i have configured a cisco router with the following configuration to practice obtaining
certificates from a microsoft 2008 server configured as a stand alone CA.
this part works okay but what i am trying to do next is giving me a headache
i am trying to delete the identity certificate but am having no luck whatsoever
interface FastEthernet0/0
ip address 192.168.2.1 255.255.255.0
ip nat outside
no shut
interface FastEthernet0/1
ip address 192.168.1.1 255.255.255.0
ip nat inside
no shut
access-list 101 permit ip 192.168.1.0 0.0.0.255 192.168.5.0 0.0.0.255
access-list 102 deny ip 192.168.1.0 0.0.0.255 192.168.5.0 0.0.0.255
access-list 102 permit ip 192.168.1.0 0.0.0.255 any
hostname Purley
ip domain-name acme.com
crypto key generate rsa general-keys
crypto ca trustpoint Purley
enrollment terminal
crl optional
enrollment retry period 1
enrollment retry count 10
subject-name cn=purley.acme.com, ou=sales, o=acme ltd, l=purley, st=surrey, c=GB
exit
crypto ca authenticate Purley
crypto ca enroll Purley
crypto ca import Purley certificate
crypto isakmp enable
crypto isakmp identity hostname
crypto isakmp policy 10
authentication rsa-sig
encryption 3des
hash md5
group 2
lifetime 86400
crypto ipsec transform-set BOSTON esp-3des esp-md5-hmac
crypto map VPN 10 ipsec-isakmp
set peer 192.168.2.2
set transform-set BOSTON
match address 101
route-map nonat permit 10
match ip address 102
ip nat inside source route-map nonat interface FastEthernet0 overload
ip route 0.0.0.0 0.0.0.0 192.168.2.2
interface FastEthernet0/0
crypto map VPN
copy run start
Purley#show crypto ca certificate
Certificate
Status: Available
Certificate Serial Number: 61E0446A000000000002
Certificate Usage: General Purpose
Issuer:
cn=WIN-SQV1ABKN6Q4-CA
dc=ACME
dc=COM
Subject:
Name: purley.acme.com
cn=purley.acme.com
ou=sales
o=acme ltd
l=purley
st=surrey
c=GB
CRL Distribution Point:
file://WIN-SQV1ABKN6Q4/CertEnroll/WIN-SQV1ABKN6Q4-CA.crl
Validity Date:
start date: 14:46:13 UTC May 14 2012
end date: 14:56:13 UTC May 14 2013
Associated Trustpoints: Purley
CA Certificate
Status: Available
Certificate Serial Number: 222F01C2CED6A5B94F83A17D00339E6B
Certificate Usage: Signature
Issuer:
cn=WIN-SQV1ABKN6Q4-CA
dc=ACME
dc=COM
Subject:
cn=WIN-SQV1ABKN6Q4-CA
dc=ACME
dc=COM
Validity Date:
start date: 12:48:03 UTC May 14 2012
end date: 12:58:02 UTC May 14 2017
Associated Trustpoints: Purley
i entered the following commands on the router to delete the certificate
but as you can see its telling me the certificate dosn't exist
(this method of deleting the cert has come from Richard Deals
complete cisco vpn configuration guide)
Purley(config)#crypto ca certificate chain Purley
Purley(config-cert-chain)#no certificate 61E0446A000000000002
% Certificate not found.
has anyone any ideas as i am stumpted
Regards
Melvyn brown
ps the router is a 3640 running c3640-jk9o3s-mz.124-7.bin
