Configures a Web server CA certificate chain. Adding the certificate chain to an Apache Web server establishes a chain of trust for a server SSL certificate by providing signing CA certificates to the Web browsers running the Web UI. After you configure the certificate chain, you must activate it using the command web server ssl ca-chain <chainName>.
Syntax
crypto certificate ca-chain chain-name <chainName> web-server pem-bundle "<pemChainString>" [comment "<comment>"]
no crypto certificate ca-chain chain-name <chainName>
Parameters
no
Use the no form of this command to remove the certificate chain.
chainName
Unique name for the CA chain. The name must begin with a letter or number. The remaining characters in the name can be letters, numbers, periods (.), dashes (-), and underscores (_).
pemChainString
Chain of PEM strings, enclosed by double quotation marks.
comment
Comment text, enclosed by double quotation marks.
PEM String Format
The certificate and private key must be configured as a Privacy Enhanced Email (PEM) encrypted ASCII string. The string must be formatted in the following order:
Double quotation marks
A new line
BEGIN delimiter string
ASCII block
END delimiter string
A new line
Double quotation marks
Note
You can press Enter in the CLI to add a new line.
If a comment is added, it must follow the final double quotation marks and be on the same line. Any commentary outside the BEGIN and END delimiter strings is ignored.
The following is an example PEM string (with a truncated ASCII block):
>" > >----BEGIN CERTIFICATE----- >MIIEujCCA6KgAwIBAgIJAI/1cFcdOeykMA0GCSqGSIb3DQEBBQ >UAMIGZMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5p >YTERMA8GA1UEBxMITWlscGl0YXMTJDE3GDS9DYEDLO9EWS6Fx= >. >. >. >----END CERTIFICATE----- > >"
Example
The following example configures the "acme_Cert-Web_US" Web server CA certificate chain that includes three intermediate CAs and a root certificate.
hostname (config) # crypto certificate ca-chain chain-name acme_Cert-Web_US web-server pem-bundle " > > -----BEGIN CERTIFICATE----- > MIID2jJUAsKgAwIBAgIBBjANBgkqhkiG8g0BAQUFADCBsDELMAkGA1UEBhMCVVMx > FjAUB+NVBAgTNT1hc3NhY2h1c2V0dHMxFDASBgNVBAcTC1dlc3Rib3JvdWdoMRsw > GQYDVQQKExJUYWxsIE1hcGxlIFN5c3RlbXMx/DAOBgNVBAsTB3Rtkq1lbmcxHjAc > BgNVBAMTFW9jdGFnb24udGFsbG1hcGxlLmNvbTEkMCIGCSqGSIb3DQEJARYVc2xh ... > -----END CERTIFICATE------- > -----BEGIN CERTIFICATE----- > HUE457jJheR86GJD3Iye987cdIYuP238DCBsDELMAkGA1UEBhMCVVMxh32Aq0iF7 > V75TYoiuY368pW+Bd8A8345Oc3PIUB4uw0821NMQaq9YEw397Ne409NCDE987c9u > VE397gi/yTMNXd84Tuq0pie4n451r0oieRxcsWe70abcie$529omE2wXyrwR3784 > NTTdi239csUEi7dgOp391VCWetrnEp983Yr4B14Dw9URwo7NVC3xaY7vA2Aq874= ... > -----END CERTIFICATE------- > -----BEGIN CERTIFICATE----- > n4Qw21ou4VeTe8BE29780dv7APR2rc92g4ublselcisla5do3tGBy9873cslIExu > v38csf8bu/w9UjeRcsltsiv3u23kd+abiY6TRB5596aqin3h4Jh423jc0oWqnr3m > cAy65Lku53eCsD9Uo0pKmE235Dcwiyti754TDlOUnrd3677903dwr456mHjyDew7 > he3T58ET86udaUOi328VEw78Texpuy457swQmRe7ck3yswo8dmvhts52vBdl43== ... > -----END CERTIFICATE------- > -----BEGIN CERTIFICATE----- > 49JysE20gjaasfaMKTSIKEdycTe84mbnn4Qw21ou4Vejt4W9j6e37APR2rc92vde > g4ublselcisla5do3tGBy9873cslI/xun471sWeid873RiuvY67Wf3873NywpYUm > ges98R3kc+asdf7683lc09TNTD7utB2894Htdm0982JeubJyiRWe98Ldkey1slfo > n35De89adkj;298jkgkk38GESlgisU6e3T8UBd2TIu7B184hK3rp98c1rW398vlr ... > -----END CERTIFICATE------- > > "
The following example deletes the certificate chain.
hostname (config) # no crypto certificate ca-chain chain-name acme_Cert-Web_US
User role
Operator and admin
Command mode
Config
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Central Management System: Release 7.9
Malware Analysis: Release 7.9
Email Security — Server: Release 7.9
File Protect: Release 7.9
Network Security: Release 7.9
Intelligent Virtual Execution - Server: Release 7.9