Configuring PKI
This chapter describes the Public Key Infrastructure (PKI) support on the Cisco NX-OS device. PKI allows the device to obtain and use digital certificates for secure communication in the network.
This chapter includes the following sections:
•Information About PKI
•Licensing Requirements for PKI
•PKI Guidelines and Limitations
•Configuring CAs and Digital Certificates
•Verifying the PKI Configuration
•Example PKI Configurations
•Default Settings
•Additional References
•Feature History for PKI
Information About PKI
This section provides information about PKI, and includes the following topics:
•CAs and Digital Certificates
•Trust Model, Trustpoints, and Identity CAs
•RSA Key Pairs and Identity Certificates
•Multiple Trusted CA Support
•PKI Enrollment Support
•Manual Enrollment Using Cut-and-Paste
•Multiple RSA Key Pair and Identity CA Support
•Peer Certificate Verification
•CRL Support
•Import and Export Support for Certificates and Associated Key Pairs
•Import and Export Support for Certificates and Associated Key Pairs
CAs and Digital Certificates
Certificate authorities (CAs) manage certificate requests and issue certificates to participating entities such as hosts, network devices, or users. The CAs provide centralized key management for the participating entities.
Digital signatures, based on public key cryptography, digitally authenticate devices and individual users. In public key cryptography, such as the RSA encryption system, each device or user has a key pair that contains both a private key and a public key. The private key is kept secret and is known only to the owning device or user only. However, the public key is known to everybody. Anything encrypted with one of the keys can be decrypted with the other. A signature is formed when data is encrypted with a sender's private key. The receiver verifies the signature by decrypting the message with the sender's public key. This process relies on the receiver having a copy of the sender's public key and knowing with a high degree of certainty that it really does belong to the sender and not to someone pretending to be the sender.
Digital certificates link the digital signature to the sender. A digital certificate contains information to identify a user or device, such as the name, serial number, company, department, or IP address. It also contains a copy of the entity's public key. The CA that signs the certificate is a third party that the receiver explicitly trusts to validate identities and to create digital certificates.
To validate the signature of the CA, the receiver must first know the CA's public key. Typically this process is handled out of band or through an operation done at installation. For instance, most web browsers are configured with the public keys of several CAs by default.
Trust Model, Trustpoints, and Identity CAs
The PKI trust model is hierarchical with multiple configurable trusted CAs. You can configure each participating device with a list of trusted CAs so that a peer certificate obtained during the security protocol exchanges can be authenticated if it was issued by one of the locally trusted CAs. The Cisco NX-OS software locally stores the self-signed root certificate of the trusted CA (or certificate chain for a subordinate CA). The process of securely obtaining a trusted CA's root certificate (or the entire chain in the case of a subordinate CA) and storing it locally is called CA authentication.
The information about a trusted CA that you have configured is called the trustpoint and the CA itself is called a trustpoint CA. This information consists of a CA certificate (or certificate chain in case of a subordinate CA) and certificate revocation checking information.
The Cisco NX-OS device can also enroll with a trustpoint to obtain an identity certificate to associate with a key pair. This trustpoint is called an identity CA.
RSA Key Pairs and Identity Certificates
You can obtain an identity certificate by generating one or more RSA key pairs and associating each RSA key pair with a trustpoint CA where the Cisco NX-OS device intends to enroll. The Cisco NX-OS device needs only one identity per CA, which consists of one key pair and one identity certificate per CA.
The Cisco NX-OS software allows you to generate RSA key pairs with a configurable key size (or modulus). The default key size is 512. You can also configure an RSA key-pair label. The default key label is the device fully qualified domain name (FQDN).
The following list summarizes the relationship between trustpoints, RSA key pairs, and identity certificates:
•A trustpoint corresponds to a specific CA that the Cisco NX-OS device trusts for peer certificate verification for any application.
•An Cisco NX-OS device can have many trustpoints and all applications on the device can trust a peer certificate issued by any of the trustpoint CAs.
•A trustpoint is not restricted to a specific application.
•An Cisco NX-OS device enrolls with the CA that corresponds to the trustpoint to obtain an identity certificate. You can enroll your device with multiple trustpoints which means that you can obtaining a separate identity certificate from each trustpoint. The identity certificates are used by applications depending upon the purposes specified in the certificate by the issuing CA. The purpose of a certificate is stored in the certificate as a certificate extension.
•When enrolling with a trustpoint, you must specify an RSA key pair to be certified. This key pair must be generated and associated to the trustpoint before generating the enrollment request. The association between the trustpoint, key pair, and identity certificate is valid until it is explicitly removed by deleting the certificate, key pair, or trustpoint.
•The subject name in the identity certificate is the fully qualified domain name for the Cisco NX-OS device.
•You can generate one or more RSA key pairs on a device and each can be associated to one or more trustpoints. But no more than one key pair can be associated to a trustpoint, which means only one identity certificate is allowed from a CA.
•If the Cisco NX-OS device obtains multiple identity certificates (each from a distinct CA), the certificate that an application selects to use in a security protocol exchange with a peer is application specific (see the "SSH Authentication Using Digital Certificates" section on page 6-2).
•You do not need to designate one or more trustpoints for an application. Any application can use any certificate issued by any trustpoint as long as the certificate purpose satisfies the application requirements.
•You do not need more than one identity certificate from a trustpoint or more than one key pair to be associated to a trustpoint. A CA certifies a given identity (or name) only once and does not issue multiple certificates with the same name. If you need more than one identity certificate for a CA and if the CA allows multiple certificates with the same names, you must define another trustpoint for the same CA, associate another key pair to it, and have it certified.
Multiple Trusted CA Support
The Cisco NX-OS device can trust multiple CAs by configuring multiple trustpoints and associating each with a distinct CA. With multiple trusted CAs, you do not have to enroll a device with the specific CA that issued the certificate to a peer. Instead, you can configure the device with multiple trusted CAs that the peer trusts. The Cisco NX-OS device can then use a configured trusted CA to verify certificates received from a peer that were not issued by the same CA defined in the identity of the peer device.
PKI Enrollment Support
Enrollment is the process of obtaining an identity certificate for the device that is used for applications. It occurs between the device that requests the certificate and the certificate authority.
The Cisco NX-OS device performs the following steps when performing the PKI enrollment process:
1. Generates an RSA private and public key pair on the device.
2. Generates a certificate request in standard format and forward it to the CA.
Note The CA administrator may be required to manually approve the enrollment request at the CA server, when the request is received by the CA.
3. Receives the issued certificate back from the CA, signed with the CA's private key.
4. Writes the certificate into a nonvolatile storage area on the device (bootflash).
Manual Enrollment Using Cut-and-Paste
The Cisco NX-OS software supports certificate retrieval and enrollment using manual cut-and-paste. Cut-and-paste enrollment means that you must cut and paste the certificate requests and resulting certificates between the device and the CA.
You must perform the following steps when using cut and paste in the manual enrollment process:
1. Create an enrollment certificate request, which the Cisco NX-OS device displays in base64-encoded text form.
2. Cut and paste the encoded certificate request text in an e-mail or in a web form and send it to the CA.
3. Receive the issued certificate (in base64-encoded text form) from the CA in an e-mail or in a web browser download.
4. Cut and paste the issued certificate to the device using the certificate import facility.
Multiple RSA Key Pair and Identity CA Support
Multiple identity CAs enable the device to enroll with more than one trustpoint, which results in multiple identity certificates, each from a distinct CA. With this feature the Cisco NX-OS device can participate in applications with many peers using certificates issued by CAs that are acceptable to those peers.
The multiple RSA key-pair feature allows the device to maintain a distinct key pair for each CA with which it is enrolled. It can match policy requirements for each CA without conflicting with the requirements specified by the other CAs, such as the key length. The device can generate multiple RSA key pairs and associate each key pair with a distinct trustpoint. Thereafter, when enrolling with a trustpoint, the associated key pair is used to construct the certificate request.
Peer Certificate Verification
The PKI support on a Cisco NX-OS device can verify peer certificates. The Cisco NX-OS software verifies certificates received from peers during security exchanges for applications. The applications verify the validity of the peer certificates. The Cisco NX-OS software performs the following steps when verifying peer certificates:
1. Verifies that the peer certificate is issued by one of the locally trusted CAs.
2. Verifies that the peer certificate is valid (not expired) with respect to current time.
3. Verifies that the peer certificate is not yet revoked by the issuing CA.
For revocation checking, the Cisco NX-OS software supports only the certificate revocation list (CRL). A trustpoint CA can use one or both of these methods to verify that the peer certificate has not been revoked.
Certificate Revocation Checking
The Cisco NX-OS software can check that revocation status of CA certificates. The applications can use the revocation checking mechanisms in the order that you specify. The choices are CRL, none, or a combination of these methods.
This section includes the following topics:
•CRL Support
CRL Support
The CAs maintain certificate revocation lists (CRLs) to provide information about certificates revoked prior to their expiration dates. The CAs publish the CRLs in a repository and provide the download public URL in all issued certificates. A client verifying a peer's certificate can obtain the latest CRL from the issuing CA and use it to determine if the certificate has been revoked. A client can cache the CRLs of some or all of its trusted CAs locally and use them later if necessary until the CRLs expire.
The Cisco NX-OS software allows the manual configuration of predownloaded CRLs for the trustpoints, and then caches them in the device bootflash (cert-store). During the verification of a peer certificate, the Cisco NX-OS software checks the CRL from the issuing CA only if the CRL has already been cached locally and the revocation checking is configured to use the CRL. Otherwise, the Cisco NX-OS software does not perform CRL checking and considers the certificate to be not revoked unless you have configured other revocation checking methods.
Import and Export Support for Certificates and Associated Key Pairs
As part of the CA authentication and enrollment process, the subordinate CA certificate (or certificate chain) and identity certificates can be imported in standard PEM (base64) format.
The complete identity information in a trustpoint can be exported to a file in the password-protected PKCS#12 standard format. It can be later imported to the same device (for example, after a system crash) or to a replacement device. The information in a PKCS#12 file consists of the RSA key pair, the identity certificate, and the CA certificate (or chain).
Virtualization Support
Except for removing the configuration for a missing module, the configuration file operations are local to the virtual device context (VDC). You can remove the missing module configuration only from the default VDC. For more information on VDCs, see the
Cisco Nexus 7000 Series NX-OS Virtual Device Context Configuration Guide, Release 4.1.
Licensing Requirements for PKI
The following table shows the licensing requirements for this feature:
|
|
Cisco NX-OS |
PKI files require no license. Any feature not included in a license package is bundled with the Cisco NX-OS system images and is provided at no extra charge to you. For a complete explanation of the Cisco NX-OS licensing scheme, see the Cisco Nexus 7000 Series NX-OS Licensing Guide, Release 4.1. |
PKI Guidelines and Limitations
PKI has the following configuration guidelines and limitations:
•The maximum number of key-pairs you can configure on a Cisco NX-OS device is 16.
•The maximum number of trust points you can declare on a Cisco NX-OS device is 16.
•The maximum number of identify certificates you can configure on a switch is 16.
•The maximum number of certificates in a CA certificate chain is 10.
•The maximum number of trust points you can authenticate to a specific CA is 10.
•Configuration rollbacks do not support the PKI configuration.
Configuring CAs and Digital Certificates
This section describes the tasks that you must perform to allow CAs and digital certificates on your Cisco NX-OS device to interoperate. This section includes the following sections:
•Configuring the Hostname and IP Domain Name
•Generating an RSA Key Pair
•Creating a Trustpoint CA Association
•Authenticating the CA
•Configuring Certificate Revocation Checking Methods
•Generating Certificate Requests
•Installing Identity Certificates
•Ensuring Trustpoint Configurations Persist Across Reboots
•Exporting Identity Information in PKCS#12 Format
•Importing Identity Information in PKCS#12 Format
•Configuring a CRL
•Deleting Certificates from the CA Configuration
•Deleting RSA Key Pairs from Your Switch
Configuring the Hostname and IP Domain Name
You must configure the hostname and IP domain name of the device if you have not yet configured them because the Cisco NX-OS software uses the fully qualified domain name (FQDN) of the device as the subject in the identity certificate. Also, the Cisco NX-OS software uses the device FQDN as a default key label when you do not specify a label during key-pair generation. For example, a certificate named DeviceA.example.com is based on a device hostname of DeviceA and a device IP domain name of example.com.
Caution
Changing the hostname or IP domain name after generating the certificate can invalidate the certificate.
BEFORE YOU BEGIN
Ensure that you are in the correct VDC (or use the switchto vdc command).
SUMMARY STEPS
1. configure terminal
2. hostname hostname
3. ip domain-name name [use-vrf vrf-name]
4. exit
5. show hosts
6. copy running-config startup-config
DETAILED STEPS
|
|
|
Step 1 |
configure terminal
Example: switch# configure terminal switch(config)# |
Enters global configuration mode. |
Step 2 |
hostname hostname
Example: switch(config)# hostname DeviceA |
Configures the hostname of the device. |
Step 3 |
ip domain-name name [use-vrf vrf-name]
Example: DeviceA(config)# ip domain-name example.com |
Configures the IP domain name of the device. If you do not specify a VRF name, the command uses the default VRF. |
Step 4 |
exit
Example: switch(config)# exit switch# |
Exits configuration mode. |
Step 5 |
show hosts
Example: switch# show hosts |
(Optional) Displays the IP domain name. |
Step 6 |
copy running-config startup-config
Example: switch# copy running-config startup-config |
(Optional) Copies the running configuration to the startup configuration. |
Generating an RSA Key Pair
You can generate an RSA key pairs are used to sign and/or encrypt and decrypt the security payload during security protocol exchanges for applications. You must generate the RSA key pare before you can obtain a certificate for your device.
BEFORE YOU BEGIN
Ensure that you are in the correct VDC (or use the switchto vdc command).
SUMMARY STEPS
1. configure terminal
2. crypto key generate rsa [label label-string] [exportable] [modulus size]
3. exit
4. show crypto key mypubkey rsa
5. copy running-config startup-config
DETAILED STEPS
|
|
|
Step 1 |
configure terminal
Example: switch# configure terminal switch(config)# |
Enters global configuration mode. |
Step 2 |
crypto key generate rsa [label label-string] [exportable] [modulus size]
Example: switch(config)# crypto key generate rsa exportable |
Generates an RSA key pair. The maximum number of key pairs on a device is 16. The label string is alphanumeric, case sensitive, and has a maximum length of 64 characters. The default label string is the hostname and the FQDN separated by a period character (.). Valid modulus values are 512, 768, 1024, 1536, and 2048. The default modulus size is 512. Note The security policy on the Cisco NX-OS device and on the CA (where enrollment is planned) should be considered when deciding the appropriate key modulus. By default, the key pair is not exportable. Only exportable key pairs can be exported in the PKCS#12 format.
Caution
You cannot change the exportability of a key pair.
|
Step 3 |
exit
Example: switch(config)# exit switch# |
Exits configuration mode. |
Step 4 |
show crypto key mypubkey rsa
Example: switch# show crypto key mypubkey rsa |
(Optional) Displays the generated key. |
Step 5 |
copy running-config startup-config
Example: switch# copy running-config startup-config |
(Optional) Copies the running configuration to the startup configuration. |
Creating a Trustpoint CA Association
You must associate the Cisco NX-OS device with a trustpoint CA.
BEFORE YOU BEGIN
Ensure that you are in the correct VDC (or use the switchto vdc command).
Generate the RSA key pair (see the "Generating an RSA Key Pair" section).
SUMMARY STEPS
1. configure terminal
2. crypto ca trustpoint name
3. enrollment terminal
4. rsakeypair label
5. exit
6. show crypto ca trustpoints
7. copy running-config startup-config
DETAILED STEPS
|
|
|
Step 1 |
configure terminal
Example: switch# configure terminal switch(config)# |
Enters global configuration mode. |
Step 2 |
crypto ca trustpoint trustpoint-label
Example: switch(config)# crypto ca trustpoint admin-ca switch(config-trustpoint)# |
Declares a trustpoint CA that the device should trust and enters trustpoint configuration mode. The trustpoint-label argument is alphanumeric, case sensitive, and has a maximum length of 64 characters. Note The maximum number of trustpoints that you can configure on a device is 16. |
Step 3 |
enrollment terminal
Example: switch(config-trustpoint)# enrollment terminal |
Enables manual cut-and-paste certificate enrollment. The default is enabled. Note The Cisco NX-OS software supports only the manual cut-and-paste method for certificate enrollment. |
Step 4 |
rsakeypair label
Example: switch(config-trustpoint)# rsakeypair SwitchA |
Specifies the label of the RSA key pair to associate to this trustpoint for enrollment. Note You can specify only one RSA key pair per CA. |
Step 5 |
exit
Example: switch(config-trustpoint)# exit switch(config)# |
Exits trustpoint configuration mode. |
Step 6 |
show crypto ca trustpoints
Example: switch(config)# show crypto ca trustpoints |
(Optional) Displays trustpoint information. |
Step 7 |
copy running-config startup-config
Example: switch(config)# copy running-config startup-config |
(Optional) Copies the running configuration to the startup configuration. |
Authenticating the CA
The configuration process of trusting a CA is complete only when the CA is authenticated to the Cisco NX-OS device. You must authenticate your Cisco NX-OS device to the CA by obtaining the self-signed certificate of the CA in PEM format, which contains the public key of the CA. Because the certificate of the CA is self-signed (the CA signs its own certificate) the public key of the CA should be manually authenticated by contacting the CA administrator to compare the fingerprint of the CA certificate.
Note The CA that you are authenticating is not a self-signed CA when it is a subordinate CA to another CA, which itself may be a subordinate to yet another CA, and so on, finally ending in a self-signed CA. This type of CA certificate is called the CA certificate chain of the CA being authenticated. In this case, you must input the full list of the CA certificates of all the CAs in the certification chain during the CA authentication. The maximum number of certificates in a CA certificate chain is 10.
BEFORE YOU BEGIN
Ensure that you are in the correct VDC (or use the switchto vdc command).
Create an association with the CA (see the Creating a Trustpoint CA Association).
Obtain the CA certificate or CA certificate chain.
SUMMARY STEPS
1. configure terminal
2. crypto ca authenticate trustpoint-label
3. exit
4. show crypto ca trustpoints
5. copy running-config startup-config
DETAILED STEPS
|
|
|
Step 1 |
configure terminal
Example: switch# configure terminal switch(config)# |
Enters global configuration mode. |
Step 2 |
crypto ca authenticate trustpoint-label
Example: switch(config)# crypto ca authenticate admin-ca input (cut & paste) CA certificate (chain) in PEM format; end the input with a line containing only END OF INPUT : -----BEGIN CERTIFICATE----- MIIC4jCCAoygAwIBAgIQBWDSiay0GZRPSRIljK0ZejANBgkqhkiG9w0BAQUFADCB kDEgMB4GCSqGSIb3DQEJARYRYW1hbmRrZUBjaXNjby5jb20xCzAJBgNVBAYTAklO MRIwEAYDVQQIEwlLYXJuYXRha2ExEjAQBgNVBAcTCUJhbmdhbG9yZTEOMAwGA1UE ChMFQ2lzY28xEzARBgNVBAsTCm5ldHN0b3JhZ2UxEjAQBgNVBAMTCUFwYXJuYSBD QTAeFw0wNTA1MDMyMjQ2MzdaFw0wNzA1MDMyMjU1MTdaMIGQMSAwHgYJKoZIhvcN AQkBFhFhbWFuZGtlQGNpc2NvLmNvbTELMAkGA1UEBhMCSU4xEjAQBgNVBAgTCUth cm5hdGFrYTESMBAGA1UEBxMJQmFuZ2Fsb3JlMQ4wDAYDVQQKEwVDaXNjbzETMBEG A1UECxMKbmV0c3RvcmFnZTESMBAGA1UEAxMJQXBhcm5hIENBMFwwDQYJKoZIhvcN AQEBBQADSwAwSAJBAMW/7b3+DXJPANBsIHHzluNccNM87ypyzwuoSNZXOMpeRXXI OzyBAgiXT2ASFuUOwQ1iDM8rO/41jf8RxvYKvysCAwEAAaOBvzCBvDALBgNVHQ8E BAMCAcYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUJyjyRoMbrCNMRU2OyRhQ GgsWbHEwawYDVR0fBGQwYjAuoCygKoYoaHR0cDovL3NzZS0wOC9DZXJ0RW5yb2xs L0FwYXJuYSUyMENBLmNybDAwoC6gLIYqZmlsZTovL1xcc3NlLTA4XENlcnRFbnJv bGxcQXBhcm5hJTIwQ0EuY3JsMBAGCSsGAQQBgjcVAQQDAgEAMA0GCSqGSIb3DQEB BQUAA0EAHv6UQ+8nE399Tww+KaGr0g0NIJaqNgLh0AFcT0rEyuyt/WYGPzksF9Ea NBG7E0oN66zex0EOEfG1Vs6mXp1//w== -----END CERTIFICATE----- END OF INPUT Fingerprint(s): MD5 Fingerprint=65:84:9A:27:D5:71:03:33:9C:12:23:92:38:6F:78:12
Do you accept this certificate? [yes/no]: yes |
Prompts you to cut and paste the certificate of the CA. Use the same name that you used when declaring the CA. The maximum number of trustpoints that you can authenticate to a specific CA is 10. Note For subordinate CA authentication, the Cisco NX-OS software requires the full chain of CA certificates ending in a self-signed CA because the CA chain is needed for certificate verification as well as for PKCS#12 format export. |
Step 3 |
exit
Example: switch(config)# exit switch# |
Exits configuration mode. |
Step 4 |
show crypto ca trustpoints
Example: switch# show crypto ca trustpoints |
(Optional) Displays the trustpoint CA information. |
Step 5 |
copy running-config startup-config
Example: switch# copy running-config startup-config |
(Optional) Copies the running configuration to the startup configuration. |
Configuring Certificate Revocation Checking Methods
During security exchanges with a client, the Cisco NX-OS device performs the certificate verification of the peer certificate sent by the client. The verification process may involve certificate revocation status checking.
The Cisco NX-OS software provides the CRL method. You can configure the device to check the CRL downloaded from the CA. Downloading the CRL and checking locally does not generate traffic in your network. However, certificates can be revoked between downloads and your device would not be aware of the revocation.
BEFORE YOU BEGIN
Authenticate the CA (see the "Authenticating the CA" section).
Ensure that you have configured the CRL if you want to use CRL checking (see the "Configuring a CRL" section).
SUMMARY STEPS
1. configure terminal
2. crypto ca trustpoint trustpoint-label
3. revocation-check {crl [none] | none}
4. exit
5. show crypto ca trustpoints
6. copy running-config startup-config
DETAILED STEPS
|
|
|
Step 1 |
configure terminal
Example: switch# configure terminal switch(config)# |
Enters global configuration mode. |
Step 2 |
crypto ca trustpoint trustpoint-label
Example: switch(config)# crypto ca trustpoint admin-ca switch(config-trustpoint)# |
Specifies a trustpoint CA and enters trustpoint configuration mode. |
Step 3 |
revocation-check {crl [none] | none}
Example: switch(config-trustpoint)# revocation-check oscp none |
Configures the certificate revocation checking methods. The default method is crl. The Cisco NX-OS software uses the certificate revocation methods in the order that you specify. |
Step 4 |
exit
Example: switch(config-trustpoint)# exit switch(config)# |
Exits trustpoint configuration mode. |
Step 5 |
show crypto ca trustpoints
Example: switch(config)# show crypto ca trustpoints |
(Optional) Displays the trustpoint CA information. |
Step 6 |
copy running-config startup-config
Example: switch(config)# copy running-config startup-config |
(Optional) Copies the running configuration to the startup configuration. |
Generating Certificate Requests
You must generate a request to obtain identity certificates from the associated trustpoint CA for each of your device's RSA key pairs. You must then cut and paste the displayed request into an e-mail or in a website form for the CA.
BEFORE YOU BEGIN
Ensure that you are in the correct VDC (or use the switchto vdc command).
Create an association with the CA (see the "Creating a Trustpoint CA Association" section).
Obtain the CA certificate or CA certificate chain.
SUMMARY STEPS
1. configure terminal
2. crypto ca enroll trustpoint-label
3. exit
4. show crypto ca certificates
5. copy running-config startup-config
DETAILED STEPS
|
|
|
Step 1 |
configure terminal
Example: switch# configure terminal switch(config)# |
Enters global configuration mode. |
Step 2 |
crypto ca enroll trustpoint-label
Example: switch(config)# crypto ca enroll admin-ca Create the certificate request .. Create a challenge password. You will need to verbally provide this password to the CA Administrator in order to revoke your certificate. For security reasons your password will not be saved in the configuration. Please make a note of it. Password:nbv123 The subject name in the certificate will be: DeviceA.cisco.com Include the switch serial number in the subject name? [yes/no]: no Include an IP address in the subject name [yes/no]: yes ip address:172.22.31.162 The certificate request will be displayed... -----BEGIN CERTIFICATE REQUEST----- MIIBqzCCARQCAQAwHDEaMBgGA1UEAxMRVmVnYXMtMS5jaXNjby5jb20wgZ8wDQYJ KoZIhvcNAQEBBQADgY0AMIGJAoGBAL8Y1UAJ2NC7jUJ1DVaSMqNIgJ2kt8rl4lKY 0JC6ManNy4qxk8VeMXZSiLJ4JgTzKWdxbLDkTTysnjuCXGvjb+wj0hEhv/y51T9y P2NJJ8ornqShrvFZgC7ysN/PyMwKcgzhbVpj+rargZvHtGJ91XTq4WoVkSCzXv8S VqyH0vEvAgMBAAGgTzAVBgkqhkiG9w0BCQcxCBMGbmJ2MTIzMDYGCSqGSIb3DQEJ DjEpMCcwJQYDVR0RAQH/BBswGYIRVmVnYXMtMS5jaXNjby5jb22HBKwWH6IwDQYJ KoZIhvcNAQEEBQADgYEAkT60KER6Qo8nj0sDXZVHSfJZh6K6JtDz3Gkd99GlFWgt PftrNcWUE/pw6HayfQl2T3ecgNwel2d15133YBF2bktExiI6Ul88nTOjglXMjja8 8a23bNDpNsM8rklwA6hWkrVL8NUZEFJxqbjfngPNTZacJCUS6ZqKCMetbKytUx0= -----END CERTIFICATE REQUEST-----
|
Generates a certificate request for an authenticated CA. Note You must remember the challenge password. It is not saved with the configuration. You must enter this password if your certificate needs to be revoked. |
Step 3 |
exit
Example: switch(config-trustpoint)# exit switch(config)# |
Exits trustpoint configuration mode. |
Step 4 |
show crypto ca certificates
Example: switch(config)# show crypto ca certificates |
(Optional) Displays the CA certificates. |
Step 5 |
copy running-config startup-config
Example: switch(config)# copy running-config startup-config |
(Optional) Copies the running configuration to the startup configuration. |
Installing Identity Certificates
You can receive the identity certificate from the CA by e-mail or through a web browser in base64 encoded text form. You must install the identity certificate from the CA by cutting and pasting the encoded text.
BEFORE YOU BEGIN
Ensure that you are in the correct VDC (or use the switchto vdc command).
Create an association with the CA (see the "Creating a Trustpoint CA Association" section).
Obtain the CA certificate or CA certificate chain.
SUMMARY STEPS
1. configure terminal
2. crypto ca import trustpoint-label certificate
3. exit
4. show crypto ca certificates
5. copy running-config startup-config
DETAILED STEPS
|
|
|
Step 1 |
configure terminal
Example: switch# configure terminal switch(config)# |
Enters global configuration mode. |
Step 2 |
crypto ca import trustpoint-label certificate
Example: switch(config)# crypto ca import admin-ca certificate input (cut & paste) certificate in PEM format: -----BEGIN CERTIFICATE----- MIIEADCCA6qgAwIBAgIKCjOOoQAAAAAAdDANBgkqhkiG9w0BAQUFADCBkDEgMB4G CSqGSIb3DQEJARYRYW1hbmRrZUBjaXNjby5jb20xCzAJBgNVBAYTAklOMRIwEAYD VQQIEwlLYXJuYXRha2ExEjAQBgNVBAcTCUJhbmdhbG9yZTEOMAwGA1UEChMFQ2lz Y28xEzARBgNVBAsTCm5ldHN0b3JhZ2UxEjAQBgNVBAMTCUFwYXJuYSBDQTAeFw0w NTExMTIwMzAyNDBaFw0wNjExMTIwMzEyNDBaMBwxGjAYBgNVBAMTEVZlZ2FzLTEu Y2lzY28uY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/GNVACdjQu41C dQ1WkjKjSICdpLfK5eJSmNCQujGpzcuKsZPFXjF2UoiyeCYE8ylncWyw5E08rJ47 glxr42/sI9IRIb/8udU/cj9jSSfKK56koa7xWYAu8rDfz8jMCnIM4W1aY/q2q4Gb x7RifdV06uFqFZEgs17/Elash9LxLwIDAQABo4ICEzCCAg8wJQYDVR0RAQH/BBsw GYIRVmVnYXMtMS5jaXNjby5jb22HBKwWH6IwHQYDVR0OBBYEFKCLi+2sspWEfgrR bhWmlVyo9jngMIHMBgNVHSMEgcQwgcGAFCco8kaDG6wjTEVNjskYUBoLFmxxoYGW pIGTMIGQMSAwHgYJKoZIhvcNAQkBFhFhbWFuZGtlQGNpc2NvLmNvbTELMAkGA1UE BhMCSU4xEjAQBgNVBAgTCUthcm5hdGFrYTESMBAGA1UEBxMJQmFuZ2Fsb3JlMQ4w DAYDVQQKEwVDaXNjbzETMBEGA1UECxMKbmV0c3RvcmFnZTESMBAGA1UEAxMJQXBh cm5hIENBghAFYNKJrLQZlE9JEiWMrRl6MGsGA1UdHwRkMGIwLqAsoCqGKGh0dHA6 Ly9zc2UtMDgvQ2VydEVucm9sbC9BcGFybmElMjBDQS5jcmwwMKAuoCyGKmZpbGU6 Ly9cXHNzZS0wOFxDZXJ0RW5yb2xsXEFwYXJuYSUyMENBLmNybDCBigYIKwYBBQUH AQEEfjB8MDsGCCsGAQUFBzAChi9odHRwOi8vc3NlLTA4L0NlcnRFbnJvbGwvc3Nl LTA4X0FwYXJuYSUyMENBLmNydDA9BggrBgEFBQcwAoYxZmlsZTovL1xcc3NlLTA4 XENlcnRFbnJvbGxcc3NlLTA4X0FwYXJuYSUyMENBLmNydDANBgkqhkiG9w0BAQUF AANBADbGBGsbe7GNLh9xeOTWBNbm24U69ZSuDDcOcUZUUTgrpnTqVpPyejtsyflw E36cIZu4WsExREqxbTk8ycx7V5o= -----END CERTIFICATE----- |
Prompts you to cut and paste the identity certificate for the CA named admin-ca. The maximum number of identify certificates that you can configure on a device is 16. |
Step 3 |
exit
Example: switch(config)# exit switch# |
Exits configuration mode. |
Step 4 |
show crypto ca certificates
Example: switch# show crypto ca certificates |
(Optional) Displays the CA certificates. |
Step 5 |
copy running-config startup-config
Example: switch# copy running-config startup-config |
(Optional) Copies the running configuration to the startup configuration. |
Ensuring Trustpoint Configurations Persist Across Reboots
You can ensure that the trustpoint configuration persists across Cisco NX-OS device reboots.
The trustpoint configuration is a normal Cisco NX-OS device configuration that persists across system reboots only if you copy it explicitly to the startup configuration. The certificates, key pairs, and CRL associated with a trustpoint are automatically persistent if you have already copied the trustpoint configuration in the startup configuration. Conversely, if the trustpoint configuration is not copied to the startup configuration, the certificates, key pairs, and CRL associated with it are not persistent since they require the corresponding trustpoint configuration after a reboot. Always copy the running configuration to the startup configuration to ensure that the configured certificates, key pairs, and CRLs are persistent. Also, save the running configuration after deleting a certificate or key pair to ensure that the deletions permanent.
The certificates and CRL associated with a trustpoint automatically become persistent when imported (that is, without explicitly copying to the startup configuration) if the specific trustpoint is already saved in startup configuration.
We recommend that you create a password protected backup of the identity certificates and save it to an external server (see the "Exporting Identity Information in PKCS#12 Format" section).
Note Copying the configuration to an external server does include the certificates and key pairs.
Exporting Identity Information in PKCS#12 Format
You can export the identity certificate along with the RSA key pair and CA certificate (or the entire chain in the case of a subordinate CA) of a trustpoint to a PKCS#12 file for backup purposes. You can import the certificate and RSA key pair to recover from a system crash on your device or when you replace the supervisor modules.
Note You can use only the bootflash:filename format when specifying the export URL.
BEFORE YOU BEGIN
Ensure that you are in the correct VDC (or use the switchto vdc command).
Generate an exportable RSA key pair (see the "Generating an RSA Key Pair" section).
Authenticate the CA (see the "Authenticating the CA" section).
Install an identity certificate (see the "Installing Identity Certificates" section).
SUMMARY STEPS
1. configure terminal
2. crypto ca export trustpoint-label pkcs12 bootflash:filename
3. exit
4. copy booflash:filename scheme://server/[url/]filename
DETAILED STEPS
|
|
|
Step 1 |
configure terminal
Example: switch# configure terminal switch(config)# |
Enters global configuration mode. |
Step 2 |
crypto ca export trustpoint-label pkcs12 bootflash:filename password
Example: switch(config)# crypto ca export admin-ca pkcs12 bootflash:adminid.p12 nbv123 |
Exports the identity certificate and associated key pair and CA certificates for a trustpoint CA. The password is alphanumeric, case sensitive, and has a maximum length of 128 characters. |
Step 3 |
exit
Example: switch(config)# exit switch# |
Exits configuration mode. |
Step 4 |
copy booflash:filename scheme://server/[url/]filename
Example: switch# copy bootflash:adminid.p12 tftp:adminid.p12 |
Copies the PKCS#12 format file to a remote server. For the scheme argument, you can enter tftp:, ftp:, scp:, or sftp:. The server argument is the address or name of the remote server, and the url argument is the path to the source file on the remote server. The server, url, and filename arguments are case sensitive. |
Importing Identity Information in PKCS#12 Format
You can import the certificate and RSA key pair to recover from a system crash on your device or when you replace the supervisor modules.
Note You can use only the bootflash:filename format when specifying the import URL.
BEFORE YOU BEGIN
Ensure that you are in the correct VDC (or use the switchto vdc command).
Ensure that the trustpoint is empty by checking that no RSA key pair is associated with it and no CA is associated with the trustpoint using CA authentication.
SUMMARY STEPS
1. copy scheme://server/[url/]filename bootflash:filename
2. configure terminal
3. crypto ca import trustpoint-label pkcs12 bootflash:filename
4. exit
5. show crypto ca certificates
6. copy running-config startup-config
DETAILED STEPS
|
|
|
Step 1 |
copy scheme://server/[url/]filename bootflash:filename
Example: switch# copy tftp:adminid.p12 bootflash:adminid.p12 |
Copies the PKCS#12 format file from the remote server. For the scheme argument, you can enter tftp:, ftp:, scp:, or sftp:. The server argument is the address or name of the remote server, and the url argument is the path to the source file on the remote server. The server, url, and filename arguments are case sensitive. |
Step 2 |
configure terminal
Example: switch# configure terminal switch(config)# |
Enters global configuration mode. |
Step 3 |
crypto ca import trustpoint-label pksc12 bootflash:filename
Example: switch(config)# crypto ca import admin-ca pkcs12 bootflash:adminid.p12 nbv123 |
Imports the identity certificate and associated key pair and CA certificates for trustpoint CA. |
Step 4 |
exit
Example: switch(config)# exit switch# |
Exits configuration mode. |
Step 5 |
show crypto ca certificates
Example: switch# show crypto ca certificates |
(Optional) Displays the CA certificates. |
Step 6 |
copy running-config startup-config
Example: switch# copy running-config startup-config |
(Optional) Copies the running configuration to the startup configuration. |
Configuring a CRL
You can manually configure CRLs that you have downloaded from the trustpoints. The Cisco NX-OS software caches the CRLs in the device bootflash (cert-store). During the verification of a peer certificate, the Cisco NX-OS software checks the CRL from the issuing CA only if you have downloaded the CRL to the device and you have configured certificate revocation checking to use the CRL.
BEFORE YOU BEGIN
Ensure that you are in the correct VDC (or use the switchto vdc command).
Ensure that you have enabled certificate revocation checking (see the "Configuring Certificate Revocation Checking Methods" section).
SUMMARY STEPS
1. copy scheme://server/[url/]filename bootflash:filename
2. configure terminal
3. crypto ca crl request trustpoint-label bootflash:filename
4. exit
5. show crypto ca crl name
6. copy running-config startup-config
DETAILED STEPS
|
|
|
Step 1 |
copy scheme:[//server/[url/]]filename bootflash:filename
Example: switch# copy tftp:adminca.crl bootflash:adminca.crl |
Downloads the CRL from a remote server. For the scheme argument, you can enter tftp:, ftp:, scp:, or sftp:. The server argument is the address or name of the remote server, and the url argument is the path to the source file on the remote server. The server, url, and filename arguments are case sensitive. |
Step 2 |
configure terminal
Example: switch# configure terminal switch(config)# |
Enters global configuration mode. |
Step 3 |
crypto ca crl request trustpoint-label bootflash:filename
Example: switch(config)# crypto ca crl request admin-ca bootflash:adminca.crl |
Configures or replaces the current CRL with the one specified in the file. |
Step 4 |
exit
Example: switch(config)# exit switch# |
Exits configuration mode. |
Step 5 |
show crypto ca crl trustpoint-label
Example: switch# show crypto ca crl admin-ca |
(Optional) Displays the CA CRL information. |
Step 6 |
copy running-config startup-config
Example: switch# copy running-config startup-config |
(Optional) Copies the running configuration to the startup configuration. |
Deleting Certificates from the CA Configuration
You can delete the identity certificates and CA certificates that are configured in a trustpoint. You must first delete the identity certificate, followed by the CA certificates. After deleting the identity certificate, you can disassociate the RSA key pair from a trustpoint. You must delete certificates to remove expired or revoked certificates, certificates that have compromised (or suspected to be compromised) key pairs, or CAs that are no longer trusted.
BEFORE YOU BEGIN
Ensure that you are in the correct VDC (or use the switchto vdc command).
SUMMARY STEPS
1. configure terminal
2. crypto ca trustpoint trustpoint-label
3. delete ca certificates
4. delete certificate [force]
5. exit
6. show crypto ca certificates [trustpoint-label]
7. copy running-config startup-config
DETAILED STEPS
|
|
|
Step 1 |
configure terminal
Example: switch# configure terminal switch(config)# |
Enters global configuration mode. |
Step 2 |
crypto ca trustpoint trustpoint-label
Example: switch(config)# crypto ca trustpoint admin-ca |
Specifies a trustpoint CA and enters trustpoint configuration mode. |
Step 3 |
delete ca-certificates
Example: switch(config-trustpoint)# delete ca-certificate |
Deletes the CA certificate or certificate chain. |
Step 4 |
delete certificate [force]
Example: switch(config-trustpoint)# delete certificate |
Deletes the identity certificate. You must use the force option if the identity certificate you want to delete is the last certificate in a certificate chain or only identity certificate in the device. This requirement ensures that you do not mistakenly delete the last certificate in a certificate chain or only identity certificate and leave the applications without a certificate to use. |
Step 5 |
exit
Example: switch(config-trustpoint)# exit switch(config)# |
Exits trustpoint configuration mode. |
Step 6 |
show crypto ca certificates [trustpoint-label]
Example: switch(config)# show crypto ca certificates admin-ca |
(Optional) Displays the CA certificate information. |
Step 7 |
copy running-config startup-config
Example: switch(config)# copy running-config startup-config |
(Optional) Copies the running configuration to the startup configuration. |
Deleting RSA Key Pairs from Your Switch
You can delete the RSA key pairs on your device if you believe the RSA key pairs were compromised in some way and should no longer be used.
Note After you delete RSA key pairs from a device, ask the CA administrator to revoke your device's certificates at the CA. You must supply the challenge password that you created when you originally requested the certificates. See the "Generating Certificate Requests" section.
BEFORE YOU BEGIN
Ensure that you are in the correct VDC (or use the switchto vdc command).
SUMMARY STEPS
1. configure terminal
2. crypto key zeroize rsa label
3. exit
4. show crypto key mypubkey rsa
5. copy running-config startup-config
DETAILED STEPS
|
|
|
Step 1 |
configure terminal
Example: switch# configure terminal switch(config)# |
Enters global configuration mode. |
Step 2 |
crypto key zeroize rsa label
Example: switch(config)# crypto key zeroize rsa MyKey |
Deletes the RSA key pair. |
Step 3 |
exit
Example: switch(config)# exit switch# |
Exits configuration mode. |
Step 4 |
show crypto key mypubkey rsa
Example: switch# show crypto key mypubkey rsa |
(Optional) Displays the RSA key pair configuration. |
Step 5 |
copy running-config startup-config
Example: switch# copy running-config startup-config |
(Optional) Copies the running configuration to the startup configuration. |
Verifying the PKI Configuration
To verify the PKI configuration, use the following commands:
|
|
show crypto key mypubkey rsa |
Displays information about the RSA public keys generated on the Cisco NX-OS device. |
show crypto ca certificates |
Displays information about CA and identity certificates. |
show crypto ca crl |
Displays information about CA CRLs. |
show crypto ca trustpoints |
Displays information about CA trustpoints. |
Example PKI Configurations
This section shows an example of the tasks that you can use to configure certificates and CRLs on Cisco NX-OS devices using a Microsoft Windows Certificate server.
Note You can use any type of certificate server to generate digital certificates. You are not limited to using Microsoft Windows Certificate server.
This section includes the following topics:
•Configuring Certificates on the Cisco NX-OS Device
•Downloading a CA Certificate
•Requesting an Identity Certificate
•Revoking a Certificate
•Generating and Publishing the CRL
•Downloading the CRL
•Importing the CRL
Configuring Certificates on the Cisco NX-OS Device
To configure certificates on an Cisco NX-OS device, follow these steps:
Step 1 Configure the device FQDN.
switch# configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
switch(config)# hostname Device-1
Step 2 Configure the DNS domain name for the device.
Device-1(config)# ip domain-name cisco.com
Step 3 Create a trustpoint.
Device-1(config)# crypto ca trustpoint myCA
Device-1(config-trustpoint)# exit
Device-1(config)# do show crypto ca trustpoints
Step 4 Create an RSA key pair for the device.
Device-1(config)# crypto key generate rsa label myKey exportable modulus 1024
Device-1(config)# do show crypto key mypubkey rsa
Step 5 Associate the RSA key pair to the trustpoint.
Device-1(config)# crypto ca trustpoint myCA
Device-1(config-trustpoint)# rsakeypair myKey
Device-1(config-trustpoint)# exit
Device-1(config)# do show crypto ca trustpoints
trustpoint: myCA; key: myKey
Step 6 Download the CA certificate from the Microsoft Certificate Service web interface (see the "Downloading a CA Certificate" section).
Step 7 Authenticate the CA that you want to enroll to the trustpoint.
Device-1(config)# crypto ca authenticate myCA
input (cut & paste) CA certificate (chain) in PEM format;
end the input with a line containing only END OF INPUT :
-----BEGIN CERTIFICATE-----
MIIC4jCCAoygAwIBAgIQBWDSiay0GZRPSRIljK0ZejANBgkqhkiG9w0BAQUFADCB
kDEgMB4GCSqGSIb3DQEJARYRYW1hbmRrZUBjaXNjby5jb20xCzAJBgNVBAYTAklO
MRIwEAYDVQQIEwlLYXJuYXRha2ExEjAQBgNVBAcTCUJhbmdhbG9yZTEOMAwGA1UE
ChMFQ2lzY28xEzARBgNVBAsTCm5ldHN0b3JhZ2UxEjAQBgNVBAMTCUFwYXJuYSBD
QTAeFw0wNTA1MDMyMjQ2MzdaFw0wNzA1MDMyMjU1MTdaMIGQMSAwHgYJKoZIhvcN
AQkBFhFhbWFuZGtlQGNpc2NvLmNvbTELMAkGA1UEBhMCSU4xEjAQBgNVBAgTCUth
cm5hdGFrYTESMBAGA1UEBxMJQmFuZ2Fsb3JlMQ4wDAYDVQQKEwVDaXNjbzETMBEG
A1UECxMKbmV0c3RvcmFnZTESMBAGA1UEAxMJQXBhcm5hIENBMFwwDQYJKoZIhvcN
AQEBBQADSwAwSAJBAMW/7b3+DXJPANBsIHHzluNccNM87ypyzwuoSNZXOMpeRXXI
OzyBAgiXT2ASFuUOwQ1iDM8rO/41jf8RxvYKvysCAwEAAaOBvzCBvDALBgNVHQ8E
BAMCAcYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUJyjyRoMbrCNMRU2OyRhQ
GgsWbHEwawYDVR0fBGQwYjAuoCygKoYoaHR0cDovL3NzZS0wOC9DZXJ0RW5yb2xs
L0FwYXJuYSUyMENBLmNybDAwoC6gLIYqZmlsZTovL1xcc3NlLTA4XENlcnRFbnJv
bGxcQXBhcm5hJTIwQ0EuY3JsMBAGCSsGAQQBgjcVAQQDAgEAMA0GCSqGSIb3DQEB
BQUAA0EAHv6UQ+8nE399Tww+KaGr0g0NIJaqNgLh0AFcT0rEyuyt/WYGPzksF9Ea
NBG7E0oN66zex0EOEfG1Vs6mXp1//w==
-----END CERTIFICATE-----
Fingerprint(s): MD5 Fingerprint=65:84:9A:27:D5:71:03:33:9C:12:23:92:38:6F:78:12
Do you accept this certificate? [yes/no]:y
Device-1(config)# do show crypto ca certificates
subject= /emailAddress=admin@yourcompany.com/C=IN/ST=Karnataka/L=Bangalore/O=Yourcompany/O
U=netstorage/CN=Aparna CA
issuer= /emailAddress=admin@yourcompany.com/C=IN/ST=Karnataka/L=Bangalore/O=Yourcompany/OU
serial=0560D289ACB419944F4912258CAD197A
notBefore=May 3 22:46:37 2005 GMT
notAfter=May 3 22:55:17 2007 GMT
MD5 Fingerprint=65:84:9A:27:D5:71:03:33:9C:12:23:92:38:6F:78:12
purposes: sslserver sslclient ike
Step 8 Generate a request certificate to use to enroll with a trustpoint.
Device-1(config)# crypto ca enroll myCA
Create the certificate request ..
Create a challenge password. You will need to verbally provide this
password to the CA Administrator in order to revoke your certificate.
For security reasons your password will not be saved in the configuration.
Please make a note of it.
The subject name in the certificate will be: Device-1.cisco.com
Include the switch serial number in the subject name? [yes/no]: no
Include an IP address in the subject name [yes/no]: yes
The certificate request will be displayed...
-----BEGIN CERTIFICATE REQUEST-----
MIIBqzCCARQCAQAwHDEaMBgGA1UEAxMRVmVnYXMtMS5jaXNjby5jb20wgZ8wDQYJ
KoZIhvcNAQEBBQADgY0AMIGJAoGBAL8Y1UAJ2NC7jUJ1DVaSMqNIgJ2kt8rl4lKY
0JC6ManNy4qxk8VeMXZSiLJ4JgTzKWdxbLDkTTysnjuCXGvjb+wj0hEhv/y51T9y
P2NJJ8ornqShrvFZgC7ysN/PyMwKcgzhbVpj+rargZvHtGJ91XTq4WoVkSCzXv8S
VqyH0vEvAgMBAAGgTzAVBgkqhkiG9w0BCQcxCBMGbmJ2MTIzMDYGCSqGSIb3DQEJ
DjEpMCcwJQYDVR0RAQH/BBswGYIRVmVnYXMtMS5jaXNjby5jb22HBKwWH6IwDQYJ
KoZIhvcNAQEEBQADgYEAkT60KER6Qo8nj0sDXZVHSfJZh6K6JtDz3Gkd99GlFWgt
PftrNcWUE/pw6HayfQl2T3ecgNwel2d15133YBF2bktExiI6Ul88nTOjglXMjja8
8a23bNDpNsM8rklwA6hWkrVL8NUZEFJxqbjfngPNTZacJCUS6ZqKCMetbKytUx0=
-----END CERTIFICATE REQUEST-----
Step 9 Request an identity certificate from the Microsoft Certificate Service web interface (see the "Requesting an Identity Certificate" section).
Step 10 Import the identity certificate.
Device-1(config)# crypto ca import myCA certificate
input (cut & paste) certificate in PEM format:
-----BEGIN CERTIFICATE-----
MIIEADCCA6qgAwIBAgIKCjOOoQAAAAAAdDANBgkqhkiG9w0BAQUFADCBkDEgMB4G
CSqGSIb3DQEJARYRYW1hbmRrZUBjaXNjby5jb20xCzAJBgNVBAYTAklOMRIwEAYD
VQQIEwlLYXJuYXRha2ExEjAQBgNVBAcTCUJhbmdhbG9yZTEOMAwGA1UEChMFQ2lz
Y28xEzARBgNVBAsTCm5ldHN0b3JhZ2UxEjAQBgNVBAMTCUFwYXJuYSBDQTAeFw0w
NTExMTIwMzAyNDBaFw0wNjExMTIwMzEyNDBaMBwxGjAYBgNVBAMTEVZlZ2FzLTEu
Y2lzY28uY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC/GNVACdjQu41C
dQ1WkjKjSICdpLfK5eJSmNCQujGpzcuKsZPFXjF2UoiyeCYE8ylncWyw5E08rJ47
glxr42/sI9IRIb/8udU/cj9jSSfKK56koa7xWYAu8rDfz8jMCnIM4W1aY/q2q4Gb
x7RifdV06uFqFZEgs17/Elash9LxLwIDAQABo4ICEzCCAg8wJQYDVR0RAQH/BBsw
GYIRVmVnYXMtMS5jaXNjby5jb22HBKwWH6IwHQYDVR0OBBYEFKCLi+2sspWEfgrR
bhWmlVyo9jngMIHMBgNVHSMEgcQwgcGAFCco8kaDG6wjTEVNjskYUBoLFmxxoYGW
pIGTMIGQMSAwHgYJKoZIhvcNAQkBFhFhbWFuZGtlQGNpc2NvLmNvbTELMAkGA1UE
BhMCSU4xEjAQBgNVBAgTCUthcm5hdGFrYTESMBAGA1UEBxMJQmFuZ2Fsb3JlMQ4w
DAYDVQQKEwVDaXNjbzETMBEGA1UECxMKbmV0c3RvcmFnZTESMBAGA1UEAxMJQXBh
cm5hIENBghAFYNKJrLQZlE9JEiWMrRl6MGsGA1UdHwRkMGIwLqAsoCqGKGh0dHA6
Ly9zc2UtMDgvQ2VydEVucm9sbC9BcGFybmElMjBDQS5jcmwwMKAuoCyGKmZpbGU6
Ly9cXHNzZS0wOFxDZXJ0RW5yb2xsXEFwYXJuYSUyMENBLmNybDCBigYIKwYBBQUH
AQEEfjB8MDsGCCsGAQUFBzAChi9odHRwOi8vc3NlLTA4L0NlcnRFbnJvbGwvc3Nl
LTA4X0FwYXJuYSUyMENBLmNydDA9BggrBgEFBQcwAoYxZmlsZTovL1xcc3NlLTA4
XENlcnRFbnJvbGxcc3NlLTA4X0FwYXJuYSUyMENBLmNydDANBgkqhkiG9w0BAQUF
AANBADbGBGsbe7GNLh9xeOTWBNbm24U69ZSuDDcOcUZUUTgrpnTqVpPyejtsyflw
E36cIZu4WsExREqxbTk8ycx7V5o=
-----END CERTIFICATE-----
Step 11 Verify the certificate configuration.
Device-1# show crypto ca certificates
subject= /CN=Device-1.cisco.com
issuer= /emailAddress=admin@yourcompany.com/C=IN/ST=Karnataka/L=Bangalore/O=Cisco/OU
serial=0A338EA1000000000074
notBefore=Nov 12 03:02:40 2005 GMT
notAfter=Nov 12 03:12:40 2006 GMT
MD5 Fingerprint=3D:33:62:3D:B4:D0:87:A0:70:DE:A3:87:B3:4E:24:BF
purposes: sslserver sslclient ike
subject= /emailAddress=admin@yourcompany.com/C=IN/ST=Karnataka/L=Bangalore/O=Yourcompany/O
U=netstorage/CN=Aparna CA
issuer= /emailAddress=admin@yourcompany.com/C=IN/ST=Karnataka/L=Bangalore/O=Yourcompany/OU
serial=0560D289ACB419944F4912258CAD197A
notBefore=May 3 22:46:37 2005 GMT
notAfter=May 3 22:55:17 2007 GMT
MD5 Fingerprint=65:84:9A:27:D5:71:03:33:9C:12:23:92:38:6F:78:12
purposes: sslserver sslclient ike
Step 12 Save the certificate configuration to the startup configuration.
Device-1# copy running-config startup-config
Downloading a CA Certificate
To download a CA certificate from the Microsoft Certificate Services web interface, follow these steps:
Step 1 From the Microsoft Certificate Services web interface, click Retrieve the CA certificate or certificate revocation task and click Next.
Step 2 From the display list, choose the CA certificate file to download from the displayed list. Then click Base 64 encoded and click Download CA certificate.
Step 3 Click Open in the File Download dialog box.
Step 4 In the Certificate dialog box, click Copy to File and click OK.
Step 5 From the Certificate Export Wizard dialog box, choose the Base-64 encoded X.509 (CER) and click Next.
Step 6 In the File name: text box on the Certificate Export Wizard dialog box, enter the destination file name and click Next.
Step 7 In the Certificate Export Wizard dialog box, click Finish.
Step 8 Enter the Microsoft Windows type command to display the CA certificate stored in Base-64 (PEM) format.
Requesting an Identity Certificate
To request an identify certificate from a Microsoft Certificate server using a PKCS#12 certificate signing request (CRS), follow these steps:
Step 1 From the Microsoft Certificate Services web interface, click Request an identity certificate and click Next.
Step 2 Click Advanced Request and click Next.
Step 3 Click Submit a certificate request using a base64 encoded PKCS#10 file or a renewal request using a base64 encoded PKCS#7 file and click Next.
Step 4 In the Saved Request text box, paste the base64 PKCS#10 certificate request and click Next. The certificate request is copied from the Cisco NX-OS device console (see the "Generating Certificate Requests" section and "Configuring Certificates on the Cisco NX-OS Device" section).
Step 5 Wait one or two days until the certificate is issued by the CA administrator.
Step 6 Note that the CA administrator approves the certificate request.
Step 7 From the Microsoft Certificate Services web interface, click Check on a pending certificate and click Next.
Step 8 Choose the certificate request that you want to check and click Next.
Step 9 Click Base 64 encoded and click Download CA certificate.
Step 10 In the File Download dialog box, click Open.
Step 11 In the Certificate box, click Details tab and click Copy to File.... In the Certificate Export Dialog box, click Base-64 encoded X.509 (.CER), and click Next.
Step 12 In the File name: text box on the Certificate Export Wizard dialog box, enter the destination file name and click Next.
Step 13 Click Finish.
Step 14 Enter the Microsoft Windows type command to display the identity certificate in base64-encoded format.
Revoking a Certificate
To revoke a certificate using the Microsoft CA administrator program, follow these steps:
Step 1 From the Certification Authority tree, click Issued Certificates folder. From the list, right-click the certificate that you want to revoke.
Step 2 Choose All Tasks > Revoke Certificate.
Step 3 From the Reason code drop-down list, choose a reason for the revocation and click Yes.
Step 4 Click the Revoked Certificates folder to list and verify the certificate revocation.
Generating and Publishing the CRL
To generate and publish the CRL using the Microsoft CA administrator program, follow these steps:
Step 1 From the Certification Authority screen, choose Action > All Tasks > Publish.
Step 2 In the Certificate Revocation List dialog box, click Yes to publish the latest CRL.
Downloading the CRL
To download the CRL from the Microsoft CA website, follow these steps:.
Step 1 From the Microsoft Certificate Services web interface, click Request the CA certificate or certificate revocation list and click Next.
Step 2 Click Download latest certificate revocation list.
Step 3 In the File Download dialog box, click Save.
Step 4 In the Save As dialog box, enter the destination file name and click Save.
Step 5 Enter the Microsoft Windows type command to display the CRL.
Importing the CRL
To import the CRL to the trustpoint corresponding to the CA, follow these steps:
Step 1 Copy the CRL file to the Cisco NX-OS device bootflash.
Device-1# copy tftp:apranaCA.crl bootflash:aparnaCA.crl
Step 2 Configure the CRL.
Device-1# configure terminal
Device-1(config)# crypto ca crl request myCA bootflash:aparnaCA.crl
Step 3 Display the contents of the CRL.
Device-1(config)# show crypto ca crl myCA
Certificate Revocation List (CRL):
Signature Algorithm: sha1WithRSAEncryption
Issuer: /emailAddress=admin@yourcompany.com/C=IN/ST=Karnatak
Yourcompany/OU=netstorage/CN=Aparna CA
Last Update: Nov 12 04:36:04 2005 GMT
Next Update: Nov 19 16:56:04 2005 GMT
X509v3 Authority Key Identifier:
keyid:27:28:F2:46:83:1B:AC:23:4C:45:4D:8E:C9:18:50:1
Serial Number: 611B09A1000000000002
Revocation Date: Aug 16 21:52:19 2005 GMT
Serial Number: 4CDE464E000000000003
Revocation Date: Aug 16 21:52:29 2005 GMT
Serial Number: 4CFC2B42000000000004
Revocation Date: Aug 16 21:52:41 2005 GMT
Serial Number: 6C699EC2000000000005
Revocation Date: Aug 16 21:52:52 2005 GMT
Serial Number: 6CCF7DDC000000000006
Revocation Date: Jun 8 00:12:04 2005 GMT
Serial Number: 70CC4FFF000000000007
Revocation Date: Aug 16 21:53:15 2005 GMT
Serial Number: 4D9B1116000000000008
Revocation Date: Aug 16 21:53:15 2005 GMT
Serial Number: 52A80230000000000009
Revocation Date: Jun 27 23:47:06 2005 GMT
Serial Number: 5349AD4600000000000A
Revocation Date: Jun 27 23:47:22 2005 GMT
Serial Number: 53BD173C00000000000B
Revocation Date: Jul 4 18:04:01 2005 GMT
Serial Number: 591E7ACE00000000000C
Revocation Date: Aug 16 21:53:15 2005 GMT
Serial Number: 5D3FD52E00000000000D
Revocation Date: Jun 29 22:07:25 2005 GMT
Serial Number: 5DAB771300000000000E
Revocation Date: Jul 14 00:33:56 2005 GMT
Serial Number: 5DAE53CD00000000000F
Revocation Date: Aug 16 21:53:15 2005 GMT
Serial Number: 5DB140D3000000000010
Revocation Date: Aug 16 21:53:15 2005 GMT
Serial Number: 5E2D7C1B000000000011
Revocation Date: Jul 6 21:12:10 2005 GMT
Serial Number: 16DB4F8F000000000012
Revocation Date: Aug 16 21:53:15 2005 GMT
Serial Number: 261C3924000000000013
Revocation Date: Aug 16 21:53:15 2005 GMT
Serial Number: 262B5202000000000014
Revocation Date: Jul 14 00:33:10 2005 GMT
Serial Number: 2634C7F2000000000015
Revocation Date: Jul 14 00:32:45 2005 GMT
Serial Number: 2635B000000000000016
Revocation Date: Jul 14 00:31:51 2005 GMT
Serial Number: 26485040000000000017
Revocation Date: Jul 14 00:32:25 2005 GMT
Serial Number: 2A276357000000000018
Revocation Date: Aug 16 21:53:15 2005 GMT
Serial Number: 3F88CBF7000000000019
Revocation Date: Aug 16 21:53:15 2005 GMT
Serial Number: 6E4B5F5F00000000001A
Revocation Date: Aug 16 21:53:15 2005 GMT
Serial Number: 725B89D800000000001B
Revocation Date: Aug 16 21:53:15 2005 GMT
Serial Number: 735A887800000000001C
Revocation Date: Aug 16 21:53:15 2005 GMT
Serial Number: 148511C700000000001D
Revocation Date: Aug 16 21:53:15 2005 GMT
Serial Number: 14A7170100000000001E
Revocation Date: Aug 16 21:53:15 2005 GMT
Serial Number: 14FC45B500000000001F
Revocation Date: Aug 17 18:30:42 2005 GMT
Serial Number: 486CE80B000000000020
Revocation Date: Aug 17 18:30:43 2005 GMT
Serial Number: 4CA4A3AA000000000021
Revocation Date: Aug 17 18:30:43 2005 GMT
Serial Number: 1AA55C8E00000000002F
Revocation Date: Sep 5 17:07:06 2005 GMT
Serial Number: 3F0845DD00000000003F
Revocation Date: Sep 8 20:24:32 2005 GMT
Serial Number: 3F619B7E000000000042
Revocation Date: Sep 8 21:40:48 2005 GMT
Serial Number: 6313C463000000000052
Revocation Date: Sep 19 17:37:18 2005 GMT
Serial Number: 7C3861E3000000000060
Revocation Date: Sep 20 17:52:56 2005 GMT
Serial Number: 7C6EE351000000000061
Revocation Date: Sep 20 18:52:30 2005 GMT
Serial Number: 0A338EA1000000000074 <-- Revoked identity certificate
Revocation Date: Nov 12 04:34:42 2005 GMT
Signature Algorithm: sha1WithRSAEncryption
0b:cb:dd:43:0a:b8:62:1e:80:95:06:6f:4d:ab:0c:d8:8e:32:
44:8e:a7:94:97:af:02:b9:a6:9c:14:fd:eb:90:cf:18:c9:96:
29:bb:57:37:d9:1f:d5:bd:4e:9a:4b:18:2b:00:2f:d2:6e:c1:
1a:9f:1a:49:b7:9c:58:24:d7:72
Note The identity certificate for the device that was revoked (serial number 0A338EA1000000000074) is listed at the end.
Default Settings
Table 5-1 lists the default settings for PKI parameters.
Table 5-1 Default PKI Parameters
|
|
Trustpoint |
None |
RSA key pair |
None |
RSA key-pair label |
Device FQDN |
RSA key-pair modulus |
512 |
RSA key-pair exportable |
Enabled |
Revocation check method |
CRL |
Additional References
For additional information related to implementing RADIUS, see the following sections:
•Related Documents
•Standards
Related Documents
|
|
Cisco NX-OS Licensing |
Cisco Nexus 7000 Series NX-OS Licensing Guide, Release 4.1 |
Command reference |
Cisco Nexus 7000 Series NX-OS Security Command Reference, Release 4.1 |
VRF configuration |
Cisco Nexus 7000 Series NX-OS Unicast Routing Configuration Guide, Release 4.1 |
Standards
|
|
No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature. |
— |
Feature History for PKI
Table 5-2 lists the release history for this feature.
Table 5-2 Feature History for PKI
|
|
|
PKI |
4.1(2) |
This feature was introduced. |