Import of RSA Keypair and Certificates in PEM Format [Cisco IOS Software Releases 12.3 T]

Table Of Contents

Import of RSA Key Pair and Certificates
in PEM Format

Contents

Prerequisites for Import of RSA Key Pair and Certificates
in PEM Format

Restrictions for Import of RSA Key Pair and Certificates
in PEM Format

Information About Import of RSA Key Pair and Certificates
in PEM Format

Benefits

Certificate Enrollment Methods

Passphrase Protection

How to Configure and Implement Key Pairs and Certificates
in PEM Files

Generating, Importing, and Exporting RSA Key Pairs in PEM Files

What to Do Next

Generating, Importing, and Exporting RSA Key Pairs and Certificates
in PEM Files

Generating a Certificate Request in a PEM File

What to Do Next

Configuration Examples for Using Key Pairs and Certificates
in PEM Files

Generating, Exporting, Importing, and Verifying RSA Keys in PEM Files: Example

Exporting Router RSA Key Pairs and Certificates From PEM Files: Example

Importing Router RSA Key Pairs and Certificate From PEM Files: Example

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Command Reference

crypto ca export pem

crypto ca import pem

crypto key export pem

crypto key import pem

enrollment

enrollment terminal

Import of RSA Key Pair and Certificates
in PEM Format

The Import of RSA Key Pair and Certificates in PEM Format feature allows customers to issue certificate requests and receive issued certificates in privacy-enhanced mail (PEM)-formatted files, which are widely used in secure socket layer (SSL) and secure shell (SSH) applications. Also, customers can use PEM-formatted files to import or export Rivest, Shamir, and Adelman (RSA) key pairs.

Release

Modification

12.3(4)T

This feature was introduced.

Feature History for Import of RSA Key Pair and Certificates in PEM Format

Finding Support Information for Platforms and Cisco IOS Software Images

Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.

Contents

•Prerequisites for Import of RSA Key Pair and Certificates in PEM Format

•Restrictions for Import of RSA Key Pair and Certificates in PEM Format

•Information About Import of RSA Key Pair and Certificates in PEM Format

•How to Configure and Implement Key Pairs and Certificates in PEM Files

•Configuration Examples for Using Key Pairs and Certificates in PEM Files

•Additional References

•Command Reference

Prerequisites for Import of RSA Key Pair and Certificates
in PEM Format

Ensure that your router supports the public key infrastructure (PKI) subsystem, which requires the crypto subsystem. (Only K8 images support the Data Encryption Standard [DES] encryption algorithm.)

Restrictions for Import of RSA Key Pair and Certificates
in PEM Format

You cannot export and import RSA keys that were generated without an exportable flag before your system was upgraded to Cisco IOS Release 12.3(4)T or later. You have to generate new RSA keys after you upgrade the Cisco IOS software.

Information About Import of RSA Key Pair and Certificates
in PEM Format

To configure and implement RSA key pairs and certificates in PEM-formatted files, you should understand the following concepts:

•Benefits

•Certificate Enrollment Methods

•Passphrase Protection

Benefits

PEM-Formatted Files

Using PEM-formatted files to import or export RSA keys or certificates can be helpful for customers who are using SSL or SSH applications to manually generate RSA key pairs, request certificates from their certification authority (CA) server, and import the RSA keys back into their PKI applications. That is, customers using PEM-formatted files can directly use existing certificates and RSA key pairs on their Cisco IOS routers. (To see PEM file examples, refer to the section "Exporting Router RSA Key Pairs and Certificates From PEM Files: Example" later in this document.)

TFTP Enrollment Using IFS File System to Support File Transfers

Cisco IOS software has been enhanced to support the IOS File System (IFS), in addition to TFTP, for certificate enrollment. (For a complete list of supported enrollment methods, see the enrollment command.)

Certificate Enrollment Methods

Cisco IOS software supports the following methods to obtain a certificate from a CA:

•Simple Certificate Enrollment Protocol (SCEP)—A Cisco proprietary enrollment protocol that uses HTTP to communicate with the CA or registration authority (RA). SCEP is the most commonly used method for sending and receiving requests and certificates.

•PKCS #12—The router imports certificates in PKCS#12 format from an external server.

•IFS (IOS File System)—The router uses any file system that is supported by Cisco IOS software (such as TFTP, FTP, flash, and NVRAM) to send a certificate request and to receive the issued certificate. A user may want to enable IFS certificate enrollment when his or her CA does not support SCEP.

•Manual (cut-and-paste)—The router displays the certificate request on the console terminal, allowing the user to enter the issued certificate on the terminal. A user may want to manually cut-and-paste certificate requests and certificates when he or she does not have a network connection between the router and CA.

Passphrase Protection

You have to include a passphrase to encrypt the PEM private key file that has been exported, and the same passphrase has to be entered when the PEM private key file is imported, in order to decrypt it. Encrypting the PEM private key file when it is being exported, deleted, or imported protects the file from unauthorized access and use while it is on a local device.

Caution Passphrase protection protects the PEM private key file from unauthorized access and use, but it cannot protect the RSA key pair from being exported if a user has full enable access to the running router.

The passphrase can be any phrase that is at least eight characters in length; it can include spaces and punctuation, excluding the question mark (?), which has special meaning to the Cisco IOS parser.

How to Configure and Implement Key Pairs and Certificates
in PEM Files

This section contains the following procedures:

•Generating, Importing, and Exporting RSA Key Pairs in PEM Files

•Generating, Importing, and Exporting RSA Key Pairs and Certificates in PEM Files

•Generating a Certificate Request in a PEM File

Generating, Importing, and Exporting RSA Key Pairs in PEM Files

Use this task to back up and recover only RSA key pairs in PEM files.

Note It is recommended that you keep the private key in a secure location.

SUMMARY STEPS

1. enable

2. configure terminal

3. crypto key generate rsa general-purpose label key-label exportable

4. crypto key export rsa key-label pem {terminal | url url} {3des | des} passphrase

5. crypto key import rsa key-label pem [usage-keys] {terminal | url url} [exportable] passphrase

6. exit

7. show crypto key mypubkey rsa

DETAILED STEPS

Command or Action

Purpose

Step 1

enable
Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2

configure terminal
Example:

Router# configure terminal

Enters global configuration mode.

Step 3

crypto key generate rsa general-purpose label key-label exportable
Example:

Router(config)# crypto key generate rsa general-purpose label mycs exportable

Generates RSA key pairs.

Note To use PEM files, the RSA key pair must be exportable.

Step 4

crypto key export rsa key-label pem {terminal | url url} {3des | des} passphrase
Example:

Router(config)# crypto key export rsa mycs pem url nvram: 3des PASSWORD

Exports the generated RSA key pair.

Note Be sure to keep the PEM file safe. For example, you may want to store it on another backup router.

Step 5

crypto key import rsa key-label pem [usage-keys] {terminal | url url} [exportable] passphrase
Example:

Router(config)# crypto key import rsa mycs2 pem url nvram: mycs PASSWORD

Imports the generated RSA key pair.

Note If you do not want the key to be exportable from your certificate server, import it back to the certificate server after it has been exported as a nonexportable key pair. Thus, the key cannot be taken off again.

Step 6

exit

Exits global configuration.

Step 7

show crypto key mypubkey rsa
Example:

Router# show crypto key mypubkey rsa

(Optional) Displays the RSA public keys of your router.

What to Do Next

After you have imported your RSA keys, you should authenticate and enroll your router with a CA server. For information on completing these tasks, refer to the chapter "Configuring Certification Authority Interoperability" in the Cisco IOS Security Configuration Guide.

Generating, Importing, and Exporting RSA Key Pairs and Certificates
in PEM Files

Use this task to back up and recover the RSA key pairs and certificates of the router that are associated with a trustpoint.

SUMMARY STEPS

1. enable

2. configure terminal

3. crypto key generate rsa general-purpose label key-label exportable

4. crypto ca trustpoint name

5. rsakeypair label

6. exit

7. crypto ca authenticate name

8. crypto ca enroll name

9. crypto ca export trustpoint pem {terminal | url url} {3des | des} passphrase

10. crypto ca import trustpoint pem [usage-keys] {terminal | url url} [exportable] passphrase

11. exit

12. show crypto ca certificates

DETAILED STEPS
Command or Action

Purpose

Step 1

enable
Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2

configure terminal
Example:

Router# configure terminal

Enters global configuration mode.

Step 3

crypto key generate rsa general-purpose label key-label exportable
Example:

Router(config)# crypto key generate rsa general-purpose label mycs exportable

Generates RSA key pairs.

Note To use PEM files, the RSA key pair must be exportable.

Step 4

crypto ca trustpoint name
Example:

Router(config)# crypto ca trustpoint ggg

Declares the CA that your router should use and enters ca-trustpoint configuration mode.

Step 5

rsakeypair label
Example:

Router(ca-trustpoint)# rsakeypair mycs

Configures the trustpoint to use the key.

Step 6

exit

Exits ca-trustpoint configuration mode.

Step 7

crypto ca authenticate name
Example:

Router(config)# crypto ca authenticate ggg

Authenticates the trustpoint to obtain the CA certificate.

Step 8

crypto ca enroll name
Example:

Router(config)# crypto ca enroll ggg

Enrolls the trustpoint to be able to get the router certificate.
Step 9
crypto ca export trustpoint pem {terminal | url url} {3des | des} passphrase
Router(config)# crypto ca export ggg pem url tftp://10.1.1.2/johndoe/msca cisco1234
Exports a CA certificate in a PEM-formatted file.

Note Be sure to keep the PEM file safe. For example, you may want to store it on another backup router.
Step 10
crypto ca import trustpoint pem [usage-keys] {terminal | url url} [exportable] passphrase
Router(config)# crypto ca import ggg pem url tftp://10.1.1.2/johndoe/msca cisco1234
Imports a CA certificate in a PEM-formatted file.
Step 11

exit

Exist global configuration mode.

Step 12

show crypto ca certificates
Example:

Router# show crypto ca certificates

(Optional) Displays information about your certificate, the CA certificate, and any registration authority certificates.
Generating a Certificate Request in a PEM File

Use this task to generate a PEM-formatted certificate request (PKCS#10) that can be used when the CA server does not support SCEP.

Note When configuring certificate requests in PEM format, your router does not have to have the CA certificate, which is obtained via the crypto ca authenticate command.

SUMMARY STEPS

1. enable

2. configure terminal

3. crypto key generate rsa general-purpose label key-label exportable

4. crypto ca trustpoint name

5. enrollment [mode] [retry period minutes] [retry count number] url url [pem]

or

enrollment terminal [pem]

6. exit

7. crypto ca enroll name

DETAILED STEPS
Command or Action

Purpose

Step 1

enable
Example:

Router> enable

Enables privileged EXEC mode.

•Enter your password if prompted.

Step 2

configure terminal
Example:

Router# configure terminal

Enters global configuration mode.

Step 3

crypto key generate rsa general-purpose label key-label exportable
Example:

Router(config)# crypto key generate rsa general-purpose label mycs exportable

Generates RSA key pairs.

Step 4

crypto ca trustpoint name
Example:

Router(config)# crypto ca trustpoint ggg

Declares the CA that your router should use and enters ca-trustpoint configuration mode.
Step 5
enrollment [mode] [retry period minutes] [retry count number] url IFS_url [pem]
Example:

Router(ca-trustpoint) enrollment url tftp://10.1.1.2/johndoe/msca cisco1234
or
enrollment terminal [pem]
Example:

Router(ca-trustpoint)# enrollment terminal pem
Specifies CA enrollment parameters. Use the pem keyword to add PEM boundaries to the certificate request.

or

Configures the trustpoint to generate PEM-formatted certificate requests to the file system or terminal console.
Step 6

exit

Exits ca-trustpoint configuration mode.

Step 7

crypto ca enroll name
Example:

Router(config)# crypto ca enroll ggg

Generates the PEM-formatted enrollment request.
What to Do Next

Retrieve the request file from either the file system (if you specified the enrollment command) or the terminal console (if you specified the enrollment terminal command), and present the file to the CA server. After the certificate is granted, import the certificate (via the crypto ca import certificate command).

Configuration Examples for Using Key Pairs and Certificates
in PEM Files

This section contains the following configuration examples:

•Generating, Exporting, Importing, and Verifying RSA Keys in PEM Files: Example

•Exporting Router RSA Key Pairs and Certificates From PEM Files: Example

•Importing Router RSA Key Pairs and Certificate From PEM Files: Example

Generating, Exporting, Importing, and Verifying RSA Keys in PEM Files: Example

The following example shows how to generate, export, bring the key back (import), and verify the status of the RSA key pair "mycs":
! Generate the key pair 
!
Router(config)# crypto key generate rsa general-purpose label mycs exportable 
The name for the keys will be: mycs
Choose the size of the key modulus in the range of 360 to 2048 for your
General Purpose Keys. Choosing a key modulus greater than 512 may take a few minutes.
How many bits in the modulus [512]: 1024
% Generating 1024 bit RSA keys ...[OK]
!
! Archive the key pair to a remote location, and use a good password.
!
Router(config)# crypto key export rsa mycs pem url nvram: 3des PASSWORD
% Key name: mycs
Usage: General Purpose Key
Exporting public key...
Destination filename [mycs.pub]? 
Writing file to nvram:mycs.pub
Exporting private key...
Destination filename [mycs.prv]? 
Writing file to nvram:mycs.prv
!
! Import the key as a different name.
!
Router(config)# crypto key import rsa mycs2 pem url nvram:mycs PASSWORD
% Importing public key or certificate PEM file...
Source filename [mycs.pub]? 
Reading file from nvram:mycs.pub
% Importing private key PEM file...
Source filename [mycs.prv]? 
Reading file from nvram:mycs.prv% Key pair import succeeded.
!
! After the key has been imported, it is no longer exportable.
!
! Verify the status of the key.
!
Router# show crypto key mypubkey rsa
% Key pair was generated at: 18:04:56 GMT Jun 6 2003
Key name: mycs
Usage: General Purpose Key
Key is exportable.
Key Data:
  30819F30 0D06092A 864886F7 0D010101 05000381 8D003081 89028181 00E65253 
  9C30C12E 295AB73F B1DF9FAD 86F88192 7D4FA4D2 8BA7FB49 9045BAB9 373A31CB 
  A6B1B8F4 329F2E7E 8A50997E AADBCFAA 23C29E19 C45F4F05 DBB2FA51 4B7E9F79 
  A1095115 759D6BC3 5DFB5D7F BCF655BF 6317DB12 A8287795 7D8DC6A3 D31B2486 
  C9C96D2C 2F70B50D 3B4CDDAE F661041A 445AE11D 002EEF08 F2A627A0 5B020301 0001
% Key pair was generated at: 18:17:25 GMT Jun 6 2003
Key name: mycs2
Usage: General Purpose Key
Key is not exportable.
Key Data:
  30819F30 0D06092A 864886F7 0D010101 05000381 8D003081 89028181 00E65253 
  9C30C12E 295AB73F B1DF9FAD 86F88192 7D4FA4D2 8BA7FB49 9045BAB9 373A31CB 
  A6B1B8F4 329F2E7E 8A50997E AADBCFAA 23C29E19 C45F4F05 DBB2FA51 4B7E9F79 
  A1095115 759D6BC3 5DFB5D7F BCF655BF 6317DB12 A8287795 7D8DC6A3 D31B2486 
  C9C96D2C 2F70B50D 3B4CDDAE F661041A 445AE11D 002EEF08 F2A627A0 5B020301 0001
Exporting Router RSA Key Pairs and Certificates From PEM Files: Example

The following example shows how to generate and export the RSA key pair "aaa" and certificates of the router in PEM files that are associated with the trustpoint "mycs." This example also shows PEM-formatted files, which include PEM boundaries before and after the base64-encoded data, that are used by other SSL and SSH applications.
Router(config)# crypto key generate rsa general-keys label aaa exportable 
The name for the keys will be:aaa
Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose 
Keys. Choosing a key modulus greater than 512 may take a few minutes. 
!
How many bits in the modulus [512]:
% Generating 512 bit RSA keys ...[OK]
!
Router(config)# crypto ca trustpoint mycs
Router(ca-trustpoint)# enrollment url http://mycs
Router(ca-trustpoint)# rsakeypair aaa
Router(ca-trustpoint)# exit
Router(config)# crypto ca authenticate mycs
Certificate has the following attributes:
Fingerprint:C21514AC 12815946 09F635ED FBB6CF31 
% Do you accept this certificate? [yes/no]:y
Trustpoint CA certificate accepted.
! 
Router(config)# crypto ca enroll mycs
%
% Start certificate enrollment .. 
% Create a challenge password. You will need to verbally provide this password to the CA 
Administrator in order to revoke your certificate.
For security reasons your password will not be saved in the configuration.
Please make a note of it.
Password:
Re-enter password:
% The fully-qualified domain name in the certificate will be:Router
% The subject name in the certificate will be:bizarro.cisco.com
% Include the router serial number in the subject name? [yes/no]:n
% Include an IP address in the subject name? [no]:n
Request certificate from CA? [yes/no]:y
% Certificate request sent to Certificate Authority
% The certificate request fingerprint will be displayed.
% The 'show crypto ca certificate' command will also show the fingerprint.
Router(config)# Fingerprint: 8DA777BC 08477073 A5BE2403 812DD157 
00:29:11:%CRYPTO-6-CERTRET:Certificate received from Certificate Authority
Router(config)# crypto ca export aaa pem terminal 3des cisco123
% CA certificate:
-----BEGIN CERTIFICATE-----
MIICAzCCAa2gAwIBAgIBATANBgkqhkiG9w0BAQUFADBOMQswCQYDVQQGEwJVUzES
<snip>
waDeNOSI3WlDa0AWq5DkVBkxwgn0TqIJXJOCttjHnWHK1LMcMVGn
-----END CERTIFICATE-----
% Key name:aaa
    Usage:General Purpose Key
-----BEGIN RSA PRIVATE KEY-----
Proc-Type:4,ENCRYPTED
DEK-Info:DES-EDE3-CBC,ED6B210B626BC81A
Urguv0jnjwOgowWVUQ2XR5nbzzYHI2vGLunpH/IxIsJuNjRVjbAAUpGk7VnPCT87
<snip>
kLCOtxzEv7JHc72gMku9uUlrLSnFH5slzAtoC0czfU4=
-----END RSA PRIVATE KEY-----
% Certificate:
-----BEGIN CERTIFICATE-----
MIICTjCCAfigAwIBAgICIQUwDQYJKoZIhvcNAQEFBQAwTjELMAkGA1UEBhMCVVMx
<snip>
6xlBaIsuMxnHmr89KkKkYlU6
-----END CERTIFICATE-----
Importing Router RSA Key Pairs and Certificate From PEM Files: Example

The following example shows how to import the RSA key pairs and certificate to the trustpoint "ggg" from PEM files via TFTP:
Router(config)# crypto ca import ggg pem url tftp://10.1.1.2/johndoe/msca cisco1234
% Importing CA certificate...
Address or name of remote host [10.1.1.2]? 
Destination filename [johndoe/msca.ca]? 
Reading file from tftp://10.1.1.2/johndoe/msca.ca
Loading johndoe/msca.ca from 10.1.1.2 (via Ethernet0):!
[OK - 1082 bytes]
% Importing private key PEM file...
Address or name of remote host [10.1.1.2]? 
Destination filename [johndoe/msca.prv]? 
Reading file from tftp://10.1.1.2/johndoe/msca.prv
Loading johndoe/msca.prv from 10.1.1.2 (via Ethernet0):!
[OK - 573 bytes]
% Importing  certificate PEM file...
Address or name of remote host [10.1.1.2]? 
Destination filename [johndoe/msca.crt]? 
Reading file from tftp://10.1.1.2/johndoe/msca.crt
Loading johndoe/msca.crt from 10.1.1.2 (via Ethernet0):!
[OK - 1289 bytes]
% PEM files import succeeded.
Router(config)#
Additional References

The following sections provide references related to Import of RSA Key Pair and Certificates in PEM Format.

Related Documents

Related Topic

Document Title

Additional CA information and tasks

The chapter "Configuring Certification Authority Interoperability" in the Cisco IOS Security Configuration Guide

CA-related commands

Cisco IOS Security Command Reference, Release 12.3 T

Certificate server information and tasks

Cisco IOS Certificate Server, Cisco IOS Release 12.3(4)T feature module

RSA key import and export information

Exporting and Importing RSA Keys, Cisco IOS Release 12.2(15)T feature module

Standards

Standards

Title

PKCS12 #12 v1.0

Personal Information Exchange Syntax Standard,
RSA Laboratories, June 24, 1999

MIBs

MIBs

MIBs Link

None

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs

RFCs

RFCs

Title

RFC 1421

Privacy Enhancement for Internet Electronic Mail: Part I: Message Encryption and Authentication Procedures

RFC 1422

Privacy Enhancement for Internet Electronic Mail: Part II: Certificate-Based Key Management

RFC 1423

Privacy Enhancement for Internet Electronic Mail: Part III: Algorithms, Modes, and Identifiers

RFC 1424

Privacy Enhancement for Internet Electronic Mail: Part IV: Key Certification and Related Services

RFC 2989

PKCS #5: Password-Based Cryptography Specification Version 2.0

Technical Assistance

Description

Link

Technical Assistance Center (TAC) home page, containing 30,000 pages of searchable technical content, including links to products, technologies, solutions, technical tips, and tools. Registered Cisco.com users can log in from this page to access even more content.

http://www.cisco.com/public/support/tac/home.shtml

Command Reference

This section documents new and modified commands. All other commands used with this feature are documented in the Cisco IOS Release 12.3 T command reference publications.

New Commands

•crypto ca export pem

•crypto ca import pem

•crypto key export pem

•crypto key import pem

Modified Command

•enrollment

•enrollment terminal

crypto ca export pem

To export certificates and Rivest, Shamir, and Adelman (RSA) keys that are associated with a trustpoint in a privacy enhanced mail (PEM)-formatted file, use the crypto ca export pem command in global configuration mode.

crypto ca export trustpoint pem {terminal | url url} {3des | des} passphrase
Syntax Description

trustpoint

Name of the trustpoint that the associated certificate and RSA key pair will export.

The trustpoint argument must match the name that was specified via the crypto ca trustpoint command.

terminal

Certificate and RSA key pair that will be displayed in PEM format on the console terminal.

url url

URL of the file system where your router should export the certificate and RSA key pairs.

3des

Export the trustpoint using the Triple Data Encryption Standard (3DES) encryption algorithm.

des

Export the trustpoint using the DES encryption algorithm.

passphrase

Passphrase that is used to encrypt the PEM file for import.

Note The passphrase can be any phrase that is at least eight characters in length; it can include spaces and punctuation, excluding the question mark (?), which has special meaning to the Cisco IOS parser.

Defaults

No default behavior or values

Command Modes

Global configuration

Command History

Release

Modification

12.3(4)T

This command was introduced.

Usage Guidelines

The crypto ca export pem command allows you to export certificate and RSA key pairs in PEM-formatted files. The PEM files can then be imported back into the Cisco IOS router (via the crypto ca import pem command) or other public key infrastructure (PKI) applications.

Examples

The following example shows how to generate and export the RSA key pair "aaa" and certificates of the router in PEM files that are associated with the trustpoint "mycs":
Router(config)# crypto key generate rsa general-keys label aaa exportable 
The name for the keys will be:aaa
Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose 
Keys. Choosing a key modulus greater than 512 may take a few minutes. 
!
How many bits in the modulus [512]:
% Generating 512 bit RSA keys ...[OK]
!
Router(config)# crypto ca trustpoint mycs
Router(ca-trustpoint)# enrollment url http://mycs
Router(ca-trustpoint)# rsakeypair aaa
Router(ca-trustpoint)# exit
Router(config)# crypto ca authenticate mycs
Certificate has the following attributes:
Fingerprint:C21514AC 12815946 09F635ED FBB6CF31 
% Do you accept this certificate? [yes/no]:y
Trustpoint CA certificate accepted.
! 
Router(config)# crypto ca enroll mycs
%
% Start certificate enrollment .. 
% Create a challenge password. You will need to verbally provide this password to the CA 
Administrator in order to revoke your certificate.
For security reasons your password will not be saved in the configuration.
Please make a note of it.
Password:
Re-enter password:
% The fully-qualified domain name in the certificate will be:Router
% The subject name in the certificate will be:bizarro.cisco.com
% Include the router serial number in the subject name? [yes/no]:n
% Include an IP address in the subject name? [no]:n
Request certificate from CA? [yes/no]:y
% Certificate request sent to Certificate Authority
% The certificate request fingerprint will be displayed.
% The 'show crypto ca certificate' command will also show the fingerprint.
Router(config)# Fingerprint: 8DA777BC 08477073 A5BE2403 812DD157 
00:29:11:%CRYPTO-6-CERTRET:Certificate received from Certificate Authority
Router(config)# crypto ca export aaa pem terminal 3des cisco123
% CA certificate:
-----BEGIN CERTIFICATE-----
MIICAzCCAa2gAwIBAgIBATANBgkqhkiG9w0BAQUFADBOMQswCQYDVQQGEwJVUzES
<snip>
waDeNOSI3WlDa0AWq5DkVBkxwgn0TqIJXJOCttjHnWHK1LMcMVGn
-----END CERTIFICATE-----
% Key name:aaa
    Usage:General Purpose Key
-----BEGIN RSA PRIVATE KEY-----
Proc-Type:4,ENCRYPTED
DEK-Info:DES-EDE3-CBC,ED6B210B626BC81A
Urguv0jnjwOgowWVUQ2XR5nbzzYHI2vGLunpH/IxIsJuNjRVjbAAUpGk7VnPCT87
<snip>
kLCOtxzEv7JHc72gMku9uUlrLSnFH5slzAtoC0czfU4=
-----END RSA PRIVATE KEY-----
% Certificate:
-----BEGIN CERTIFICATE-----
MIICTjCCAfigAwIBAgICIQUwDQYJKoZIhvcNAQEFBQAwTjELMAkGA1UEBhMCVVMx
<snip>
6xlBaIsuMxnHmr89KkKkYlU6
-----END CERTIFICATE-----
Related Commands

Command

Description

crypto ca import pem

Imports certificates and RSA keys to a trustpoint from PEM-formatted files.

crypto ca trustpoint

Declares the CA that your router should use.

enrollment

Specifies the enrollment parameters of a CA.

crypto ca import pem

To import certificates and Rivest, Shamir, and Adelman (RSA) keys to a trustpoint from privacy enhanced mail (PEM)-formatted files, use the crypto ca import pem command in global configuration mode.

crypto ca import trustpoint pem [usage-keys] {terminal | url url} [exportable] passphrase
Syntax Description

trustpoint

Name of the trustpoint that is associated with the imported certificates and RSA key pairs.

The trustpoint argument must match the name that was specified via the crypto ca trustpoint command.

usage-keys

(Optional) Specifies that two RSA special usage key pairs will be imported (that is, one encryption pair and one signature pair), instead of one general-purpose key pair.

terminal

Certificates and RSA key pairs will be manually imported from the console terminal.

url url

URL of the file system where your router should import the certificates and RSA key pairs.

exportable

(Optional) Specifies that the imported RSA key pair can be exported again to another Cisco device such as a router.

passphrase

Passphrase that is used to encrypt the PEM file for import.

Note The passphrase can be any phrase that is at least eight characters in length; it can include spaces and punctuation, excluding the question mark (?), which has special meaning to the Cisco IOS parser.

Defaults

No default behavior or values

Command Modes

Global configuration

Command History

Release

Modification

12.3(4)T

This command was introduced.

Usage Guidelines

The crypto ca import pem command allows you import certificates and RSA key pairs in PEM-formatted files. The files can be previously exported from another router or generated from other public key infrastructure (PKI) applications.

Examples

The following example shows how to import PEM files to trustpoint "ggg" via TFTP:
Router(config)# crypto ca import ggg pem url tftp://10.1.1.2/johndoe/msca cisco1234
% Importing CA certificate...
Address or name of remote host [10.1.1.2]? 
Destination filename [johndoe/msca.ca]? 
Reading file from tftp://10.1.1.2/johndoe/msca.ca
Loading johndoe/msca.ca from 10.1.1.2 (via Ethernet0):!
[OK - 1082 bytes]
% Importing private key PEM file...
Address or name of remote host [10.1.1.2]? 
Destination filename [johndoe/msca.prv]? 
Reading file from tftp://10.1.1.2/johndoe/msca.prv
Loading johndoe/msca.prv from 10.1.1.2 (via Ethernet0):!
[OK - 573 bytes]
% Importing  certificate PEM file...
Address or name of remote host [10.1.1.2]? 
Destination filename [johndoe/msca.crt]? 
Reading file from tftp://10.1.1.2/johndoe/msca.crt
Loading johndoe/msca.crt from 10.1.1.2 (via Ethernet0):!
[OK - 1289 bytes]
% PEM files import succeeded.
Router(config)#
Related Commands

Command

Description

crypto ca export pem

Exports certificates and RSA keys that are associated with a trustpoint in a PEM-formatted file.

crypto ca trustpoint

Declares the CA that your router should use.

enrollment

Specifies the enrollment parameters of a CA.

crypto key export pem

To export Rivest, Shamir, and Adelman (RSA) keys in privacy enhanced mail (PEM)-formatted files, use the crypto key export pem command in global configuration mode.

crypto key export rsa key-label pem {terminal | url url} {3des | des} passphrase
Syntax Description

rsa key-label

Name of the RSA key pair that will be exported.

The key-label argument must match the key pair name that was specified via the crypto key generate rsa command.

terminal

RSA key pair will be displayed in PEM format on the console terminal.

url url

URL of the file system where your router should export the RSA key pair.

3des

Export the RSA key pair using the Triple Data Encryption Standard (3DES) encryption algorithm.

des

Export the RSA key pair using the DES encryption algorithm.

passphrase

Passphrase that is used to encrypt the PEM file for import.

Note The passphrase can be any phrase that is at least eight characters in length; it can include spaces and punctuation, excluding the question mark (?), which has special meaning to the Cisco IOS parser.

Defaults

No default behavior or values

Command Modes

Global configuration

Command History

Release

Modification

12.3(4)T

This command was introduced.

Usage Guidelines

The crypto key export pem command allows you to export RSA key pairs in PEM-formatted files. The PEM files can then be imported back into a Cisco IOS router or other public key infrastructure (PKI) applications.

Note Before you can export a RSA key pair in a PEM file, you must be sure the RSA key pair is exportable. To generate an exportable RSA key pair, issue the crypto key generate rsa command and specify the exportable keyword.

Examples

The following example shows how to generate, export, bring the key back (import), and verify the status of the RSA key pair "mycs":
! Generate the key pair 
!
Router(config)# crypto key generate rsa general-purpose label mycs exportable 
The name for the keys will be: mycs
Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose 
Keys. Choosing a key modulus greater than 512 may take a few minutes.
How many bits in the modulus [512]: 1024
% Generating 1024 bit RSA keys ...[OK]
!
! Archive the key pair to a remote location, and use a good password.
!
Router(config)# crypto key export rsa mycs pem url nvram: 3des PASSWORD
% Key name: mycs
Usage: General Purpose Key
Exporting public key...
Destination filename [mycs.pub]? 
Writing file to nvram:mycs.pub
Exporting private key...
Destination filename [mycs.prv]? 
Writing file to nvram:mycs.prv
!
! Import the key as a different name.
!
Router(config)# crypto key import rsa mycs2 pem url nvram:mycs PASSWORD
% Importing public key or certificate PEM file...
Source filename [mycs.pub]? 
Reading file from nvram:mycs.pub
% Importing private key PEM file...
Source filename [mycs.prv]? 
Reading file from nvram:mycs.prv% Key pair import succeeded.
!
! After the key has been imported, it is no longer exportable.
!
! Verify the status of the key.
!
Router# show crypto key mypubkey rsa
% Key pair was generated at: 18:04:56 GMT Jun 6 2003
Key name: mycs
Usage: General Purpose Key
Key is exportable.
Key Data:
  30819F30 0D06092A 864886F7 0D010101 05000381 8D003081 89028181 00E65253 
  9C30C12E 295AB73F B1DF9FAD 86F88192 7D4FA4D2 8BA7FB49 9045BAB9 373A31CB 
  A6B1B8F4 329F2E7E 8A50997E AADBCFAA 23C29E19 C45F4F05 DBB2FA51 4B7E9F79 
  A1095115 759D6BC3 5DFB5D7F BCF655BF 6317DB12 A8287795 7D8DC6A3 D31B2486 
  C9C96D2C 2F70B50D 3B4CDDAE F661041A 445AE11D 002EEF08 F2A627A0 5B020301 0001
% Key pair was generated at: 18:17:25 GMT Jun 6 2003
Key name: mycs2
Usage: General Purpose Key
Key is not exportable.
Key Data:
  30819F30 0D06092A 864886F7 0D010101 05000381 8D003081 89028181 00E65253 
  9C30C12E 295AB73F B1DF9FAD 86F88192 7D4FA4D2 8BA7FB49 9045BAB9 373A31CB 
  A6B1B8F4 329F2E7E 8A50997E AADBCFAA 23C29E19 C45F4F05 DBB2FA51 4B7E9F79 
  A1095115 759D6BC3 5DFB5D7F BCF655BF 6317DB12 A8287795 7D8DC6A3 D31B2486 
  C9C96D2C 2F70B50D 3B4CDDAE F661041A 445AE11D 002EEF08 F2A627A0 5B020301 0001
Related Commands

Command

Description

crypto key generate rsa

Generates RSA key pairs.

crypto key import pem

Imports RSA keys in PEM-formatted files.

crypto key import pem

To import Rivest, Shamir, and Adelman (RSA) keys in privacy enhanced mail (PEM)-formatted files, use the crypto key import pem command in global configuration mode.

crypto key import rsa key-label pem [usage-keys] {terminal | url url} [exportable] passphrase
Syntax Description

rsa key-label

Name of the RSA key pair that will be imported.

The key-label argument must match the key pair name that was specified via the crypto key generate rsa command.

usage-keys

(Optional) Specifies that two RSA special usage key pairs will be imported (that is, one encryption pair and one signature pair), instead of one general-purpose key pair.

terminal

Certificates and RSA key pairs will be manually imported to the console terminal.

url url

URL of the file system where your router should import certificates and RSA key pairs.

exportable

(Optional) Specifies that imported RSA key pair can be exported again to another Cisco device such as a router.

passphrase

Passphrase that is used to encrypt the PEM file for import.

Note The passphrase can be any phrase that is at least eight characters in length; it can include spaces and punctuation, excluding the question mark (?), which has special meaning to the Cisco IOS parser.

Defaults

No default behavior or values

Command Modes

Global configuration

Command History

Release

Modification

12.3(4)T

This command was introduced.

Usage Guidelines

The crypto key import pem command allows you to import RSA key pairs in PEM-formatted files. The files can be previously exported from another Cisco IOS router or generated by other public key infrastructure (PKI) applications.

Examples

The following example shows how to generate, export, bring the key back (import), and verify the status of the RSA key pair "mycs":
! Generate the key pair 
!
Router(config)# crypto key generate rsa general-purpose label mycs exportable 
The name for the keys will be: mycs
Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose 
Keys. Choosing a key modulus greater than 512 may take a few minutes.
How many bits in the modulus [512]: 1024
% Generating 1024 bit RSA keys ...[OK]
!
! Archive the key pair to a remote location, and use a good password.
!
Router(config)# crypto key export rsa mycs pem url nvram: 3des PASSWORD
% Key name: mycs
Usage: General Purpose Key
Exporting public key...
Destination filename [mycs.pub]? 
Writing file to nvram:mycs.pub
Exporting private key...
Destination filename [mycs.prv]? 
Writing file to nvram:mycs.prv
!
! Import the key as a different name.
!
Router(config)# crypto key import rsa mycs2 pem url nvram:mycs PASSWORD
% Importing public key or certificate PEM file...
Source filename [mycs.pub]? 
Reading file from nvram:mycs.pub
% Importing private key PEM file...
Source filename [mycs.prv]? 
Reading file from nvram:mycs.prv% Key pair import succeeded.
!
! After the key has been imported, it is no longer exportable.
!
! Verify the status of the key.
!
Router# show crypto key mypubkey rsa
% Key pair was generated at: 18:04:56 GMT Jun 6 2003
Key name: mycs
Usage: General Purpose Key
Key is exportable.
Key Data:
  30819F30 0D06092A 864886F7 0D010101 05000381 8D003081 89028181 00E65253 
  9C30C12E 295AB73F B1DF9FAD 86F88192 7D4FA4D2 8BA7FB49 9045BAB9 373A31CB 
  A6B1B8F4 329F2E7E 8A50997E AADBCFAA 23C29E19 C45F4F05 DBB2FA51 4B7E9F79 
  A1095115 759D6BC3 5DFB5D7F BCF655BF 6317DB12 A8287795 7D8DC6A3 D31B2486 
  C9C96D2C 2F70B50D 3B4CDDAE F661041A 445AE11D 002EEF08 F2A627A0 5B020301 0001
% Key pair was generated at: 18:17:25 GMT Jun 6 2003
Key name: mycs2
Usage: General Purpose Key
Key is not exportable.
Key Data:
  30819F30 0D06092A 864886F7 0D010101 05000381 8D003081 89028181 00E65253 
  9C30C12E 295AB73F B1DF9FAD 86F88192 7D4FA4D2 8BA7FB49 9045BAB9 373A31CB 
  A6B1B8F4 329F2E7E 8A50997E AADBCFAA 23C29E19 C45F4F05 DBB2FA51 4B7E9F79 
  A1095115 759D6BC3 5DFB5D7F BCF655BF 6317DB12 A8287795 7D8DC6A3 D31B2486 
  C9C96D2C 2F70B50D 3B4CDDAE F661041A 445AE11D 002EEF08 F2A627A0 5B020301 0001
Related Commands

Command

Description

crypto key export pem

Exports RSA keys in PEM-formatted files.

crypto key generate rsa

Generates RSA key pairs.

enrollment

To specify the enrollment parameters of a certification authority (CA), use the enrollment command in ca-trustpoint configuration mode. To remove any of the configured parameters, use the no form of this command.

enrollment [mode] [retry period minutes] [retry count number] url url [pem]
no enrollment [mode] [retry period minutes] [retry count number] url url [pem]
Syntax Description

mode

(Optional) Registration authority (RA) mode, if your CA system provides an RA. By default, RA mode is disabled.

retry period minutes

(Optional) Specifies the period in which the router will wait before sending the CA another certificate request. The default is 1 minute between retries. (Specify between 1 to 60 minutes.)

retry count number

(Optional) Specifies the number of times a router will resend a certificate request when it does not receive a response from the previous request. The default is 10 retries. (Specify from 1 to 100 retries.)

url url

URL of the file system where your router should send certificate requests. For enrollment method options, see Table 1.

pem

(Optional) Adds privacy enhanced mail (PEM) boundaries to the certificate request.

Defaults

Your router does not know the CA URL until you specify it via url url.

Command Modes

Ca-trustpoint configuration

Command History

Release

Modification

12.2(8)T

This command was introduced.

12.2(13)T

The url url option was enhanced to support TFTP enrollment.

12.3(4)T

The pem keyword was added, and the url url option was enhanced to support an additional enrollment method—the Cisco IOS File System (IFS).

Usage Guidelines

Use the mode keyword to specify the mode supported by the CA. This keyword is required if your CA system provides an RA.

Use the retry period minutes option to change the retry period from the default of 1 minute between retries. After requesting a certificate, the router waits to receive a certificate from the CA. If the router does not receive a certificate within a period of time (the retry period), the router will send another certificate request. By default, the router will send a maximum of 10 requests until it receives a valid certificate, until the CA returns an enrollment error, or until the configured number of retries (specified via the retry count number option) is exceeded.

Use the pem keyword to issue certificate requests (via the crypto ca enroll command) or receive issued certificates (via the crypto ca import certificate command) in PEM-formatted files.

Note When generating certificate requests in PEM format, your router does not have to have the CA certificate, which is obtained via the crypto ca authenticate command.

Use the url url option to specify or change the URL of the CA. Table 1 lists the available enrollment methods.

Table 1 Certificate Enrollment Methods

Enrollment Method

Description

bootflash

Enroll via bootflash: file system

cns

Enroll via Cisco Networking Services (CNS): file system

flash

Enroll via flash: file system

ftp

Enroll via FTP: file system

SCEP¹

Enroll via Simple Certificate Enrollment Protocol (SCEP) (an HTTP URL)

null

Enroll via null: file system

nvram

Enroll via NVRAM: file system

rcp

Enroll via remote copy protocol (rcp): file system

scp

Enroll via secure copy protocol (scp): file system

system

Enroll via system: file system

TFTP²

Enroll via TFTP: file system

¹If you are using SCEP for enrollment, the URL must be in the form http://CA_name, where CA_name is the host Domain Name System (DNS) name or IP address of the CA.

²If you are using TFTP for enrollment, the URL must be in the form tftp://certserver/file_specification. (The file_specification is optional. See the section "TFTP Certificate Enrollment" for additional information.)

TFTP Certificate Enrollment

TFTP enrollment is used to send the enrollment request and retrieve the certificate of the CA and the certificate of the router. If the file_specification is included in the URL, the router will append an extension onto the file specification. When the crypto ca authenticate command is entered, the router will retrieve the certificate of the CA from the specified TFTP server. As appropriate, the router will append the extension ".ca" to the filename or the fully qualified domain name (FQDN). (If the url url option does not include a file specification, the FQDN of the router will be used.)

Note The crypto ca trustpoint command deprecates the crypto ca identity and crypto ca trusted-root commands and all related subcommands (all ca-identity and trusted-root configuration mode commands). If you enter a ca-identity or trusted-root subcommand, the configuration mode and command will be written back as ca-trustpoint.

Examples

The following example shows how to declare a CA named "ka" and specify the URL of the CA as "http://kahului:80":
crypto ca trustpoint ka
 enrollment url http://kahului:80
Related Commands

Command

Description

crypto ca authenticate

Authenticates the CA (by getting the certificate of the CA).

crypto ca enroll

Obtains the certificate(s) of your router from the certification authority.

crypto ca trustpoint

Declares the CA that your router should use.

enrollment terminal

To specify manual cut-and-paste certificate enrollment, use the enrollment terminal command in ca-trustpoint configuration mode. To delete a current enrollment request, use the no form of this command.

enrollment terminal [pem]
no enrollment terminal [pem]
Syntax Description

pem

(Optional) Adds privacy enhanced mail PEM boundaries to the certificate request.

Defaults

No default behavior or values

Command Modes

Ca-trustpoint configuration

Command History

Release

Modification

12.2(13)T

This command was introduced.

12.3(4)T

The pem keyword was added.

Usage Guidelines

A user may want to manually cut-and-paste certificate requests and certificates when he or she does not have a network connection between the router and certification authority (CA). When this command is enabled, the router displays the certificate request on the console terminal, allowing the user to enter the issued certificate on the terminal.

The pem Keyword

Use the pem keyword to issue certificate requests (via the crypto ca enroll command) or receive issued certificates (via the crypto ca import certificate command) in PEM-formatted files through the console terminal. If the CA server does not support simple certificate enrollment protocol (SCEP), the certificate request can be presented to the CA server manually.

Note When generating certificate requests in PEM format, your router does not have to have the CA certificate, which is obtained via the crypto ca authenticate command.

Examples

The following example shows how to manually specify certificate enrollment via cut-and-paste. In this example, the CA trustpoint is "MS."
crypto ca trustpoint MS
 enrollment terminal
 crypto ca authenticate MS
!
crypto ca enroll MS
crypto ca import MS certificate
Related Commands

Command

Description

crypto ca authenticate

Authenticates the CA (by getting the certificate of the CA).

crypto ca enroll

Obtains the certificate(s) of your router from the certification authority.

crypto ca import

Imports a certificate manually via TFTP or cut-and-paste at the terminal.

crypto ca trustpoint

Declares the CA that your router should use.

Copyright © 2003 Cisco Systems, Inc. All rights reserved.

Cisco IOS Software Releases 12.3 T

Import of RSA Keypair and Certificates in PEM Format

Hierarchical Navigation

Downloads

Table Of Contents

Import of RSA Key Pair and Certificatesin PEM Format

Contents

Prerequisites for Import of RSA Key Pair and Certificatesin PEM Format

Restrictions for Import of RSA Key Pair and Certificatesin PEM Format

Information About Import of RSA Key Pair and Certificatesin PEM Format

Benefits

Certificate Enrollment Methods

Passphrase Protection

How to Configure and Implement Key Pairs and Certificates in PEM Files

Generating, Importing, and Exporting RSA Key Pairs in PEM Files

SUMMARY STEPS

DETAILED STEPS

What to Do Next

Generating, Importing, and Exporting RSA Key Pairs and Certificates in PEM Files

SUMMARY STEPS

DETAILED STEPS

Generating a Certificate Request in a PEM File

SUMMARY STEPS

DETAILED STEPS

What to Do Next

Configuration Examples for Using Key Pairs and Certificatesin PEM Files

Generating, Exporting, Importing, and Verifying RSA Keys in PEM Files: Example

Exporting Router RSA Key Pairs and Certificates From PEM Files: Example

Importing Router RSA Key Pairs and Certificate From PEM Files: Example

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Command Reference

crypto ca export pem

Syntax Description

Defaults

Command Modes

Command History

Usage Guidelines

Examples

Related Commands

crypto ca import pem

Syntax Description

Defaults

Command Modes

Command History

Usage Guidelines

Examples

Related Commands

crypto key export pem

Syntax Description

Defaults

Command Modes

Command History

Usage Guidelines

Examples

Related Commands

crypto key import pem

Syntax Description

Defaults

Command Modes

Command History

Usage Guidelines

Examples

Related Commands

enrollment

Syntax Description

Defaults

Command Modes

Command History

Usage Guidelines

Examples

Related Commands

enrollment terminal

Syntax Description

Defaults

Command Modes

Import of RSA Key Pair and Certificates
in PEM Format

Prerequisites for Import of RSA Key Pair and Certificates
in PEM Format

Restrictions for Import of RSA Key Pair and Certificates
in PEM Format

Information About Import of RSA Key Pair and Certificates
in PEM Format

How to Configure and Implement Key Pairs and Certificates
in PEM Files

Generating, Importing, and Exporting RSA Key Pairs and Certificates
in PEM Files

Configuration Examples for Using Key Pairs and Certificates
in PEM Files