Re: Cisco and automatic renewal (signature with old certificate)

[max pritikin <pritikin@xxxxxxxxx>]

12.2?? Hmm... I think re-enroll using an existing cert went in at  
12.3(11)T.

IIRC some of the renewal, and rollover behavior on IOS clients is  
triggered automatically by the CAs responses in GetCaps.
IIRC GetCACaps is called more than once -- the results are not stored  
in the config. I don't recall if it happens before all SCEP operations  
(that would be extreme, no?).

- max

On May 9, 2008, at 3:42 AM, Alexander Klink wrote:

> Hi again,
>
> On Fri, May 09, 2008 at 10:31:50AM +0200, Alexander Klink wrote:
> > > Are you returning "Renewal" in the GetCACaps SCEP response?
> >
> > Unfortunately, we didn't implement GetCACaps (yet) - would that  
> > change
> > anything?
>
> I just checked my Apache logs and the device we're trying this on
> (a Cisco 7300 running IOS 12.2(31)SB11) apparently does not send
> GetCACaps (we updated it during the testing process, though, so
> maybe it only asks during the trustpoint configuration?) ... - any
> ideas?
>
> Cheers,
>  Alex
> --
> Dipl.-Math. Alexander Klink | IT-Security Engineer |    a.klink@xxxxxxxxx
> mobile: +49 (0)178 2121703 |          Cynops GmbH | http://www.cynops.de
> ----------------------------+---------------------- 
> +---------------------
>      HRB 7833, Amtsgericht | USt-Id: DE 213094986 |      
> Geschäftsführer:
>     Bad Homburg v. d. Höhe |                      |      Martin  
> Bartosch