Use this command to manually verify a CA certificate chain against the default CA bundle or supplemental CA list.
Syntax
crypto certificate reverify chain-name <chainName>
Parameters
chainName
The name of the chain.
Example
The following example manually verifies the certificates in the "apache12" Web server CA certificate chain. The "apache 02-1" certificate failed validation because its issuing certificate ("apache02-2") was not added to the supplemental CA list. After it is added, all certificates in the chain are verified.
cm-02 (config) # crypto certificate reverify chain-name apache12 Certification notice: certificate name apache02-1, ID 6xxxxxxx could not be verified: unable to get issuer certificate Certification notice: certificate name apache 02-2, ID 7xxxxxxx is verified: verify ok Certification notice: certificate name apache02-03, ID 8xxxxxxx is verified: verify ok cm-02 (config) # crypto certificate ca-list default-ca-list name apache02-2 cm-02 (config) # crypto certificate reverify chain-name apache12 Certification notice: certificate name apache02-1, ID 6xxxxxxx is verified: verify ok Certification notice: certificate name apache 02-2, ID 7xxxxxxx is verified: verify ok Certification notice: certificate name apache02-03, ID 8xxxxxxx is verified: verify ok
User role
Operator and admin
Command mode
Config
Supported appliances
This command is supported on the following appliances running the specified releases or later:
Central Management System: Release 8.0.0
Malware Analysis: Release 8.0.0
Email Security — Server: Release 8.0.0
File Protect: Release 8.0.0
Network Security: Release 8.0.0