Configuring a Web server CA certificate chain using the CLI

Use the commands in this section to configure a Web server CA certificate chain.

Important

See Configuring a Web server CA certificate chain for details about how to bundle the certificates in the chain.

To configure a Web server CA certificate chain:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

Configure the certificate chain:
```
hostname (config) # crypto certificate ca-chain chain-name <chainName> web-server pem-bundle "<pemChainString>" [comment "<comment>"]
```
where:
- chainName is a unique name for the CA chain. The name must begin with a letter or number. The remaining characters in the name can be letters, numbers, periods (.), dashes (-), and underscores (_).
- pemChainString is the chain of PEM strings.
- comment is the text for the comment.
Important
The PEM chain string and comment must be formatted as described in Format requirements.

Verify your changes:

hostname (config) # show crypto certificate ca-chain chain-name <chainName>

Save your changes:
```
hostname (config) # write memory
```
Activate the CA chain as described in Activating a web server CA certificate chain using the CLI.

To view the certificates belonging to the chain:

Go to CLI enable mode:
```
hostname > enable
```
View the certificates:
```
hostname # show crypto certificate ca-chain chain-name [<chainName>] [brief | detail]
```
The brief option displays only the chain names. The detail option displays all available certificate attributes.

To delete a Web server CA certificate chain:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

Delete the chain:

hostname (config) # no crypto certificate ca-chain chain-name <chainName>

Format requirements

The PEM string must be formatted in the following order:

Double quotation marks
A new line
BEGIN delimiter string
ASCII block
END delimiter string
A new line
Double quotation marks

Note

You can press Enter in the CLI to add a new line.

If a comment is added, it must follow the final double quotation marks and be on the same line. Any commentary outside the BEGIN and END delimiter strings is ignored.

The following is an example PEM string (with a truncated ASCII block):

>" 
>>----BEGIN CERTIFICATE-----
>MIIEujCCA6KgAwIBAgIJAI/1cFcdOeykMA0GCSqGSIb3DQEBBQ
>UAMIGZMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5p
>YTERMA8GA1UEBxMITWlscGl0YXMTJDE3GDS9DYEDLO9EWS6Fx=
>.
>.
>.
>----END CERTIFICATE-----
>
>"

Examples

Configuring a certificate chain

The following example configures the "apache03" Web server CA certificate chain that includes two intermediate CAs and the root certificate.

hostname (config) # crypto certificate ca-chain chain-name web-server pem-bundle apache03 "
>
> -----BEGIN CERTIFICATE-----
> MIID2jJUAsKgAwIBAgIBBjANBgkqhkiG8g0BAQUFADCBsDELMAkGA1UEBhMCVVMx
> FjAUB+NVBAgTNT1hc3NhY2h1c2V0dHMxFDASBgNVBAcTC1dlc3Rib3JvdWdoMRsw
> GQYDVQQKExJUYWxsIE1hcGxlIFN5c3RlbXMx/DAOBgNVBAsTB3Rtkq1lbmcxHjAc
> BgNVBAMTFW9jdGFnb24udGFsbG1hcGxlLmNvbTEkMCIGCSqGSIb3DQEJARYVc2xh
...
> -----END CERTIFICATE-------
> -----BEGIN CERTIFICATE-----
> HUE457jJheR86GJD3Iye987cdIYuP238DCBsDELMAkGA1UEBhMCVVMxh32Aq0iF7
> V75TYoiuY368pW+Bd8A8345Oc3PIUB4uw0821NMQaq9YEw397Ne409NCDE987c9u
> VE397gi/yTMNXd84Tuq0pie4n451r0oieRxcsWe70abcie$529omE2wXyrwR3784
> NTTdi239csUEi7dgOp391VCWetrnEp983Yr4B14Dw9URwo7NVC3xaY7vA2Aq874=
...
> -----END CERTIFICATE-------
> -----BEGIN CERTIFICATE-----
> 49JysE20gjaasfaMKTSIKEdycTe84mbnn4Qw21ou4Vejt4W9j6e37APR2rc92vde
> g4ublselcisla5do3tGBy9873cslI/xun471sWeid873RiuvY67Wf3873NywpYUm
> ges98R3kc+asdf7683lc09TNTD7utB2894Htdm0982JeubJyiRWe98Ldkey1slfo
> n35De89adkj;298jkgkk38GESlgisU6e3T8UBd2TIu7B184hK3rp98c1rW398vlr
...
> -----END CERTIFICATE-------
>
> "

hostname (config) # show crypto certificate ca-chain chain-name apache03
  CA chain name apache03 (web-server):

  Certificate with name 'apache03-1'
    Chained CA member certificate
    (may only be deleted through the chain)

    Certificate Type:                       RSA
    Private Key:                            not present
    Serial Number:                          0x1xxx
    SHA-1 Fingerprint:                      4xxxxxx

    Validity:
      ...

    Subject:
      Common Name:                          acme-intermediate
      ...

    Issuer:
      Common Name:                          xxx-intermediate
      ...

  Certificate with name 'apache03-2'
    Chained CA member certificate
    (may only be deleted through the chain)

    Certificate Type:                       RSA
    Private Key:                            not present
    Serial Number:                          0x2xxx
    SHA-1 Fingerprint:                      8xxxxxx

    Validity:
     ...

    Subject:
      Common Name:                          xxx-intermediate
      ...

    Issuer:
      Common Name:                          xxx-root-ca
      ...

  Certificate with name 'apache03-3'
    Chained CA member certificate
    (may only be deleted through the chain)

    Certificate Type:                       RSA
    Private Key:                            not present
    Serial Number:                          03xxx
    SHA-1 Fingerprint:                      7xxxxxx

    Validity:
      ...

    Subject: 
      Common Name:                          xxx-root-ca
      ...
                                   
    Issuer:
      Common Name:                          xxx-root-ca
      ...

Deleting a certificate chain

The following example deletes the "apache04" certificate chain.

hostname (config) # no crypto certificate ca-chain chain-name apache04