Use the CLI commands in this section to enable or disable the appliance to allow the user to log in to the Web UI even when the basic constraints extension is not included in the X.509 certificate. The basic constraints extension is used to identify that the certificate is issued for a Certificate Authority (CA). By default, the appliance verifies if the basic constraints extension is included in the X.509 certificate, and the login fails if the extension is not found. When the aaa authentication certificate validation allow-missing-basic-constraints command is disabled, users cannot log in to the Web UI if the basic constraints extension is not included in the X.509 certificate.
Go to CLI configuration mode.
hostname > enable hostname # configure terminal
Enable the appliance to allow the user to log in to the Web UI even when the basic constraints extension is not included in the X.509 certificate.
hostname (config) # aaa authentication certificate validation allow-missing-basic-constraintsVerify the status of the basic constraints extension.
hostname (config) # show aaa authentication certificateCertificate based authentication settings:
...
OCSP override responder : no
Basic constraints must present : no
...
Save your changes.
hostname (config) # write memory
Go to CLI configuration mode.
hostname > enable hostname # configure terminal
Disable the option to allow the user to log in to the Web UI when the basic constraints extension is not included in the X.509 certificate.
hostname (config) # no aaa authentication certificate validation allow-missing-basic-constraintsVerify the status of the basic constraints extension.
hostname (config) # show aaa authentication certificateCertificate based authentication settings:
...
OCSP override responder : no
Basic constraints must present : yes
...
Save your changes.
hostname (config) # write memory