This command declares the Certificate Authority (CA) the XSR should use and identifies CAs
which may be required as part of the CA chain for the router or a peer IPSec client. If you
previously declared the CA and just want to update its characteristics, specify the name you
previously created. In some cases, the CA might require a particular CA name, such as its domain
name.

Performing this command acquires CA Identity mode, where you can specify CA characteristics
with the following sub‐commands:

•

crl frequency

‐ Specifies the interval between Certificate Revocation List (CRL) retrievals

and other maintenance that may be performed periodically. Refer to

page 14‐85

for the

command definition.

•

enrollment http-proxy

‐ Specifies the local HTTP proxy server. It is optional. Refer to

page

14‐86

for the command definition.

•

enrollment retry count

‐ Specifies how many certificate enrollment polls

the XSR

will

send before giving up. It is defaulted. Refer to

page 14‐86

for the command definition.

•

enrollment retry period

‐ Specifies an interval that the XSR should wait between sending

certificate request retries. It is defaulted. Refer to

page 14‐87

for the command definition.

•

enrollment url

‐ Specifies the URL of the CA and is always required. Refer to

page 14‐88

for

the command definition.

Syntax

crypto ca identity name

Note: AAA commands are described in Chapter 13: Configuring Security.