Downloading a CA certificate bundle using the CLI

Use the CLI commands in this section to download a CA certificate bundle, and add an imported certificate to an existing bundle from a specified URL. The bundle must be a single concatenated PEM file. Each certificate is imported in to the bundle configuration. The imported certificates are listed in the specified bundle.

By default, if the name of the bundle already exists, it will be replaced with an imported certificate.

Note

The certificate bundle must be named client-cert-auth.

To download a CA certificate bundle:

Go to CLI configuration mode.

hostname > enable

hostname # configure terminal

Specify the name for the certificate bundle and download it.
```
hostname (config) # crypto certificate bundle <bundle_name> fetch url <url>
```
where:
- <bundle_name> is the name of the certificate bundle. The bundle must be client-cert-auth.
- <url> is the direct path to the certificate file. The <url> is specified with remote server Administrator credentials (<username> and <password>), the remote server( <hostname>), the path and filename in which to save the certificate bundle (<path/filename>) in the following format:
```
scp://<username>[:<password>]@<hostname>/<path/filename>
```
  Note
  If you do not specify the remote host administrator password in the crypto certificate bundle fetch url command (where the password would be visible as clear text), the CLI prompts for the password and obfuscates the keyboard input as you type it.
If the certificates were successfully imported, the command output is as follows:
```
Successfully imported 2 of 2 certificate(s).
```
(Optional) Add a new certificate to an existing certificate bundle. The existing certificates will be retained in the database.
```
hostname (config) # crypto certificate bundle <certificate_name> fetch url <url> append
```

Verify the list of all the certificate bundle names. The comment is added automatically when you import a certificate bundle.

hostname (config) # show crypto certificate bundle

Bundle name                Comment

============================================================

client-cert-auth           Imported from http://builds.eng.fireeye.com/~john.doe/vps1-cacerts.pem

(Optional) View the Privacy Enhanced Email (PEM) encrypted ASCII string of the certificate bundle.

hostname (config) # show crypto certificate bundle client-cert-auth pem

-----BEGIN CERTIFICATE-----

MIIFRzCCBC+gAwIBAgIJANHeZPrkimh2MA0GCSqGSIb3DQEBCwUAMGcxCzAJBgNV

BAYTAlVTMQswCQYDVQQIDAJDQTERMA8GA1UEBwwITWlscGl0YXMxEDAOBgNVBAoM

B0ZpcmVFeWUxDTALBgNVBAsMBENBb3UxFzAVBgNVBAMMDnZwczFfcm9vdF9jYV8x

.....

-----END CERTIFICATE-----

Save your changes.
```
hostname (config) # write memory
```