Managing Threat Defense Certificates

You can see the following columns for each device listed on this screen:

• Name—Lists the devices that already have trustpoints associated with them. Expand the device to see the list of associated trustpoints.

• Domain—Displays the certificates that are enrolled in a specific domain.

• Enrollment Type—Displays the type of enrollment used for a trustpoint.

• Status—Provides the status of the CA Certificate and Identity Certificate. You can view the certificate contents, when Available, by clicking the magnifying glass.

  When you view the CA certificate information, you can view the hierarchy of all the certifying authorities, which issued your CA certificate.

  If the enrollment fails, click status to view the failure message.

• Click Enable weak-crypto on the right to enable weak cipher usage in certificates. When you click the toggle button, you get a warning to confirm before enabling weak ciphers. Click Yes to enable weak ciphers.

  Note	When a certificate enrollment fails due to weak cipher usage, you get a prompt to enable the weak cipher. You can choose to enable weak cipher when you need to use weak encryption.

• The additional column lists icons to perform the following tasks:

  • Export Certificate—Click to export and download a copy of the certificate. You can choose to export the PKCS12 (Complete Certificate Chain) or the PEM(Identity Certificate Only) format.

    You must provide a pass phrase to export a PKCS12 certificate format to import the file later.

  • Re-enroll certificate—Re-enroll an existing certificate.

  • Refresh certificate status—Refresh a certificate to synchronize the Firepower Threat Defense device certificate status to the Firepower Management Center.

  • Delete certificate—Delete all the associated certificates for a trustpoint.

When a certificate enrollment object is associated with and then installed on a device, the process of certificate enrollment starts immediately. The process is automatic for self-signed and SCEP enrollment types, meaning it does not require any additional administrator action. Manual certificate enrollment requires extra administrator action.

Note

The certificate enrollment on a device does not block the user interface and the enrollment process gets executed in the background, enabling the user to perform certificate enrollment on other devices in parallel. The progress of these parallel operations can be monitored on the same user interface. The respective icons display the certificate enrollment status.