Cisco ISR 4000 series - Page 39

Cisco ISR 4000 Family Routers Administrator Guidance
Page 39 of 66
trust point associated with the root CA, an error message will be displayed and the chain
validation will revert to the default chain-validation command setting.
7. Exit:
TOE-common-criteria(ca-trustpoint)# exit
4.6.4.8 Setting X.509 for use with IKE
Once X.509v3 keys are installed on the TOE, they can be set for use with IKEv1 with the
commands:
TOE-common-criteria (config)#crypto isakmp policy 1
TOE-common-criteria (config-isakmp)# authentication rsa-sig
Or
TOE-common-criteria (config-isakmp)# authentication ecdsa-sig
And for IKEv2 with the commands:
TOE-common-criteria (config)#crypto ikev2 proposal sample
TOE-common-criteria(config-ikev2-profile)#authentication [remote | local] rsa-sig
or
TOE-common-criteria(config-ikev2-profile)#authentication [remote | local] ecdsa-sig
If an invalid certificate is loaded, authentication will not succeed.
4.6.4.9 Deleting Certificates
If the need arises, certificates that are saved on the router can be deleted. The router saves its
own certificates and the certificate of the CA.
To delete the router's certificate from the router's configuration, the following commands can be
used in global configuration mode:
Router# show crypto ca certificates [Displays the certificates stored on router]
Router(config)# crypto ca certificate chain name [Enters certificate chain configuration mode]
Router(config-cert-cha)# no certificate certificate-serial-number [deletes the certificate]
To delete the CA's certificate, the entire CA identity must be removed, which also removes all
certificates associated with the CA—router's certificate and the CA certificate. To remove a CA
identity, the following command in global configuration mode can be used:
Router(config)# no crypto ca identity name [Deletes all identity information and certificates
associated with the CA]