Шаг1. Проверяем Дату, Время и Временную зону
1. Выбираем Configuration, и кликаем на Device Setup.
2. Раскрываем список System Time и выбираем Clock.
3. Проверяем информацию которая отбразилась.
Шаг2. Генерация Certificate Signing Request (SCR)
Certificate signing request (CSR) is required in order for the 3rd party CA to issue an identity certificate. The CSR contains your ASA's distinguished name (DN) string along with the ASA's generated public key. The ASA uses the generated private key to digitally sign the CSR.
ASDM Procedure
1. Выбираем Configuration и кликаем Device Management.
2. Раскрываем список Certificate Management и выбираем Identity Certificates.
3. Нажимаем Add.
4. Переключаем radio button на Add a new identity certificate.
5. В строке Key Pair кликаем на New.
6. Выбираем Enter new key pair name. Далее надо дать название, желательно осмысленное :)
7. В поле Size выбираем 2048
8. И нажимаем Generate Now.
В течение некоторого времени будут создаваться пара ключей.
8. Далее необходимо сопастваить признаки для Certificate Subject DN:
Attribute Description
CN FQDN (Full Qualified Domain Name)
OU Department Name
O Company Name (Avoid using Special Characters)
C Country Code (2 Letter Code without Punctuation)
St State (Must be spelled out completrly EX: North Carolina)
L City
Чтобы сформировать какой либо параметр, сначала выбираем в поле Attribute необходимый атрибут и вписываем в поле Value значение и нажимаем кнопку Add.
9. После завершения работы по добавлению атрибутов, нажимаем OK.
10. Нажимаем на кнопку Advanced.
11. В поле FQDN, вводим FQDN которое используется для доступа к девайсу через Интернет. Это значение FQDN такое же какое вы использовали для Common Name (CN).
12. Нажимаем OK, и затем кликаем на Add Certificate.
Будет предложено сохранить Ваш CSR в файл на вашей локальной машине.
13. Кликаем Browse, выбираем папку куда сохранить ваш CSR, и сохраняем файл с расширением .txt.
14. Подтверждаем сохранение и отправляем файл поставщику сертификата.
Шаг3. Authenticate the Trustpoint
Once you receive the identity certificate from the 3rd party vendor, you can proceed with this step.
ASDM Procedure
1. Save the identity certificate to your local computer.
2. If your were provided a base64-encoded certificate that did not come as a file, you must copy the base64 message, and paste it into a text file.
3. Rename the file with a .cer extension.
Note: Once the file is renamed with the .cer extension, the file icon should display as a certificate.
4. Double-click the certificate file.
The Certificate dialog box appears.
[+] Show Image [ASDM]
asa_8.x_3rdpartyvendorcert_07.gif
Note: If the "Windows does not have enough information to verify this certificate" message appears in the General tab, you must obtain the 3rd party vendor root CA or intermediate CA certificate before you continue with this procedure. Contact your 3rd party vendor or CA administrator in order to obtain the issuing root CA or intermediate CA certificate.
5. Click the Certificate Path tab.
6. Click the CA certificate located above your issued identity certificate, and click View Certificate.
[+] Show Image [ASDM]
asa_8.x_3rdpartyvendorcert_08.gif
Detailed information about the intermediate CA certificate appears.
warning Warning! Do not install the identity (device) certificate in this step. Only the root, subordinate root, or CA certificate are added in this step. The identity (device) certificates are installed in Step 4.
7. Click Details.
[+] Show Image [ASDM]
asa_8.x_3rdpartyvendorcert_09.gif
8. Click Copy to File.
9. Within the Certificate Export Wizard, click Next.
[+] Show Image [ASDM]
asa_8.x_3rdpartyvendorcert_10.gif
10. In the Export File Format dialog box, click the Base-64 encoded X.509 (.CER) radio button, and click Next.
[+] Show Image [ASDM]
asa_8.x_3rdpartyvendorcert_11.gif
11. Enter the file name and location to which you want to save the CA certificate.
12. Click Next, and then click Finish.
13. Click OK in the Export Successful dialog box.
14. Browse to the location where you saved the CA certificate.
15. Open the file with a text editor, such as Notepad. (Right-click the file, and choose Send To > Notepad.)
16. The base64-encoded message should appear similar to the certificate in this image:
[+] Show Image [ASDM]
asa_8.x_3rdpartyvendorcert_12.gif
17.
Within ASDM, click Configuration, and then click Device Management.
18.
Expand Certificate Management, and choose CA Certificates.
19.
Click Add.
20.
Click the Paste certificate in PEM Format radio button, and paste the base64 CA certificate provided by the 3rd party vendor into the text field.
21.
Click Install Certificate.
[+] Show Image [ASDM]
asa_8.x_3rdpartyvendorcert_13.gif
A dialog box appears that confirms the installation was succesful.
