Certificate authorities (CAs) are responsible for managing certificate requests and issuing certificates to participating IPSec network devices. These services provide centralized security key and certificate management for the participating devices. Specific CA servers are referred to as "trustpoints." The command "crypto pki trustpoint name" declares the trustpoint and a given name and enters ca-trustpoint configuration mode. The command "enrollment terminal" specifies manual cut-and-paste certificate enrollment method. The certificate request will be displayed on the console terminal so that you may manually copied (or cut). The command "crypto pki enroll name" generates certificate request and displays the request for copying and pasting into the certificate server. The full configuration is shown in the reference below. Reference: https://www.cisco.com/c/en/us/td/docs/ios/ios_xe/sec_secure_connectivity/configuration/guide/convert/sec_pki_xe_3s_book/sec_cert_enroll_pki_xe.html