CUMA SSL Certificate (2048 bits)

Question

Hi team
I have  Sent to verisign,  a  self-signed request for a CUMA Server 7.1, but, they say that the key size is not secure  (1024 bits) and they want,  that I change the Key size to 2048bits. Can I do that? I won´t have problem with this change?
Thanks
Jose

Answer 1

Here do we need to generate the new key pair or can we use the default Key pair .
As you already created the default keypair with 2048 bits, you can use the default one. But it's a good practice to have separate key-pairs for different functions. So I would generate a new key-pair with a specific label like "SSL-KEYS" and use that for ASDM.
Also for self signed certificate do we need to specify the DN attributes value ? i.e Common Name , Department , Company Name etc. etc .
that depends on how you want to access your ASA. If you have your ASA-FQDN in DNS, then use that as the subject (CN=asa.example.com). Or you use the inside IP address of the ASA to access the ASDM.
Also do we need to enable Act as local certificate authority and issue dynamic certificates to TLS proxy ?
no, that's a completely different functionality.
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni