Remove Keys and Certificates on Fabric IPsec Gateway VM

Before you begin

You can remove subject certificates from the certificate authority (CA) trustpoint only if the subject-label is not configured on an IPsec tunnel.

Use this procedure to remove keys or certificates from the certificate store.

Enter Fabric IPsec Gateway Configuration mode:

enable

virtual-service WORD<1-128> console

Note

Type CTRL+Y to exit the console.
Remove a key:

certificate remove key <key-label>
Remove a specific certificate from the store:

certificate remove offline-cacert <filename>
Remove a Certificate Revocation List (CRL) certificate from the store:

certificate remove offline-crl <filename>
Remove signed certificates for a specific subject label:

certificate remove offline-subject-certs <subject-label>
Remove a specific identity certificate from the CA trustpoint:

certificate ca <ca-trustpoint> remove <subject-label>
Remove all certificates from the CA trustPoint:

certificate ca <ca-trustpoint> clean

The following table defines parameters for the certificate remove command.


Variable	Value
key <key-label>	Specifies the key name to remove.
offline-cacert <filename>	Specifies the certificate filename to remove.
offline-crl <filename>	Specifies the Certificate Revocation List (CRL) certificate filename to remove.
offline-subject-certs <subject-label>	Specifies the subject label for which to remove signed certificates.

The following table defines parameters for the certificate ca command.


Variable	Value
<ca-trustpoint>	Specifies the name of the certificate authority. The name can be alphanumeric and is case-sensitive. The maximum length is 45 characters.
<subject-label>	Specifies the subject identity.