBIGA1UEAwwLMTkyLjE2OC4xLjEwHhcNMTYxMDI3MjIzNDE3 WhcNMTcxMDI3MjIzNDE3WjBXMQswCQYDVQQGEwJVUzELMAkGA1UECAwCVFgxDzAN BgNVBAcMBmF1c3RpbjEUMBIGA1UECgwLMTkyLjE2OC4xLjExFDASBgNVBAMMCzE5 Mi4xNjguMS4xMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA5NceYwtP ES6Ve+S9z7WLKGX5JlF58AvH82GPkOQdrixn3FZeWLQapTpJZt/vgtAI2FZIK31h (...20 lines removed...) hbr6HOgKlOwXbRvOdksTzTEzVUqbgxt5Lwupg3b2ebQhWJz4BZvMsZX9etveEXDh PY184V3yeSeYjbSCF5rP71fObG9Iu6+u4EfHp/NQv9s9dN5PMffXKieqpuN20Ojv 2b1sfOydf4GMUKLBUMkhQnip6+3W -----END CERTIFICATE-----
	8.	In the Advanced Options step, you can configure the following: In the Revocation tab, you can configure the following: Enable Certificate Revocation Lists (CRL) — Check to enable CRL checking. By default, the Use CRL distribution point from the certificate check box is selected to obtain the revocation lists distribution URL from the certificate. Cache Refresh Time (in minutes) — Enter the number of minutes between cache refreshes. The default is 60 minutes. The range is 1 to 1440 minutes. To avoid having to retrieve the same CRL from a CA repeatedly, the ASA can store retrieved CRLs locally, which is called CRL caching. The CRL cache capacity varies by platform and is cumulative across all contexts. If an attempt to cache a newly retrieved CRL would exceed its storage limits, the ASA removes the least recently used CRL until more space becomes available. Enable Online Certificate Status Protocol (OCSP) — Check to enable OCSP checking. OCSP Server URL—The URL of the OCSP server checking for revocation if you require OCSP checks. This URL must start with `http://`. Disable Nonce Extension — Enable the check box which cryptographically binds requests with responses to avoid replay attacks. This process works by matching the extension in the request to that in the response, ensuring that they are the same. Uncheck the Disable Nonce Extension check box if the OCSP server you are using sends pregenerated responses that do not include this matching nonce extension. Evaluation Priority — Specify whether to evaluate the revocation status of a certificate first in CRL or OSCP. Consider the certificate valid if revocation information cannot be reached— Select this check box to consider the certificate to be a valid certificate if revocation information is unreachable. For more information on revocation check, see the "Digital Certificates" chapter in the "Basic Settings" book of the Cisco ASA Series General Operations ASDM Configuration, X.Y document. Click the Others tab: Use CA Certificate for the Validation of — Specify the type of connections that can be validated by this CA. IPSec Client — Validates certificate presented by remote SSL servers. SSL Client — Validates certificates presented by incoming SSL connections. SSL Server — Validates certificates presented by incoming IPSec connections. Other Options: Enable CA flag in basic constraints extension — Select this option if you want to validate if the subject of the certificate is a CA using the basic constraints extension. Accept certificates issued by this CA — Select this option to indicate that the ASA should accept certificates from the specified CA. Accept certificates issued by the subordinates CAs of this CA — Select this option to indicate that the ASA should accept certificates from the subordinate CA. Ignore IPSec Key Usage — Select this option if you do not want to validate values in the key usage and extended key usage extensions of IPsec remote client certificates. You can suppress key usage checking on IPsec client certificates. By default, this option is not enabled.
	9.	Click Add. This creates a trustpoint certificate object.

Self-Signed and CSR certificate generation based on certificate contents

You need to have an idea of the CN and SANS content in the Self-Signed and CSR certificates. The content is based on the parameters you specify during their creation. You need to configure the parameters precisely for the AnyConnect clients to connect to the intended VPN headends of your organization.

This section provides different use cases with examples to give you an idea of the content of Self-Signed and CSR certificates based on the parameters specified.

Usecase 1: Different CN and FQDN values

Example:

Common Name (CN): mywebsite.com
FQDN: mysan.com

Table 1. Example: Different CN and FQDN values
	Common Name	unstructuredName	SANS
Self-Signed	mywebsite.com	mysan.com	mysan.com
CSR	mywebsite.com	mysan.com	-

Usecase 2: FQDN field set to None

Example:

Common Name (CN): mywebsite.com
FQDN: None

Table 2. Example: FQDN field set to None
	Common Name	SANS
Self-Signed	Host Name	-
CSR	mywebsite.com	-

Usecase 3: No FQDN (Default FQDN)

Example:

Common Name (CN): mywebsite.com

Table 3. Example: No FQDN (Default FQDN)
	Common Name	unstructuredName	SANS
Self-Signed	mywebsite.com	Host Name	-
CSR	mywebsite.com	Host Name	Host Name

Usecase 4: IP Address is specified in FQDN

Example:

Common Name (CN): mywebsite.com
FQDN: 4.5.6.7

Table 4. Example: IP Address is specified in FQDN
	Common Name	unstructuredName	SANS
Self-Signed	mywebsite.com	4.5.6.7	-
CSR	mywebsite.com	4.5.6.7	4.5.6.7

Usecase 5: IP Address is Specified

Example:

IP Address: 4.5.6.7
Common Name (CN): mywebsite.com
FQDN: fqdn.com

Table 5. Example: IP Address is specified
	Common Name	unstructuredAddress	unstructuredName	SANS
Self-Signed	mywebsite.com	4.5.6.7	fqdn.com	-
CSR	mywebsite.com	4.5.6.7	fqdn.com	fqdn.com

Usecase 6: Serial Number Check box is Selected

Example:

Serial Number: 9AQXMWOKDT9

Table 6. Example: IP Serial Number Check box is Selected
	serialNumber	SANS
Self-Signed	9AQXMWOKDT9	-
CSR	9AQXMWOKDT9	fqdn.com

Usecase 7: Email Address is Specified

Example:

EA: abc@xyz.com

Table 7. Example: Email Address is Specified
	unstructredName	emailAddress	SANS
Self-Signed	Host Name	abc@xyz.com	Host Name
CSR	Host Name	abc@xyz.com	-