Certification Authority offline

I need to configure an IPsec tunnel between a Cisco 851 and 871. The Certification authorithy creates the certificate and then go offline. How can i configure the routers so that i can load the certificate on them and make the enrollment withiut checking the CA? And how to use an USB token on 871? Thank you, Graziano