Adding supplemental CA certificates using the CLI

Use the commands in this section to add a certificate to the certificate database, and then add it to the default CA list as a supplemental certificate.

Note

You can also download the certificate, as described in Downloading a certificate using the CLI.

There are two ways you can import a CA certificate:

Import a private key directly.
Import a private key by entering it when prompted.

To add a supplemental CA certificate:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

Use the following command to import the supplemental certificate:
```
hostname (config) # crypto certificate name <certName> public-cert pem "<pemString>" [comment "<comment>"]
```
The command parameters are defined as follows:
- <certName>—Unique certificate name; it cannot be the name of an existing certificate in the certificate database.
- <pemString>—The public certificate PEM string.
- <comment>—An optional comment.
Important
The PEM string and comment must be formatted as described in Format requirements.
Example:
```
hostname (config) # crypto certificate name cert0 public-cert pem "MIIEujCCA6KgAwIBAgIJAI/1cFcdOeykMA0GCSqGSIb3DQEBBQ
UAMIGZMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5p
YTERMA8GA1UEBxMITWlscGl0YXMTJDE3GDS9DYEDLO9EWS6Fx=..."
comment "certificate import example
```
If you want to import a private key directly, use the following command:
```
hostname (config) # crypto certificate name <certName> private-key pem "<pemString>"
```
The command parameters are defined as follows:
- <certName>—Unique certificate name; it cannot be the name of an existing certificate in the certificate database.
- <pemString>—The public certificate PEM string, formatted as described in Format requirements.
Example:
```
hostname (config) # crypto certificate name cert1 private-key pem "MIIEujCCA6KgAwIBAgIJAI/1cFcdOeykMA0GCSqGSIb3DQEBBQ
UAMIGZMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5p
YTERMA8GA1UEBxMITWlscGl0YXMTJDE3GDS9DYEDLO9EWS6Fx=..."
```
If instead you want to import the private key by entering it when prompted and with secure echo of your response, use the following command:
```
hostname (config) # crypto certificate name <certName> prompt-private-key
```
The <certName> parameter is the unique name by which the certificate is identified.
The following example imports a private key that you enter when prompted.
```
hostname (config) # crypto certificate name Cert2 prompt-private-key
```

Add the certificate to the default CA list:

hostname (config) # crypto certificate ca-list default-ca-list name cert3

Verify your changes:

hostname (config) # show crypto certificate ca-list

Save your changes.
```
hostname (config) # write memory
```

Format requirements

The PEM string must be formatted in the following order:

Double quotation marks
A new line
BEGIN delimiter string
ASCII block
END delimiter string
A new line
Double quotation marks

Note

You can press Enter in the CLI to add a new line.

If a comment is added, it must follow the final double quotation marks and be on the same line. Any commentary outside the BEGIN and END delimiter strings is ignored.

The following is an example PEM string (with a truncated ASCII block):

>" 
>>----BEGIN CERTIFICATE-----
>MIIEujCCA6KgAwIBAgIJAI/1cFcdOeykMA0GCSqGSIb3DQEBBQ
>UAMIGZMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5p
>YTERMA8GA1UEBxMITWlscGl0YXMTJDE3GDS9DYEDLO9EWS6Fx=
>.
>.
>.
>----END CERTIFICATE-----
>
>"

Adding supplemental CA certificates using the CLI

Note

Important

Format requirements

Note