ASA sslvpn window CA认证配置步骤.docxVIP

第一步：window CA搭建，配置ASA和window CA时间同步 第二步：ASA安装window CA根证书，同时申请证书并安装 第三步：ASA配置SSLVPN server 第四步：客户端配置：客户端安装window CA根证书，同时申请证书并安装 第一步：window CA搭建 第二步：ASA安装window CA根证书，同时申请证书并安装 1、生成rsa 密钥对 sslvpngw(config)# domain-name sslvpngw(config)# crypto key generate rsa label my.ca.key modulus 1024 INFO: The name for the keys will be: my.ca.key Keypair generation process begin. Please wait... 2、Defines x.500 distinguished name crypto ca trustpoint CA1(配置可信站点) enrollment terminal（注册方式，terminal：用于手动注册；url：secp注册） fqdn subject-nameCN=,OU=network,O=link-infor,C=CH,St=ShangHai keypair my.ca.key crl configure enrollment url http://x.x.x.x（CRL配置） crl的更新配置 3、 sslvpngw(config)# crypto ca enroll CA1（从CA服务器获取ID证书） % Start certificate enrollment .. % The subject name in the certificate will be: CN=,OU=network,O=link-infor,C=CH,St=ShangHai % The fully-qualified domain name in the certificate will be: % Include the device serial number in the subject name? [yes/no]: n Display Certificate Request to terminal? [yes/no]: y Certificate Request follows: BEGIN CERTIFICATE REQUEST MIICIDCCAYkCAQAwgZcxETAPBgNVBAgTCFNoYW5nSGFpMQswCQYDVQQGEwJDSDET MBEGA1UEChMKbGluay1pbmZvcjEQMA4GA1UECxMHbmV0d29yazEjMCEGA1UEAxMa c3NsdnBuZ3cubGluay1pbmZvci5jb20uY24xKTAnBgkqhkiG9w0BCQIWGnNzbHZw bmd3LmxpbmstaW5mb3IuY29tLmNuMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB gQC9hpOZU4tcyyXtp1Ddb0lgPLGwSu3Ol2Q5QlhL0RdCJot1TiEWuQvoT70Y4sJ5 lcXga+f6cA3yKMyx9lnloSaO6pio2fY//t8jeQvTsQJu6FuB84vpMzcFPZAEZAmF gfxvs45zxcDjVnK6GU33HwUPVR/r3tYDAU1tqwvE1fbOcwIDAQABoEgwRgYJKoZI hvcNAQkOMTkwNzAOBgNVHQ8BAf8EBAMCBaAwJQYDVR0RBB4wHIIac3NsdnBuZ3cu bGluay1pbmZvci5jb20uY24wDQYJKoZIhvcNAQEFBQADgYEAW2iG+v9Ubz6tTTGi Bz/4qmc+kSLUtey2FSVCG7KDXmrvZWAWKnk1YKdGIhO9uTIledsNXr4He4/A0gnI 2WEl9W5ScUGA/lcaBeNUx3K/qYmWjIT0ug20L5LZyQjJ0fTnxdGqZOYAOZb6ak7Z p8t80WUes1sqgzxPHjocKufX2d8= END CERTIFICATE REQUEST Redisplay enrollment request? [yes/no]: 4、申请ASA的证书 此base-64编码由crypto ca enroll CA1生成的编码 5、CA服务器管理员接受以上ASA的证书申请，颁发给ASA，同时下载该证书火狐浏览器无法为ASA下载证书 选择Base 64编码 Bef