| 6.5 |  | Digital Certificates |
| 6.5.3 |  | CA servers |

| There are several CA vendors that interoperate with Cisco IOS software on Cisco routers. They include Entrust, VeriSign, Baltimore, and Microsoft. Several CA vendors support the simple certificate enrollment protocol (SCEP) for enrolling Cisco routers. Cisco is using the Cisco Security Associate Program to test new CA and Public Key Infrastructure (PKI) solutions with the Cisco Secure family of products.

Microsoft Windows 2000 certificate services
Microsoft has integrated SCEP support into the Windows 2000 CA server through the Windows 2000 Server Resource Kit. SCEP assists Cisco devices to obtain certificates and certificate revocation information from Microsoft Certificate Services for all of the Cisco VPN security solutions. This is for compatible PCs capable of running Windows 2000 Server. The Windows 2000 CA server must use the Cisco IOS release 12.0(5)T and above. The following standards are supported with this CA server, X.509 version 3, CRL version 2, PKCS #7, 10, and 12, PKIX, SSL version 3, Kerberos v5 RFC 1510, 1964 tokens, SGC, IPSec, PKINIT, PC/SC, and IETF 2459.

The SCEP tool is not installed by default. After installing the Microsoft CA services, the SCEP tool must be installed separately using the Windows 2000 Resource Kit. To install the SCEP tool, use the following procedure:

Step 1 Before starting, install the SCEP Add-on for Certificate Services on a root CA. Both enterprise root CAs and stand-alone root CAs are supported.

Step 2 Log on with the appropriate administrative privileges to the server on which the root CA is installed.

Step 3 Run the cepsetup.exe file located on the Windows 2000 Resource Kit CD.

Step 4 In the SCEP Add-on for Certificate Services Setup wizard, perform the following steps:

- Select whether or not a challenge phrase will be required for certificate enrollment. Adding a challenge phrase may increase security, especially if the CA is configured to automatically grant certificates. This will obtain the challenge phrase immediately before enrolling the IPSec Client by accessing the CA URL http://URLHostName/certsrv/mscep/mscep.dll, and copying the phrase. The phrase is then entered upon IPSec Client enrollment.
- Enter information about who is enrolling for the RA certificate, which will later allow certificates to be requested from the CA on behalf of the router.
- Select Advanced Enrollment Options to specify the cryptographic service provider (CSP) and key lengths for the RA signature and encryption keys. This step is optional.
- The URL http://URLHostName/certsrv/mscep/mscep.dll is displayed when the SCEP Setup wizard finishes and confirms a successful installation. URLHostName is the name of the server that hosts the CA enrollment Web pages, also referred to as Certificate Services Web pages.

It may be necessary to update the mscep.dll with a later version. Refer to the Microsoft Web site at www.microsoft.com for more information.

| Web Links www.entrust.com www.verisign.com www.baltimore.com