aaa authentication oidc client ssl ca-list

Specifies the list of supplemental certificates of authority (CA) that is to be used for server authentication while in TLS or SSL mode.

This configuration is needed for certificate verification when the OIDC issuer is not part of a well-known public trust chain. For example, this configuration is needed when using self-signed certificates.

The ca-list supplements the systems internal default CA bundle which contains well-known trusted CAs. The ca-list does not replace the default CA bundle.

The reserved ca-list name: default-ca-list tells the OIDC client to consult the system's configured global default ca-list for supplemental certificates. To add trusted certificates to the default ca-list, use the crypto certificate ca-list default-ca-list name command.

Syntax

[no] aaa authentication oidc client ssl ca-list { default-ca-list | none }

Parameters

No

Use the no form of this command ignores the CA certificates.The reserved CA list within the Trellix appliance.

default-ca-list

The reserved CA list is within the Trellix appliance.

none

Ignores the supplemental certificates within the default-ca-list.

Example

The following example appends the default-ca-list certificates to the system CA list.

hostname (config) # aaa authentication oidc client ssl ca-list default-ca-list

The following example uses the system's CA list, but does not append the default-ca-list certificates to the list:

hostname (config) # aaa authentication oidc client ssl ca-list none

The following example does not use the system's CA certificates

hostname (config) # no aaa authentication oidc client ssl ca-list

User role

Admin

Command mode

Config

Supported appliances