Trusted certificate authority objects

A trusted certificate authority object is a security configuration item that

  • represents a CA public key certificate belonging to a trusted CA,

  • consists of the object name and CA public key certificate, and

  • can be used in SSL policy, realm configurations, and integration with ISE or ISE-PIC.

Usage scenarios for trusted certificate authority objects

You can use trusted certificate authority objects and groups in the following configurations:

  • SSL policy: Control traffic encrypted with a certificate signed either by the trusted CA, or any CA within the chain of trust.

  • Realm configurations: Establish secure connections to LDAP or Active Directory (AD) servers.

  • ISE or ISE-PIC connection: Select trusted certificate authority objects for the pxGrid Server CA and MNT Server CA fields.

After you create the trusted CA object, you can modify the name and add certificate revocation lists (CRL), but cannot modify other object properties. There is no limit on the number of CRLs you can add to an object. If you want to modify a CRL you have uploaded to an object, you must delete the object and recreate it.

Note

Adding a CRL to an object has no effect when the object is used in your ISE or ISE-PIC integration configuration.

You cannot delete a trusted CA object that is in use. Additionally, after you edit a trusted CA object that is in use, the associated access control policy goes out-of-date. You must re-deploy the access control policy for your changes to take effect.