Use the CLI commands in this section to configure the user attributes for certificate authentication.
Note
Use the no aaa authentication certificate username command to reset the certificate field for the username to use the default x509-cert-san-upn attribute.
Go to CLI configuration mode.
hostname > enable hostname # configure terminal
Specify the name of the entry for the subject field in the certificate.
hostname (config) # aaa authentication certificate username x509-cert-subjectSpecify an entry for the Common Name (CN) from the DN attribute that is associated in a certificate.
hostname (config) # aaa authentication certificate username x509-cert-subject-cnSpecify an email address in the Subject Alternative Name (SAN) field of the certificate. You are allowed to have multiple subfields for SAN.
hostname (config) # aaa authentication certificate username x509-cert-san-emailSpecify the user name of the email address without the domain name in the certificate.
hostname (config) # aaa authentication certificate username x509-cert-san-email-usernameSpecify the User Principal Name (UPN) that is encoded in the "Other Name" field of the SAN field in the certificate.
hostname (config) # aaa authentication certificate username x509-cert-san-upnSpecify the user name of the UPN attribute without the domain name in the certificate.
hostname (config) # aaa authentication certificate username x509-cert-san-upn-usernameVerify the configuration of the certificate-based authentication settings.
hostname (config) # show aaa authentication certificateCertificate based authentication settings:
Web Policy : required
Certificate field for username : x509-cert-subject-cnCA certificate bundle : client-cert-auth
OCSP enabled : no
Default OCSP URL : http://10.3.13.219:80
OCSP override responder : no
Basic constraints must present : no
No CRL file is configured.
Save your changes.
hostname (config) # write memory