aaa authentication saml ssl ca-list

Specifies the list of supplemental certificates of authority (CA) that is to be used for server authentication in TLS or SSL mode.

This configuration setting is needed for certificate verification when the Secure Assertion Markup Language (SAML) identity provider (IdP) server is not part of a well-known public trust chain. For example, this configuration is needed to verify self-signed certificates.

The ca-list supplements the system's internal default CA bundle, default-ca-list, which contains well-known trusted CAs. The ca-list does not replace the default CA bundle.

Specifying the reserved ca-list name: default-ca-list tells the SAML service provider (SP) appliance to consult the system's configured global default ca-list for supplemental certificates. To add trusted certificates to the default ca-list, use the crypto certificate ca-list default-ca-list name command.

Syntax

[no] aaa authentication saml ssl ca-list { default-ca-list | none }

Parameters

no

Use the no form of this command to ignore the CA certificates.

default-ca-list

The reserved CA list within the appliance.

none

Ignores the supplemental certificates within the default-ca-list.

Example

The following example appends the default-ca-list certificates to the system CA list.

hostname (config) # aaa authentication saml ssl ca-list default-ca-list

The following example uses the system's CA list, but does not append the default-ca-list certificates to the list:

hostname (config) # aaa authentication saml ssl ca-list none

The following example does not use the system's CA certificates

hostname (config) # no aaa authentication saml ssl ca-list

User role

Admin

Command mode

Config

Supported appliances

This command is supported on the following appliances running the specified releases or later: