Use the commands in this section to verify a certificate chain, an individual certificate, or a certificate bundle.
To verify a certificate chain:
Go to CLI configuration mode:
hostname > enable hostname # configure terminal
Verify the chain:
hostname (config) # crypto certificate reverify chain-name <chainName>
To verify an individual certificate:
Go to CLI configuration mode:
hostname > enable hostname # configure terminal
Verify the certificate:
hostname (config) # crypto certificate reverify cert-name <certName>
To verify a certificate bundle:
Go to CLI configuration mode:
hostname > enable hostname # configure terminal
Verify the bundle:
hostname (config) # crypto certificate reverify bundle-name <bundleName>
Example
The following example installs the "apache02" Web server CA certificate chain. It shows that the "apache02-1" and "apache02-2" intermediate certificates failed verification, and the "apache02-3" self-signed root certificate passed verification. It then adds the two issuer certificates (apache02-03 and apache02-02) to the supplemental CA list, and manually verifies the chain.
ex-04 (config) # crypto certificate ca-chain chain-name web-server pem-bundle apache02 " > >-----BEGIN CERTIFICATE--- ... >-----END CERTIFICATE----- >-----BEGIN CERTIFICATE--- ... >-----END CERTIFICATE----- >-----BEGIN CERTIFICATE--- ... >-----END CERTIFICATE----- > > " Certificate notice: certificate name apache02-1, ID 6xxxxxx could not be verified: unable to get issuer certificate Certificate notice: certificate name apache02-2, ID 7xxxxxx could not be verified: unable to get issuer certificate Certificate notice: certificate name apache02-3, ID 8xxxxxx is verified: verify ok ex-04 (config) # crypto certficiate ca-list default-ca-list name apache02-03 ex-04 (config) # crypto certificate ca-list default-ca-list name apache02-02 ex-04 (config) # reverify chain name apache02 Certification notice: certificate name apache02-1, ID 6xxxxxx is verified: verify ok
Certification notice: certificate name apache02-2, ID 7xxxxxx is verified: verify ok Certification notice: certificate name apache02-3, ID 8xxxxxx is verified: verify ok