Enabling or disabling a certificate with missing basic constraints using the CLI

Prev Next

Use the CLI commands in this section to enable or disable the appliance to allow the user to log in to the Web UI even when the basic constraints extension is not included in the X.509 certificate. The basic constraints extension is used to identify that the certificate is issued for a Certificate Authority (CA). By default, the appliance verifies if the basic constraints extension is included in the X.509 certificate, and the login fails if the extension is not found. When the aaa authentication certificate validation allow-missing-basic-constraints command is disabled, users cannot log in to the Web UI if the basic constraints extension is not included in the X.509 certificate.

To enable the appliance to allow a certificate with a missing basic constraints extension:
  1. Go to CLI configuration mode.

    hostname > enable
    hostname # configure terminal
  2. Enable the appliance to allow the user to log in to the Web UI even when the basic constraints extension is not included in the X.509 certificate.

    hostname (config) # aaa authentication certificate validation allow-missing-basic-constraints
  3. Verify the status of the basic constraints extension.

    hostname (config) # show aaa authentication certificate
    Certificate based authentication settings:
      ...
      OCSP override responder        : no
      Basic constraints must present : no
      ...
  4. Save your changes.

    hostname (config) # write memory
To prohibit certificates with a missing basic constraints extension:
  1. Go to CLI configuration mode.

    hostname > enable
    hostname # configure terminal
  2. Disable the option to allow the user to log in to the Web UI when the basic constraints extension is not included in the X.509 certificate.

    hostname (config) # no aaa authentication certificate validation allow-missing-basic-constraints
  3. Verify the status of the basic constraints extension.

    hostname (config) # show aaa authentication certificate
    Certificate based authentication settings:
      ...
      OCSP override responder        : no
      Basic constraints must present : yes
       ...
  4. Save your changes.

    hostname (config) # write memory