Configuring a SharePoint CA certificate chain using the CLI

Use the commands in this section to configure a SharePoint CA certificate chain.

Important

See Configuring a SharePoint CA certificate chain for details about how to bundle the certificates in the chain.

To configure a SharePoint CA certificate chain:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

Configure the certificate chain:
```
hostname (config) # crypto certificate sharepoint ca-chain chain-name <chainName> "<pemChainString>" [cert-comment "<comment>"]
```
where:
- chainName is a unique name for the CA chain. This is the name you specify when you mount the secure WebDAV share. The name must begin with a letter or number. The remaining characters in the name can be letters, numbers, periods (.), dashes (-), and underscores (_).
- pemChainString is the chain of PEM strings.
- comment is the text for the comment.
Important
The PEM chain string and comment must be formatted as described in Format requirements.
Save your changes:
```
hostname (config) # write memory
```

To view the certificates belonging to the chain:

Enable the CLI enable mode:
```
hostname > enable
```
View the certificates:
```
hostname # show crypto certificate ca-chain [<chainName>] [brief | detail]
```
The brief option displays only the chain names. The detail option displays all available certificate attributes.

To delete a SharePoint CA certificate chain:

Enable the CLI configuration mode:

hostname > enable
hostname # configure terminal

Delete the chain:

hostname (config) # no crypto certificate sharepoint ca-chain chain-name <chainName>

Format requirements

The PEM string must be formatted in the following order:

Double quotation marks
A new line
BEGIN delimiter string
ASCII block
END delimiter string
A new line
Double quotation marks

Note

You can press Enter in the CLI to add a new line.

If a comment is added, it must follow the final double quotation marks and be on the same line. Any commentary outside the BEGIN and END delimiter strings is ignored.

The following is an example PEM string (with a truncated ASCII block):

>" 
>>----BEGIN CERTIFICATE-----
>MIIEujCCA6KgAwIBAgIJAI/1cFcdOeykMA0GCSqGSIb3DQEBBQ
>UAMIGZMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5p
>YTERMA8GA1UEBxMITWlscGl0YXMTJDE3GDS9DYEDLO9EWS6Fx=
>.
>.
>.
>----END CERTIFICATE-----
>
>"

Examples

Configuring a certificate chain

The following example configures a SharePoint CA certificate chain that includes the root certificate, two intermediate certificates, and the SharePoint server certificate.

hostname (config) # crypto certificate sharepoint ca-chain chain-name acme_Cert-Dec2017_share "
>
> -----BEGIN CERTIFICATE-----
> MIID2jJUAsKgAwIBAgIBBjANBgkqhkiG8g0BAQUFADCBsDELMAkGA1UEBhMCVVMx
> FjAUB+NVBAgTNT1hc3NhY2h1c2V0dHMxFDASBgNVBAcTC1dlc3Rib3JvdWdoMRsw
> GQYDVQQKExJUYWxsIE1hcGxlIFN5c3RlbXMx/DAOBgNVBAsTB3Rtkq1lbmcxHjAc
> BgNVBAMTFW9jdGFnb24udGFsbG1hcGxlLmNvbTEkMCIGCSqGSIb3DQEJARYVc2xh
...
> -----END CERTIFICATE-------
> -----BEGIN CERTIFICATE-----
> HUE457jJheR86GJD3Iye987cdIYuP238DCBsDELMAkGA1UEBhMCVVMxh32Aq0iF7
> V75TYoiuY368pW+Bd8A8345Oc3PIUB4uw0821NMQaq9YEw397Ne409NCDE987c9u
> VE397gi/yTMNXd84Tuq0pie4n451r0oieRxcsWe70abcie$529omE2wXyrwR3784
> NTTdi239csUEi7dgOp391VCWetrnEp983Yr4B14Dw9URwo7NVC3xaY7vA2Aq874=
...
> -----END CERTIFICATE-------
> -----BEGIN CERTIFICATE-----
> n4Qw21ou4VeTe8BE29780dv7APR2rc92g4ublselcisla5do3tGBy9873cslIExu
> v38csf8bu/w9UjeRcsltsiv3u23kd+abiY6TRB5596aqin3h4Jh423jc0oWqnr3m
> cAy65Lku53eCsD9Uo0pKmE235Dcwiyti754TDlOUnrd3677903dwr456mHjyDew7
> he3T58ET86udaUOi328VEw78Texpuy457swQmRe7ck3yswo8dmvhts52vBdl43==
...
> -----END CERTIFICATE-------
> -----BEGIN CERTIFICATE-----
> 49JysE20gjaasfaMKTSIKEdycTe84mbnn4Qw21ou4Vejt4W9j6e37APR2rc92vde
> g4ublselcisla5do3tGBy9873cslI/xun471sWeid873RiuvY67Wf3873NywpYUm
> ges98R3kc+asdf7683lc09TNTD7utB2894Htdm0982JeubJyiRWe98Ldkey1slfo
> n35De89adkj;298jkgkk38GESlgisU6e3T8UBd2TIu7B184hK3rp98c1rW398vlr
...
> -----END CERTIFICATE-------
>
> " cert-comment "Acme HR SharePoint Server"

Deleting a certificate chain

The following example deletes the certificate chain.

hostname (config) # no crypto certificate sharepoint ca-chain chain-name acme_Cert-Dec2017_share