Managing named certificates using the CLI

Use the commands in this section to do the following:

Import an HTTPS or MTA certificate.
Note
You can also download the certificate, as described in Downloading a certificate using the CLI.
Generate and regenerate an HTTPS or MTA self-signed certificate.
Export the public key.

Important

If the certificate you import or generate will be used on the Web server, you must specify "web-cert" as the certificate name, and then activate the certificate as described in Activating named certificates. Likewise, if the certificate will be used on the MTA, you must specify "mta-cert" as the certificate name, and then activate the certificate.

Importing a certificate

Important

Do not add a private key for an MTA certificate if the certificate was obtained using a CSR generated from the Certificate Management page in the Web UI.

To import a certificate and private key:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

Import the certificate:
```
hostname (config) # crypto certificate name <certificateName> public-cert pem "<pemString>" [comment "<comment>"]
```
where:
- <certificateName> can be a name of your choice, but must be changed to "web-cert" or "mta-cert" before it can be activated.
- <pemString> is the public certificate PEM string.
- <comment> is the text for the comment.
Important
The PEM string and comment must be formatted as described in Usage guidelines.
Import the private key:
- To add the private key directly:
```
hostname (config) # crypto certificate name <certificateName> private-key pem "<pemString>"
```
  where <pemString> is the private key PEM string, formatted as described in Usage guidelines.
- To prompt for the private key with secure echo, so asterisks are displayed instead of the PEM string characters:
```
hostname (config) # crypto certificate name <certificateName> prompt-private-key
```

Verify your changes:

hostname (config) # show crypto certificate

Save your changes.
```
hostname (config) # write memory
```

Creating a self-signed HTTPS or MTA certificate

Note

If you do not supply attribute values when you create the self-signed certificate, the default attribute values will be used.

To create a self-signed HTTPS or MTA certificate:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

Create the certificate:
- To use default attribute values:
```
hostname (config) # crypto certificate name <certificateName> generate self-signed
```
  where <certificateName> can be a name of your choice, but must be changed to "web-cert" or "mta-cert" before it can be activated on the Web server or MTA.
- To use other attribute values:
```
hostname (config) # crypto certificate name <certificateName> generate self-signed [<attribute_1> <value>] [<attribute_2> <value>]...[<attribute_n> <value>]]]
```
  where:
  - <certificateName> can be a name of your choice, but must be changed to "web-cert" or "mta-cert" before it can be activated on the Web server or MTA.
  - <attribute_1>, <attribute_2>, and <attribute_n> are attribute names, and <value> is the value of the specified attribute. For descriptions of the attributes and values, see Defining default certificate attributes.
Save your changes.
```
hostname (config) # write memory
```

Regenerating the self-signed HTTPS or MTA certificate

Regenerating the self-signed certificate regenerates both the public and private keys. It extends the expiration date by 365 days or the number of days you specify, and gets any updated default attribute values.

To regenerate the HTTPS or MTA self-signed certificate:

Go to CLI configuration mode:

hostname > enable
hostname # configure terminal

Regenerate the HTTPS certificate:
```
hostname (config) # crypto certificate name web-cert regenerate [days-valid <days>]
```
where <days> is the number of days before the certificate expires. If the days-valid parameter is not included, the default attribute value is used.
(On the Email Security — Server Appliance Only) Regenerate the MTA certificate:
```
hostname (config) # crypto certificate name mta-cert regenerate[days-valid <days>]
```
where <days> is the number of days before the certificate expires. If the days-valid parameter is not included, the default attribute value is used.

Verify your changes:

hostname (config) # show crypto certificate name web-cert

hostname (config) # show crypto certificate name mta-cert

Save your changes.
```
hostname (config) # write memory
```

Displaying the public key for export

You can copy the public key PEM string and then paste it into a text file that you can distribute.

Note

Because private keys are sensitive, you can export only the public key.

To display the public key PEM string for export:

Go to CLI enable mode:
```
hostname > enable
```

Display the public key PEM string:

hostname # show crypto certificate name <certificateName> public-pem

Examples

Importing a certificate and key

The following example imports a certificate and its private key.

hostname (config) # crypto certificate name acme.cert3.pem public-cert pem "
>
> -----BEGIN CERTIFICATE-----
> MIID2jJUAsKgAwIBAgIBBjANBgkqhkiG8g0BAQUFADCBsDELMAkGA1UEBhMCVVMx
> FjAUBgNVBAgTNT1hc3NhY2h1c2V0dHMxFDASBgNVBAcTC1dlc3Rib3JvdWdoMRsw
> GQYDVQQKExJUYWxsIE1hcGxlIFN5c3RlbXMxEDAOBgNVBAsTB3Rtkq1lbmcxHjAc
> BgNVBAMTFW9jdGFnb24udGFsbG1hcGxlLmNvbTEkMCIGCSqGSIb3DQEJARYVc2xh
.
.
.
> -----END CERTIFICATE-----
>
> "
Successfully installed certificate with name 'acme.cert3.pem'

hostname (config) # crypto certificate name acme.cert3.pem private-key pem "
>
> -----BEGIN RSA PRIVATE KEY-----
> MIICGTCCAYICAQAwgawxCzAJBgNVBAYTAlVTMRYwFAYDVQQIEw1NYXNzYWNodXNl
> dHRzMRQwEgYDVQQHEwtXZXN0Ym9mi3VnaDEbMBkGA1UEChMSVGFsbCBNYXBsZSBT
> eXN0ZW1zMRAwDgYDVMGLEwd0bXMtZW5nMRowGAYDVQQDExF0YjcudGFsbG1hcGxl 
> LmNvbTEkMCIGCSqGSIb3DQEJARYVc2xhbnNlckB0YWrebWFwbGUuY29tMIGfMA0G
.
.
.
> -----END RSA PRIVATE KEY-----
>
> "

Creating a self-signed certificate

The following example generates an HTTPS self-signed certificate:

hostname (config) # crypto certificate name acme.selfcert5.pem generate self-signed
Successfully generated certificate with name 'acme.selfcert5.pem'

Regenerating the certificate

The following example regenerates the HTTPS self-signed certificate and its private key and extends the expiration date by two years.

hostname (config) # crypto certificate name web-cert regenerate days-valid 730
Successfully regenerated certificate with name 'web-cert'
hostname # show crypto certificate name web-cert
Certificate with name 'web-cert'
    Private Key:                 present
    Serial Number:               0x71a676d9a1j5d8a316487f9d683kkc0
    SHA-1 Fingerprint:           7g04933d77491wgba2h78d2a6f34s50cech324c78

    Validity:
        Starts:                  2015/04/25 20:32:50
        Expires:                 2017/04/22 20:32:50    
        .
        .

Exporting the public key PEM string

The following example displays the public key PEM string.

hostname # show crypto certificate name acme-cert12 public-pem
> -----BEGIN CERTIFICATE-----
> jjELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExEDAOBgNVBAcMB1Nh
> HzAdBgkqhkiG9w0BCQEWEGZlYWRtaW5AYWNtZS5jb20wggEiMA0GCSqGSIb3DQEB
> s0KvSMHO/8o0is/2wOuTQ/SF1gnBGZtPWWV0CUOZGHNt9ftAh6RLLvvvVnbguwc7
> HhcNMTUwNDI3MDIzODU2WhcNMTYwNDI2MDIzODU2WjCBjjELMAkGA1UEBhMCVVMx
> .
> .
> -----END CERTIFICATE-----