-
Cisco IOS Security Command Reference
-
Introduction
-
aaa accounting through aaa local authentication attempts max-fail
-
aaa nas Cisco-nas-port-use-async-info through alert-severity
-
all (profile map configuration) through browser-proxy
-
ca trust-point through clear eou
-
clear ip access-list counters through crl-cache none
-
crypto aaa attribute list through crypto ipsec transform-set
-
crypto isakmp aggressive-mode disable through crypto mib ipsec flowmib history tunnel size
-
crypto pki authenticate through ctype
-
database archive through dns
-
dnsix-dmdp retries through dynamic
-
E
-
F through H
-
icmp idle-timeout through ip http ezvpn
-
ip inspect through ip security strip
-
ip source-track through issuer-name
-
K through L
-
mac access-group through max-users (WebVPN)
-
message retry count through outgoing
-
parameter through port-misuse
-
ppp accounting through quit
-
radius attribute nas-port-type through rate-limit (firewall)
-
reauthentication time through rsa-pubkey
-
sa ipsec through sessions maximum
-
set aggressive-mode client-endpoint through show class-map type urlfilter
-
show crypto ace redundancy through show crypto vlan
-
show diameter peer through show object-group
-
show parameter-map type inspect through show users
-
show vlan group through switchport port-security violation
-
tacacs-server administration through tms-class
-
traffic-export through zone security
-
Table Of Contents
crypto pki certificate query (ca-trustpoint)
crypto pki certificate storage
crypto pki server info requests
crypto pki server password generate
crypto pki server request pkcs10
crypto pki server trim generate expired-list
crypto pki token encrypted-user-pin
crypto pki token removal timeout
crypto pki token secondary config
crypto pki token secondary unconfig
crypto provisioning petitioner
crypto pki authenticate
To authenticate the certification authority (CA) (by getting the certificate of the CA), use the crypto pki authenticate command in global configuration mode.
crypto pki authenticate name
Syntax Description
name
The name of the CA. This is the same name used when the CA was declared with the crypto ca identity command.
Defaults
No default behavior or values.
Command Modes
Global configuration
Command History
Usage Guidelines
This command is required when you initially configure CA support at your router.
This command authenticates the CA to your router by obtaining the self-signed certificate of the CA that contains the public key of the CA. Because the CA signs its own certificate, you should manually authenticate the public key of the CA by contacting the CA administrator when you enter this command.
If you are using Router Advertisements (RA) mode (using the enrollment command) when you issue the crypto pki authenticate command, then registration authority signing and encryption certificates will be returned from the CA and the CA certificate.
This command is not saved to the router configuration. However. the public keys embedded in the received CA (and RA) certificates are saved to the configuration as part of the Rivest, Shamir, and Adelman (RSA) public key record (called the "RSA public key chain").
Note
If the CA does not respond by a timeout period after this command is issued, the terminal control will be returned so that it remains available. If this happens, you must reenter the command. Cisco IOS software will not recognize CA certificate expiration dates set for beyond the year 2049. If the validity period of the CA certificate is set to expire after the year 2049, the following error message will be displayed when authentication with the CA server is attempted:
error retrieving certificate :incomplete chain
If you receive an error message similar to this one, check the expiration date of your CA certificate. If the expiration date of your CA certificate is set after the year 2049, you must reduce the expiration date by a year or more.Examples
In the following example, the router requests the certificate of the CA. The CA sends its certificate and the router prompts the administrator to verify the certificate of the CA by checking the CA certificate's fingerprint. The CA administrator can also view the CA certificate's fingerprint, so you should compare what the CA administrator sees to what the router displays on the screen. If the fingerprint on the router's screen matches the fingerprint viewed by the CA administrator, you should accept the certificate as valid.
Router(config)# crypto pki authenticate mycaCertificate has the following attributes:Fingerprint: 0123 4567 89AB CDEF 0123Do you accept this certificate? [yes/no] y#Related Commands
crypto pki cert validate
To determine if a trustpoint has been successfully authenticated, a certificate has been requested and granted, and if the certificate is currently valid, use the crypto pki cert validate command in global configuration mode.
crypto pki cert validate trustpoint
Syntax Description
Defaults
No default behavior or values.
Command Modes
Global configuration
Command History
Usage Guidelines
The crypto pki cert validate command validates the router's own certificate for a given trustpoint. Use this command as a sanity check after enrollment to verify that the trustpoint is properly authenticated, a certificate has been requested and granted for the trustpoint, and that the certificate is currently valid. A certificate is valid if it is signed by the trustpoint certification authority (CA), not expired, and so on.
Examples
The following examples show the possible output from the crypto pki cert validate command:
Router(config)# crypto pki cert validate kaValidation Failed: trustpoint not found for kaRouter(config)# crypto pki cert validate kaValidation Failed: can't get local certificate chainRouter(config)# crypto pki cert validate kaCertificate chain has 2 certificates.Certificate chain for ka is validRouter(config)# crypto pki cert validate kaCertificate chain has 2 certificates.Validation Error: no certs on chainRouter(config)# crypto pki cert validate kaCertificate chain has 2 certificates.Validation Error: unspecified errorRelated Commands
crypto pki trustpoint
Declares the certification authority that the router should use.
show crypto pki trustpoints
Displays the trustpoints that are configured in the router.
crypto pki certificate chain
To enter the certificate chain configuration mode, use the crypto pki certificate chain command in global configuration mode.
crypto pki certificate chain name
Syntax Description
name
Specifies the name of the certificate authority (CA). The name must match that which was declared for the CA using the crypto pki trustpoint command.
Defaults
No default behavior or values.
Command Modes
Global configuration
Command History
Usage Guidelines
This command puts you into certificate chain configuration mode. When you are in certificate chain configuration mode, you can delete certificates using the certificate command.
You need to be in certificate chain configuration mode to delete certificates.
Examples
The following example deletes the router's certificate. In this example, the router had a general-purpose RSA key pair with one corresponding certificate. The show command is used to determine the serial number of the certificate to be deleted.
Router# show crypto pki certificatesCertificateSubject NameName: myrouter.example.comIP Address: 10.0.0.1Status: AvailableCertificate Serial Number: 0123456789ABCDEF0123456789ABCDEFKey Usage: General PurposeCA CertificateStatus: AvailableCertificate Serial Number: 3051DF7123BEE31B8341DFE4B3A338E5FKey Usage: Not SetRouter# configure terminalRouter(config)# crypto pki certificate chain mycaRouter(config-cert-chain)# no certificate 0123456789ABCDEF0123456789ABCDEF% Are you sure you want to remove the certificate [yes/no]? yes% Be sure to ask the CA administrator to revoke this certificate.Router(config-cert-chain)# exitThe following example shows a certificate chain with an active CA certificate and a shadow, or rollover, certificate:
Router# configure terminalRouter(config)# crypto pki certificate chain mycacertificate 06certificate ca 01certificate rollover 0B! This is the peer's shadow PKI certificate.certificate rollover ca 0A! This is the CA shadow PKI certificateThis example shows how the certificate chain is rewritten when rollover actually happens:
Router# configure terminalRouter(config)# crypto pki certificate chain mycacertificate 0Bcertificate ca 0ARelated Commands
crypto pki certificate map
To define certificate-based access control lists (ACLs), use the crypto pki certificate map command in ca-certificate-map configuration mode. To remove the certificate-based ACLs, use the no form of this command.
crypto pki certificate map label sequence-number
no crypto pki certificate map label sequence-number
Syntax Description
Defaults
None
Command Modes
Ca-certificate-map configuration (ca-certificate-map)
Command History
Usage Guidelines
Issuing this command places the router in ca-certificate-map configuration mode where you can specify several certificate fields together with their matching criteria. The general form of these fields is as follows:
field-name match-criteria match-value
The field-name field in the above example is one of the certificate fields. Field names are similar to the names used in the ITU-T X.509 standard. The field-name is a special field that matches any subject name or related name field in the certificate, such as the alt-subject-name, subject-name, and unstructured-subject-name fields.
•
•
•
•
•
•
•
•
Note
The match-criteria field in the example is one of the following logical operators:
•
•
•
•
•
•
The match-value field is a case-insensitive string or a date.
Examples
The following example shows how to configure a certificate-based ACL that will allow any certificate issued by Company to an entity within the company.com domain. The label is Company, and the sequence is 10.
crypto pki certificate map Company 10issuer-name co Companyunstructured-subject-name co company.comThe following example accepts any certificate issued by Company for an entity with DIAL or organizationUnit component ou=WAN. This certificate-based ACL consists of two separate ACLs tied together with the common label Group. Because the check for DIAL has a lower sequence number, it is performed first. Note that the string "DIAL" can occur anywhere in the subjectName field of the certificate, but the string WAN must be in the organizationUnit component.
crypto pki certificate map Group 10issuer-name co Companysubject-name co DIALcrypto pki certificate map Group 20issuer-name co Companysubject-name co ou=WANCase is ignored in string comparisons; therefore, DIAL in the previous example will match dial, DIAL, Dial, and so on. Also note that the component identifiers (o=, ou=, cn=, and so on) are not required unless it is desirable that the string to be matched occurs in a specific component of the name. (Refer to the ITU-T security standards for more information about certificate fields and components such as ou=.)
If a component identifier is specified in the match string, the exact string, including the component identifier, must appear in the certificate. This requirement can present a problem if more than one component identifier is included in the match string. For example, "ou=WAN,o=Company" will not match a certificate with the string "ou=WAN,ou=Engineering,o=Company" because the "ou=Engineering" string separates the two desired component identifiers.
To match both "ou=WAN" and "o=Company" in a certificate while ignoring other component identifiers, you could use this certificate map:
crypto pki certificate map Group 10subject-name co ou=WANsubject-name co o=CompanyAny space character proceeding or following the equal sign (=) character in component identifiers is ignored. Therefore "o=Company" in the proceeding example will match "o = Company," "o =Company," and so on.
The following example shows a CA map file used to certificate serial number session control:
crypto pki trustpoint CA1enrollment url http://CA1ip-address FastEthernet0/0crl query ldap://CA1_ldaprevocation-check crlmatch certificate crl-map1crypto pki certificate map crl-map1 1serial-number ne 489dRelated Commands
crypto pki certificate query (ca-trustpoint)
To specify that certificates should not be stored locally but retrieved from a certification authority (CA) trustpoint, use the crypto pki certificate query command in ca-trustpoint configuration mode. To cause certificates to be stored locally per trustpoint, use the no form of this command.
crypto pki certificate query
no crypto pki certificate query
Syntax Description
This command has no arguments or keywords.
Defaults
CA trustpoints are stored locally in the router's NVRAM.
Command Modes
Ca-trustpoint configuration
Command History
Usage Guidelines
Normally, certain certificates are stored locally in the router's NVRAM, and each certificate uses a moderate amount of memory. To save NVRAM space, you can use this command to put the router into query mode, preventing certificates from being stored locally; instead, they are retrieved from a specified CA trustpoint when needed. This will save NVRAM space but could result in a slight performance impact.
The crypto pki certificate query command is a subcommand for each trustpoint; thus, this command can be disabled on a per-trustpoint basis.
Before you can configure this command, you must enable the crypto pki trustpoint command, which puts you in ca-trustpoint configuration mode.
Note
Examples
The following example shows how to prevent certificates and certificate revocation lists (CRLs) from being stored locally on the router; instead, they are retrieved from the "ka" trustpoint when needed.
crypto pki trustpoint ka...crypto pki certificate queryRelated Commands
crypto pki certificate storage
To specify the local storage location for public key infrastructure (PKI) credentials, use the crypto pki certificate storage command in global configuration mode. To restore the default behavior, that is to store PKI credentials to NVRAM, use the no form of this command.
crypto pki certificate storage location-name
no crypto pki certificate storage
Syntax Description
Defaults
NVRAM is the default local storage location if this command is not issued.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
All Cisco platforms support NVRAM and flash local storage. Depending on your platform, you may have other supported local storage options including bootflash, slot, disk, USB flash, or USB token.
During run time, you can specify what active local storage device you would like to use to store PKI credentials. You must have the following system requirements before you can specify PKI credentials local storage location:
•
•
•
•
When using a local storage device to store PKI data, the following restrictions are applicable:
•
•
•
Examples
The following configuration example shows how to store certificates to the certs subdirectory. The certs subdirectory does not exist and is automatically created.
Router# dir nvram:114 -rw- 4687 <no date> startup-config115 ---- 5545 <no date> private-config116 -rw- 4687 <no date> underlying-config1 ---- 34 <no date> persistent-data3 -rw- 707 <no date> ioscaroot#7401CA.cer9 -rw- 863 <no date> msca-root#826E.cer10 -rw- 759 <no date> msca-root#1BA8CA.cer11 -rw- 863 <no date> msca-root#75B8.cer24 -rw- 1149 <no date> storagename#6500CA.cer26 -rw- 863 <no date> msca-root#83EE.cer129016 bytes total (92108 bytes free)Router# config terminalEnter configuration commands, one per line. End with CNTL/Z.Router(config)# crypto pki certificate storage disk0:/certsRequested directory does not exist -- createdCertificates will be stored in disk0:/certs/Router(config)# endRouter# write*May 27 02:09:00:%SYS-5-CONFIG_I:Configured from console by consolememBuilding configuration...[OK]Router# directory disk0:/certsDirectory of disk0:/certs/14 -rw- 707 May 27 2005 02:09:02 +00:00 ioscaroot#7401CA.cer15 -rw- 863 May 27 2005 02:09:02 +00:00 msca-root#826E.cer16 -rw- 759 May 27 2005 02:09:02 +00:00 msca-root#1BA8CA.cer17 -rw- 863 May 27 2005 02:09:02 +00:00 msca-root#75B8.cer18 -rw- 1149 May 27 2005 02:09:02 +00:00 storagename#6500CA.cer19 -rw- 863 May 27 2005 02:09:02 +00:00 msca-root#83EE.cer47894528 bytes total (20934656 bytes free)! The certificate files are now on disk0/certs:Related Commands
show crypto pki certificates storage
Displays the current PKI certificate storage location.
crypto pki crl cache
To set the maximum amount of volatile memory used to cache certificate revocation lists (CRLs), use the crypto pki crl cache command in privileged EXEC mode. To restore the default value, use the no form of this command.
crypto pki crl cache cache-size
no crypto pki crl cache cache-size
Syntax Description
cache-size
The maximum CRL cache size in kilobytes.
•
The value specified must be an integer. Specifying a cache size of zero disables CRL caching.
Command Default
The default CRL cache size is set to 512 kilobytes.
Command Modes
Privileged EXEC (#)
Command History
12.4(20)T
This command was introduced.
Cisco IOS XE Release 2.4
This command was implemented on the Cisco ASR 1000 series routers.
Usage Guidelines
The CRL cache is a global cache that holds all CRLs downloaded by the router regardless of the trustpoint configuration. The impact on router memory depends upon the CRL cache size configured by the administrator. Configuring the CRL cache size allows the amount of memory used for the CRL cache to be reduced (for instance, if low memory conditions exist) or to be increased for better performance (for instance, when a large number of CRLs are being processed).
If the crypto pki crl cache command is issued, regardless of the CRL cache size value set, the CRL cache size will be included in the configuration. Issuing the no crypto pki crl cache command will remove the CRL cache size from the configuration.
When a CRL is stored in the CRL cache, it is condensed at least one-fifth of its original size. Therefore, more CRLs can be stored in the CRL cache than would be expected based on the CRL size before being cached.
Note
Examples
The following example sets the maximum CRL cache size to 2048 kilobytes and then shows sample output of the show crypto pki crls command:
Router# crypto pki crl cache 2048Router# show crypto pki crlsCRL Issuer Name:cn=ioscs,l=Anytown,c=USLastUpdate: 02:53:41 GMT Mar 6 2007NextUpdate: 02:53:41 GMT Mar 13 2007Retrieved from CRL Distribution Point:** CDP Not Published - Retrieved via SCEPCRL DER is 475 bytesCRL is stored in parsed CRL cacheParsed CRL cache current size is 1705 bytesParsed CRL cache maximum size is 2048 bytesRelated Commands
crypto pki crl request
To request that a new certificate revocation list (CRL) be obtained immediately from the certification authority, use the crypto pki crl request command in global configuration mode.
crypto pki crl request name
Syntax Description
name
Specifies the name of the CA. This is the same name used when the CA was declared with the crypto pki trustpoint command.
Defaults
Normally, the router requests a new CRL when it is verifying a certificate and there is no CRL cached.
Command Modes
Global configuration
Command History
Usage Guidelines
A CRL lists all the certificates of the network device that have been revoked. Revoked certificates will not be honored by your router; therefore, any IPSec device with a revoked certificate cannot exchange IP Security traffic with your router.
The first time your router receives a certificate from a peer, it will download a CRL from the CA. Your router then checks the CRL to make sure the certificate of the peer has not been revoked. (If the certificate appears on the CRL, it will not accept the certificate and will not authenticate the peer.)
A CRL can be reused with subsequent certificates until the CRL expires. If your router receives the certificate of a peer after the applicable CRL has expired, it will download the new CRL.
If your router has a CRL which has not yet expired, but you suspect that the contents of the CRL are out of date, use the crypto pki crl request command to request that the latest CRL be immediately downloaded to replace the old CRL.
This command is not saved to the configuration.
Note
Examples
The following example immediately downloads the latest CRL to your router:
crypto pki crl requestcrypto pki enroll
To obtain the certificates for your router from the certificate authority (CA), use the crypto pki enroll command in global configuration mode. To delete a current enrollment request, use the no form of this command.
crypto pki enroll name
no crypto pki enroll name
Syntax Description
name
The name of the CA. Use the same name as when you declared the CA using the crypto pki trustpoint command.
Defaults
No default behavior or values.
Command Modes
Global configuration (config)
Command History
Usage Guidelines
This command requests certificates from the CA for all of your router's Rivest, Shamir, and Adelmen (RSA) key pairs. This task is also known as enrolling with the CA. (Technically, enrolling and obtaining certificates are two separate events, but they both occur when this command is issued.)
Your router needs a signed certificate from the CA for each RSA key pairs of your router; if you previously generated general-purpose keys, this command obtains the one certificate corresponding to the one general-purpose RSA key pair. If you previously generated special-usage keys, this command obtains two certificates corresponding to each of the special-usage RSA key pairs.
If you already have a certificate for your keys you are prompted to remove the existing certificate first. (You can remove existing certificates with the no certificate command.)
The crypto pki enroll command is not saved in the router configuration.
Note
Note
Responding to Prompts
When you issue the crypto pki enroll command, you are prompted a number of times.
You are prompted to create a challenge password. This password can be up to 80 characters in length. This password is necessary in the event that you ever need to revoke your router's certificates. When you ask the CA administrator to revoke your certificate, you must supply this challenge password as a protection against fraudulent or mistaken revocation requests.
Note
If you lose the password, the CA administrator may still be able to revoke the router's certificate but will require further manual authentication of the router administrator identity.
You are also prompted to indicate whether your router's serial number should be included in the obtained certificate. The serial number is not used by IP Security (IPsec) or Internet Key Exchange, but may be used by the CA to either authenticate certificates or to later associate a certificate with a particular router. (Note that the serial number stored is the serial number of the internal board, not the one on the enclosure.) Ask your CA administrator if serial numbers should be included. If you are in doubt, include the serial number.
Normally, you would not include the IP address because the IP address binds the certificate more tightly to a specific entity. Also, if the router is moved, you would need to issue a new certificate. A router has multiple IP addresses, any of which might be used with IPsec.
If you indicate that the IP address should be included, you will then be prompted to specify the interface of the IP address. This interface should correspond to the interface that you apply your crypto map set to. If you apply crypto map sets to more than one interface, specify the interface that you name in the crypto map local-address command.
Examples
In the following example, a router with a general-purpose RSA key pair requests a certificate from the CA. When the router displays the certificate fingerprint, the administrator verifies this number by calling the CA administrator, which checks the number. The fingerprint is correct, so the router administrator accepts the certificate.
There can be a delay between when the router administrator sends the request and when the certificate is actually received by the router. The amount of delay depends on the CA method of operation.
Router(config)# crypto pki enroll myca%% Start certificate enrollment ..% Create a challenge password. You will need to verbally provide thispassword to the CA Administrator in order to revoke your certificate.For security reasons your password will not be saved in the configuration.Please make a note of it.Password: <mypassword>Re-enter password: <mypassword>% The subject name in the certificate will be: myrouter.example.com% Include the router serial number in the subject name? [yes/no]: yes% The serial number in the certificate will be: 03433678% Include an IP address in the subject name [yes/no]? yesInterface: ethernet0/0Request certificate from CA [yes/no]? yes% Certificate request sent to Certificate Authority% The certificate request fingerprint will be displayed.% The 'show crypto pki certificates' command will also show the fingerprint.Some time later, the router receives the certificate from the CA and displays the following confirmation message:
Router(config)# Fingerprint: 01234567 89ABCDEF FEDCBA98 75543210%CRYPTO-6-CERTRET: Certificate received from Certificate AuthorityRouter(config)#If necessary, the router administrator can verify the displayed fingerprint with the CA administrator.
If there is a problem with the certificate request and the certificate is not granted, the following message is displayed on the console instead:
%CRYPTO-6-CERTREJ: Certificate enrollment request was rejected by Certificate AuthorityThe subject name in the certificate is automatically assigned to be the same as the RSA key pair's name. In the example, the RSA key pair was named "myrouter.example.com." (The router assigned this name.)
Requesting certificates for a router with special-usage keys would be the same as in the previous example, except that two certificates would have been returned by the CA. When the router received the two certificates, the router would have displayed the same confirmation message:
%CRYPTO-6-CERTRET: Certificate received from Certificate AuthorityRelated Commands
crypto pki export pem
To export certificates and Rivest, Shamir, and Adelman (RSA) keys that are associated with a trustpoint in a privacy-enhanced mail (PEM)-formatted file, use the crypto pki export pem command in global configuration mode.
crypto pki export trustpoint pem {terminal | url url} {3des | des} passphrase [rollover]
Syntax Description
Defaults
No default behavior or values
Command Modes
Global configuration
Command History
Usage Guidelines
The crypto pki export pem command allows you to export certificate and RSA key pairs in PEM-formatted files. The PEM files can then be imported back into the Cisco IOS router (via the crypto pki import pem command) or other public key infrastructure (PKI) applications.
Examples
The following example shows how to generate and export the RSA key pair "aaa" and certificates of the router in PEM files that are associated with the trustpoint "mycs":
Router(config)# crypto key generate rsa general-keys label aaa exportableThe name for the keys will be:aaaChoose the size of the key modulus in the range of 360 to 2048 for your General Purpose Keys. Choosing a key modulus greater than 512 may take a few minutes.!How many bits in the modulus [512]:% Generating 512 bit RSA keys ...[OK]!Router(config)# crypto pki trustpoint mycsRouter(ca-trustpoint)# enrollment url http://mycsRouter(ca-trustpoint)# rsakeypair aaaRouter(ca-trustpoint)# exitRouter(config)# crypto pki authenticate mycsCertificate has the following attributes:Fingerprint:C21514AC 12815946 09F635ED FBB6CF31% Do you accept this certificate? [yes/no]:yTrustpoint CA certificate accepted.!Router(config)# crypto pki enroll mycs%% Start certificate enrollment ..% Create a challenge password. You will need to verbally provide this password to the CA Administrator in order to revoke your certificate.For security reasons your password will not be saved in the configuration.Please make a note of it.Password:Re-enter password:% The fully-qualified domain name in the certificate will be:Router% The subject name in the certificate will be:bizarro.cisco.com% Include the router serial number in the subject name? [yes/no]:n% Include an IP address in the subject name? [no]:nRequest certificate from CA? [yes/no]:y% Certificate request sent to Certificate Authority% The certificate request fingerprint will be displayed.% The 'show crypto ca certificate' command will also show the fingerprint.Router(config)# Fingerprint: 8DA777BC 08477073 A5BE2403 812DD15700:29:11:%CRYPTO-6-CERTRET:Certificate received from Certificate AuthorityRouter(config)# crypto pki export aaa pem terminal 3des cisco123% CA certificate:-----BEGIN CERTIFICATE-----MIICAzCCAa2gAwIBAgIBATANBgkqhkiG9w0BAQUFADBOMQswCQYDVQQGEwJVUzES<snip>waDeNOSI3WlDa0AWq5DkVBkxwgn0TqIJXJOCttjHnWHK1LMcMVGn-----END CERTIFICATE-----% Key name:aaaUsage:General Purpose Key-----BEGIN RSA PRIVATE KEY-----Proc-Type:4,ENCRYPTEDDEK-Info:DES-EDE3-CBC,ED6B210B626BC81AUrguv0jnjwOgowWVUQ2XR5nbzzYHI2vGLunpH/IxIsJuNjRVjbAAUpGk7VnPCT87<snip>kLCOtxzEv7JHc72gMku9uUlrLSnFH5slzAtoC0czfU4=-----END RSA PRIVATE KEY-----% Certificate:-----BEGIN CERTIFICATE-----MIICTjCCAfigAwIBAgICIQUwDQYJKoZIhvcNAQEFBQAwTjELMAkGA1UEBhMCVVMx<snip>6xlBaIsuMxnHmr89KkKkYlU6-----END CERTIFICATE-----Related Commands
crypto pki export pkcs12
To export Rivest, Shamir, and Adelman (RSA) keys within a PKCS12 file at a specified location, use the crypto pki export pkcs12 command in global configuration mode.
crypto pki export trustpointname pkcs12 destination url passphrase
Syntax Description
Defaults
No default behavior or values
Command Modes
Global configuration
Command History
Usage Guidelines
The crypto pki export pkcs12 command creates a PKCS 12 file that contains an RSA key pair. The PKCS12 file, along with a certificate authority (CA), is exported to the location that you specify with the destination URL. If you decide not to import the file to another router, you must delete the file.
Security Measures
Keep the PKCS12 file stored in a secure place with restricted access.
An RSA keypair is more secure than a passphrase because the private key in the key pair is not known by multiple parties. When you export an RSA key pair to a PKCS#12 file, the RSA key pair now is only as secure as the passphrase.
To create a good passphrase, be sure to include numbers, as well as both lowercase and uppercase letters. Avoid publicizing the passphrase by mentioning it in e-mail or cell phone communications because the information could be accessed by an unauthorized user.
Examples
The following example exports an RSA key pair with a trustpoint name "mytp" to a Flash file:
Router(config)# crypto pki export mytp pkcs12 flash:myexport mycompanyRelated Commands
crypto pki import
To import a certificate manually via TFTP or as a cut-and-paste at the terminal, use the crypto pki import command in global configuration mode.
crypto pki import name certificate
Syntax Description
name certificate
Name of the certification authority (CA). This name is the same name used when the CA was declared with the crypto pki trustpoint command.
Defaults
No default behavior or values
Command Modes
Global configuration
Command History
Usage Guidelines
You must enter the crypto pki import command twice if usage keys (signature and encryption keys) are used. The first time the command is entered, one of the certificates is pasted into the router; the second time the command is entered, the other certificate is pasted into the router. (It does not matter which certificate is pasted first.)
Examples
The following example shows how to import a certificate via cut-and-paste. In this example, the CA trustpoint is "MS."
crypto pki trustpoint MSenroll terminalcrypto pki authenticate MS!crypto pki enroll MScrypto pki import MS certificateRelated Commands
crypto pki import pem
To import certificates and Rivest, Shamir, and Adelman (RSA) keys to a trustpoint from privacy-enhanced mail (PEM)-formatted files, use the crypto pki import pem command in global configuration mode.
crypto pki import trustpoint pem [usage-keys] {terminal | url url} [exportable] passphrase
Syntax Description
Defaults
No default behavior or values
Command Modes
Global configuration
Command History
Usage Guidelines
The crypto pki import pem command allows you import certificates and RSA key pairs in PEM-formatted files. The files can be previously exported from another router or generated from other public key infrastructure (PKI) applications.
Examples
The following example shows how to import PEM files to trustpoint "ggg" via TFTP:
Router(config)# crypto pki import ggg pem url tftp://10.1.1.2/johndoe/msca cisco1234% Importing CA certificate...Address or name of remote host [10.1.1.2]?Destination filename [johndoe/msca.ca]?Reading file from tftp://10.1.1.2/johndoe/msca.caLoading johndoe/msca.ca from 10.1.1.2 (via Ethernet0):![OK - 1082 bytes]% Importing private key PEM file...Address or name of remote host [10.1.1.2]?Destination filename [johndoe/msca.prv]?Reading file from tftp://10.1.1.2/johndoe/msca.prvLoading johndoe/msca.prv from 10.1.1.2 (via Ethernet0):![OK - 573 bytes]% Importing certificate PEM file...Address or name of remote host [10.1.1.2]?Destination filename [johndoe/msca.crt]?Reading file from tftp://10.1.1.2/johndoe/msca.crtLoading johndoe/msca.crt from 10.1.1.2 (via Ethernet0):![OK - 1289 bytes]% PEM files import succeeded.Router(config)#Related Commands
crypto pki import pkcs12
To import Rivest, Shamir, and Adelman (RSA) keys, use the crypto pki import pkcs12 command in global configuration mode.
crypto pki import trustpointname pkcs12 source url passphrase
Syntax Description
Defaults
No default behavior or values
Command Modes
Global configuration
Command History
Usage Guidelines
When you enter the crypto pki import pkcs12 command, a ke pair and a trustpoint are generated. If you then decide you want to remove the key pair and trustpoint that were generated, enter the crypto key zeroize rsa command to zeroize the key pair and enter the no crypto pki trustpoint command to remove the trustpoint.
Note
Examples
In the following example, an RSA key pair that has been associated with the trustpoint "forward" is to be imported:
Router(config)# crypto pki import forward pkcs12 flash:myexport mycompanyRelated Commands
crypto pki export pkcs12
Exports RSA keys.
crypto pki trustpoint
Declares the CA that your router should use.
crypto key zeroize rsa
Deletes all RSA keys from your router.
crypto pki profile enrollment
To define an enrollment profile, use the crypto pki profile enrollment command in global configuration mode. To delete all information associated with this enrollment profile, use the no form of this command.
crypto pki profile enrollment label
no crypto pki profile enrollment label
Syntax Description
label
Name for the enrollment profile; the enrollment profile name must match the name specified in the enrollment profile command.
Defaults
An enrollment profile does not exist.
Command Modes
Global configuration
Command History
Usage Guidelines
Before entering this command, you must specify a named enrollment profile using the enrollment profile in ca-trustpoint configuration mode.
After entering the crypto pki profile enrollment command, you can use any of the following commands to define the profile parameters:
•
•
•
•
•
•
•
Note
Examples
The following example shows how to define the enrollment profile named "E" and associated profile parameters:
crypto pki trustpoint Entrustenrollment profile Eserialcrypto pki profile enrollment Eauthentication url http://entrust:81authentication command GET /certs/cacert.derenrollment url http://entrust:81/cda-cgi/clientcgi.exeenrollment command POST reference_number=$P2&authcode=$P1&retrievedAs=rawDER&action=getServerCert&pkcs10Request=$REQparameter 1 value aaaa-bbbb-ccccparameter 2 value 5001Related Commands
crypto pki server
To enable a Cisco IOS certificate server and enter certificate server configuration mode or to immediately generate shadow certificatation authority (CA) credentials, use the crypto pki server command in global configuration mode. To disable a certificate server (which is the default functionality), use the no form of this command.
crypto pki server cs-label [rollover [cancel] [request pkcs10 terminal]][redundancy][show][serial-number serial-number]
no crypto pki server cs-label
Syntax Description
Defaults
A certificate server is not enabled; the automatic CA certificate rollover process is not initiated.
Command Modes
Global configuration
Command History
Usage Guidelines
A certificate server allows you to more easily deploy public key infrastructure (PKI) by defining default behavior, which limits user interface complexity. To define the functionality of the certificate server, you can use any of the following certificate server configuration mode commands:
•
•
•
•
Note
•
•
•
•
Note
Automated CA Certificate Rollover
CAs and their clients, have certificates with expiration dates that have to be reissued when the current certificate is about to expire. CAs also have key pairs used to sign client certificates. When the CA certificate is expiring it must generate a new certificate and possibly a new key pair. This process, called rollover, allows for continuous operation of the network while clients and the certificate server are switching from an expiring CA certificate to a new CA certificate.
Examples
The following example shows how to enable the certificate server "mycertserver":
Router(config)# ip http serverRouter(config)# crypto pki server mycertserverRouter(cs-server)# database url tftp://mytftp/johndoe/mycertserverThe following example shows how to disable the certificate server "mycertserver":
Router(config)# no crypto pki server mycertserver% This will stop the Certificate Server process and delete the serverconfigurationAre you sure you want to do this? [yes/no]: yes% Do you also want to remove the associated trustpoint andsigning certificate and key? [yes/no]: no% Certificate Server Process stoppedThe following example shows a shadow client certificate request from a terminal:
Router# crypto pki server mycs rollover request pkcs10 terminal% Enter Base64 encoded or PEM formatted PKCS10 enrollment request.% End with a blank line or "quit" on a line by itself.-----BEGIN CERTIFICATE REQUEST-----MIIBUTCBuwIBADASMRAwDgYDVQQDEwdOZXdSb290MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDMHeev1ERSs320zbLQQk+3lhV/R2HpYQ/iM6uT1jkJf5iy0UPRwF/X16yUNmG+ObiGiW9fsASF0nxZw+fO7d2X2yh1PakfvF2wbP27C/sgJNOw9uPfsBxEc40Xe0d5FMh0YKOSAShfZYKOflnyQR2Drmm2x/33QGol5QyRvjkeWQIDAQABoAAwDQYJKoZIhvcNAQEEBQADgYEALM90r4d79X6vxhD0qjuYJXfBCOvv4FNyFsjraBS/y6CnNVYySF8UBUohXYIGTWf4I4+sj6i8gYfoFUW1/L82djS18TLrUr6wpCOsRqfAfps7HW1e4cizOfjAUU+C7lNcobCAhwF1o6q2nIEjpQ/2yfK9O7sb3SCJZBfeeW3tyCo=-----END CERTIFICATE REQUEST-----The following example shows the redundancy, show, and serial-number keywords in the crypto pki server command.
Router(config)#crypto pki server MYCARouter(cs-server)#grant autoRouter(cs-server)#redundancyRouter(cs-server)#serial-number 0x4cRouter(cs-server)#showredundancyserial-number 0x4Cgrant autoendRelated Commands
crypto pki server info requests
Displays all outstanding certificate enrollment requests.
ip http server
Enables an HTTP server on your network.
crypto pki server grant
To grant all or certain simple certificate enrollment protocol (SCEP) requests, use the crypto pki server grant command in privileged EXEC mode.
crypto pki server cs-label grant {all | req-id}
Syntax Description
Defaults
If this command is not issued, the certificate server keeps the requests in a pending state.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
After you enable the crypto pki server grant command, your certificate server will immediately grant all specified certificate requests. Certificate requests that are not granted will expire after the time that was specified using the lifetime enrollment-request command.
Examples
The following example shows to grant all manual enrollment requests for the certificate server "mycs":
Router# crypto pki server mycs grant allRelated Commands
crypto pki server
Enables a Cisco IOS certificate server and enters certificate server configuration mode.
crypto pki server reject
Rejects all or certain SCEP requests.
crypto pki server info crl
Note
To display information regarding the status of the current certificate revocation list (CRL), use the crypto pki server info crl command in privileged EXEC mode.
crypto pki server cs-label info crl
Syntax Description
cs-label
Name of the certificate server. The name must match the name specified via the crypto pki server command.
Defaults
No default behavior or values
Command Modes
Privileged EXEC
Command History
12.3(4)T
This command was introduced.
12.4(20)T
This command was replaced by the show crypto pki server crl command.
Usage Guidelines
CRLs are issued once every specified time period via the lifetime crl command. It is the responsibility of the network administrator to ensure that the CRL is available from the location that is specified via the cdp-url command. To access information, such as the lifetime and location of the CRL, use the crypto pki server info crl command.
Examples
The following example shows how to access CRL information for the certificate server "mycs":
Router# crypto pki server mycs info crlRelated Commands
crypto pki server info requests
Note
To display all outstanding certificate enrollment requests, use the crypto pki server info requests command in privileged EXEC mode.
crypto pki server cs-label info requests
Syntax Description
cs-label
Name of the certificate server. The name must match the name specified via the crypto pki server command.
Defaults
No default behavior or values
Command Modes
Privileged EXEC
Command History
Usage Guidelines
A certificate enrollment request functions as follows:
•
–
–
•
–
–
If the connection of the client has closed, the certificate server will wait for client user to request another certificate.
All enrollment requests transitions through the certificate enrollment states that are defined in Table 35.
Examples
The following example shows output for the certificate server "certsrv1," which has a pending certificate enrollment request:
Router# crypto pki server certsrv1 info requestsEnrollment Request Database:ReqID State Fingerprint SubjectName--------------------------------------------------------------1 pending 0A71820219260E526D250ECC59857C2D serialNumber=2326115A+hostname=831.The following example shows the output for shadow PKI certificate info requests:
Router# crypto pki server mycs info requestsEnrollment Request Database:RA certificate requests:ReqID State Fingerprint SubjectName--------------------------------------------------------------RA rollover certificate requests:ReqID State Fingerprint SubjectName--------------------------------------------------------------Router certificates requests:ReqID State Fingerprint SubjectName--------------------------------------------------------------1 pending A426AF07FE3A4BB69062E0E47198E5BF hostname=clientRouter rollover certificates requests:ReqID State Fingerprint SubjectName--------------------------------------------------------------2 pending B69062E0E47198E5BFA426AF07FE3A4B hostname=clientRelated Commands
crypto pki server
Enables a Cisco IOS certificate server and enters PKI configuration mode.
crypto pki server password generate
To generate a password for simple certificate enrollment protocol (SCEP) requests that can be used only one time, use the crypto pki server password generate command in privileged EXEC mode.
crypto pki server cs-label password generate [minutes]
Syntax Description
Defaults
If this command is not enabled, no password is created.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
SCEP, which is the only supported enrollment protocol, supports two client authentication mechanisms—manual and preshared key. Manual enrollment requires the administrator at the certification authority (CA) server to specifically authorize the enrollment requests; enrollment using preshared keys allows the administrator to preauthorize enrollment requests by generating a one-time password.
Note
Examples
The following example shows how to generate a one-time password that is valid for 75 minutes for the certificate server "mycs":
Router# crypto pki server mycs password generate 75Related Commands
crypto pki server
Enables a Cisco IOS certificate server and enters certificate server configuration mode.
crypto pki server reject
To reject all or certain Simple Certificate Enrollment Protocol (SCEP) requests, use the crypto pki server reject command in privileged EXEC mode.
crypto pki server cs-label reject {all | req-id}
Syntax Description
Defaults
If this command is not issued, the certificate server keeps the requests in a pending state.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
After you enable the crypto pki server reject command, your certificate server will immediately reject all certificate requests.
SCEP, which is the only supported enrollment protocol, supports two client authentication mechanisms—manual and preshared key. Manual enrollment requires the administrator at the certification authority (CA) server to specifically authorize the enrollment requests. The administrator can become overloaded if there are numerous enrollment requests. Thus, the crypto pki server reject command can be reduce user interaction by automatically rejecting all or specific enrollment requests.
Examples
The following example shows how reject all manual enrollment requests for the certificate server "mycs":
Router# crypto pki server mycs reject allRelated Commands
crypto pki server remove
To remove enrollment requests that are in the certificate server Enrollment Request Database, use the crypto pki server remove command in privileged EXEC mode . This command does not have a no form.
crypto pki server cs-label remove {all | req-id}
Syntax Description
cs-label
Name of the certificate server.
all
Removes all enrollment requests.
req-id
Removes the specified enrollment request.
Defaults
Enrollment requests will remain in the certificate server database.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
After the certificate server receives an enrollment request, it can leave the request in pending, reject it, or grant it. Before this command was added, the request would be left in the Enrollment Request Database for 1 hour until the client polled the certficiate server for the result of the request. This command allows you to remove individual or all requests from the database, especially useful if the client leaves and never polls the certificate server.
In addition, the use of this command also allows the server to be returned to a clean slate with respect to the keys and transaction IDs. Thus, it is a useful command to use during troubleshooting with a Simple Certificate Enrollment Protocol (SCEP) client that may be behaving badly.
Examples
The following example shows that all enrollment requests are to be removed from the certificate server:
Router# enableRouter# crypto pki server server1 remove allRelated Commands
crypto pki server request pkcs10
To manually add a certificate request to the request database, use the crypto pki server request pkcs10 command in privileged EXEC mode.command argument keyword
crypto pki server cs-label request pkcs10 {url | terminal} [base64 | pem | scep hex]
Syntax Description
cs-label
Name of the certificate server. The name must match the name specified via the crypto pki server command.
url
URL of the file systems from which the certificate server should retrieve the PKCS10 enrollment request and to which it should post the granted certificate. For a list of available options, see Table 36.
Note
terminal
Certificate requests will be manually pasted from the console terminal, and the granted certificate will be displayed on the console.
base64
(Optional) Specifies the certificate will be returned without privacy-enhanced mail (PEM) headers, regardless of whether PEM headers were used in the request.
pem
(Optional) Specifies the certificate will be returned with PEM headers automatically added to the certificate after the certificate is granted, regardless of whether PEM headers were used in the request.
scep hex
(Optional) Specifies the certificate will be returned in hexadecimal. Pending requests will also be synchronized with the standby certificate server in hexadecimal.
Command Default
None
Command Modes
Privileged EXEC (#)
Command History
12.3(4)T
This command was introduced.
15.0(1)M
The command was modified to accept the PKCS10 certificate and the signing certificate in hexadecimal as well as in base64 encoding.
Usage Guidelines
Use the crypto pki server request pkcs10 command to manually add a base64-encoded, PEM-formatted, or hexadecimal-encoded PKCS10 certificate enrollment request. This command is especially useful when the client does not have a network connection with the certificate server so that it can do Simple Certificate Enrollment Protocol (SCEP) enrollment. After the certificate is granted, the certificate will be displayed on the console terminal using base64 encoding if the terminal keyword is specified, or it will be sent to the file system that is specified using the url argument.
The url argument allows you to specify or change the location in which the certificate server retrieves the new certificate request and posts the granted certificate. Table 36 lists available file system options.
Examples
The following example shows how to manually add a base64-encoded certificate request with PEM boundaries to the request database:
Router# crypto pki server mycs request pkcs10 terminal pem% Enter Base64 encoded or PEM formatted PKCS10 enrollment request.% End with a blank line or "quit" on a line by itself.-----BEGIN CERTIFICATE REQUEST-----MIIBdTCB3wIBADA2MQswCQYDVQQGEwJVUzEWMBQGA1UEChMNQ2lzY28gU3lzdGVtczEPMA0GA1UEAxMGdGVzdCAxMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDFEFukc2lCFSHtDJn6HFR2n8rpdhlAYwcs0m68N3iRYHonv847h0/H6utTHVd2qEEorNw97jMRZk6BLhVDc05TKGHvUlBlHQWwc/BqpVI8WiHzZdskUH/DUM8kd67Vkjlbe+FF7WrWT4FIO4vR4rF1V2p3FZ+A29UNc9Pi1s98nQIDAQABoAAwDQYJKoZIhvcNAQEEBQADgYEAUQCGNzzNJwBOCwmEmG8XEGFSZWDmFlctm8VWvaZYMPOt+vl6iwFkRmtD1Kg91Vw/qT5FJN8LmGUopOWIrwH4rUWON+TqtRmv2dgsdL5T4dx0sgG5E0s4T302paxEHiHVRJpe8OD7FJgOvdsKRziCpyD4/Jfb1WnSVQZmvIYAxVQ=-----END CERTIFICATE REQUEST-----% Enrollment request pending, reqId=2Router# crypto pki server mycs grant 2% Granted certificate:-----BEGIN CERTIFICATE-----MIIB/TCCAWagAwIBAgIBAzANBgkqhkiG9w0BAQQFADAPMQ0wCwYDVQQDEwRteWNzMB4XDTA0MDgyODAxMTcyOVoXDTA1MDgyODAxMTcyOVowNjELMAkGA1UEBhMCVVMxFjAUBgNVBAoTDUNpc2NvIFN5c3RlbXMxDzANBgNVBAMTBnRlc3QgMTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAxRBbpHNpQhUh7QyZ+hxUdp/K6XYZQGMHLNJuvDd4kWB6J7/OO4dPx+rrUx1XdqhBKKzcPe4zEWZOgS4VQ3NOUyhh71JQZR0FsHPwaqVSPFoh82XbJFB/w1DPJHeu1ZI5W3vhRe1q1k+BSDuL0eKxdVdqdxWfgNvVDXPT4tbPfJ0CAwEAAaNCMEAwHwYDVR0jBBgwFoAUggWpVwokbUtGIwGZGavh6C8Bq6UwHQYDVR0OBBYEFFD3jZ/d960qzCGKwKNtFvq85Xt6MA0GCSqGSIb3DQEBBAUAA4GBAAE4MqerwbM/nO8BCyZAiDzTqwLGnNvzS4H+u3JCsm0LaxY+E3d8NbSY+HruXWaR7QyjprDGFd9bftRoqGYuiQkupU13sIHEyf3C2KnXJB6imySvAiuaQrGdSuUSIhBOXfh/xdWo3XL1e3vtWiYUa4X6jPUMpn74HoNfB4/gHO7g-----END CERTIFICATE-----The following example shows how to retrieve a certificate request and add it to the request database (using the url argument):
Note
Router# crypto pki server mycs request pkcs10 tftp://192.0.2.129/router5% Retrieving Base64 encoded or PEM formatted PKCS10 enrollment request...Reading file from tftp://192.0.2.129/router5.reqLoading router5.req from 192.0.2.129 (via Ethernet0): ![OK - 582 bytes]% Enrollment request pending, reqId=1Router# crypto pki server mycs grant 1% Writing out the granted certificate...!Writing file to tftp://192.0.2.129/router5.crt!The following example shows how to manually add a hexadecimal-encoded certificate request with PEM boundaries to the request database:
Router# crypto pki server mycs request pkcs10 scep hex 0C4A3A2CA5C2E66DDCD740A4259759E2 5811E7CB133BAC936EF48C6187F4AD22 3PKCS10 request in hexEnter the PKCS10 in hexidecimal representation....Router(config-pubkey)#3082010E 3081B902 0100301D 311B3019 06092A86 4886F70D 01090216 0C697073Router(config-pubkey)#6563662D 33383435 61305C30 0D06092A 864886F7 0D010101 0500034B 00304802Router(config-pubkey)#4100B660 EF764AD6 A896E03E 0D1A1A16 5450857C 9B2CC04E B61719E5 2216CBF2Router(config-pubkey)#1973B464 17E78829 22CDBD87 FBD015F1 2A0A8DD7 5396EAA1 A2A65132 912466D2Router(config-pubkey)#62C90203 010001A0 37301406 092A8648 86F70D01 09073107 13056369 73636F30Router(config-pubkey)#1F060A60 86480186 F8450109 08311104 0F300D30 0B060355 1D0F0404 030205A0Router(config-pubkey)#300D0609 2A864886 F70D0101 04050003 410062A5 81B4C7F2 BDCEE03D 998BAD2BRouter(config-pubkey)#1E763461 EBB812EB 4082E2BB 273AA5DD 74FF7E12 E16035E9 4525A041 AF65E48FRouter(config-pubkey)#F0E6E13C 2646F943 5C23A634 BC50BC1F 343ARouter(config-pubkey)#30820123 3081CE02 0101300D 06092A86 4886F70D 01010405 00301D31 1B301906Router(config-pubkey)#092A8648 86F70D01 0902160C 69707365 63662D33 38343561 301E170D 30393031Router(config-pubkey)#31323032 33323039 5A170D31 39303131 30303233 3230395A 301D311B 30190609Router(config-pubkey)#2A864886 F70D0109 02160C69 70736563 662D3338 34356130 5C300D06 092A8648Router(config-pubkey)#6F70D01 01010500 034B0030 48024100 B660EF76 4AD6A896 E03E0D1A 1A165450Router(config-pubkey)#857C9B2C C04EB617 19E52216 CBF21973 B46417E7 882922CD BD87FBD0 15F12A0ARouter(config-pubkey)#8DD75396 EAA1A2A6 51329124 66D262C9 02030100 01300D06 092A8648 86F70D01Router(config-pubkey)#01040500 03410041 B2EBC44A 7F5FD26A DBAAB574 655D0C5D 84CCC7B5 48643525Router(config-pubkey)#E85E4E06 5465A27F 6066BC8C 52AF9FF4 CE6A9C66 44441BF0 053325DC 736FD696Router(config-pubkey)#97F8335 DDA951Router(config-pubkey)#quitEnter the certificate in hexidecimal representation....Router(config-pubkey)#quitRelated Commands
crypto pki server revoke
To revoke a certificate on the basis of its serial number, use the crypto pki server revoke command in privileged EXEC mode.
crypto pki server cs-label revoke certificate-serial-number
Syntax Description
Defaults
Certificates are revoked on the basis of their name.
Command Modes
Privileged EXEC
Command History
12.3(4)T
This command was introduced.
15.0(1)M
The command was modified to remove the serial-number check against the last-issued serial number.
Usage Guidelines
When a new certificate revocation list (CRL) is issued, the certificate server obtains the previous CRL, makes the appropriate changes, and resigns the new CRL. A new CRL is issued after a certificate is revoked from the CLI. If this process negatively affects router performance, the crypto pki server revoke command can be used to revoke a list or range of certificates.
Note
Note
Examples
The following examples show how to revoke a certificate with the serial number 76 (for example, 0x4c in hexidecimal) from the certificate server "mycs":
Router# crypto pki server mycs revoke 76Router# crypto pki server mycs revoke 0x4cRelated Commands
crypto pki server start
To enable a Cisco IOS certificate server, use the crypto pki server start command in privileged EXEC mode. To disable a certificate server, use the crypto pki server stop command.
crypto pki server servername start
Syntax Description
servername
Name of the certificate server.
Note
Command Default
The certificate server is disabled.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Using the crypto pki server start command is the same as using the no shut command in DSP configuration mode.
Examples
The following example shows how to enable a certificate server on a router:
Router# crypto pki server MYCA start%Some server settings cannot be changed after CA certificate generation.% Please enter a passphrase to protect the private key% or type Return to exitPassword:Re-enter password:% Certificate Server enabled.Related Commands
crypto pki server stop
Disables a Cisco IOS certificate server.
show crypto pki server
Displays the current state and configuration of a certificate server.
crypto pki server stop
To disable a Cisco IOS certificate server, use the crypto pki server stop command in privileged EXEC mode.
crypto pki server servername stop
Syntax Description
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
Using the crypto pki server stop command is the same as using the shutdown command in DSP configuration mode.
Examples
The following example shows how to disable a certificate server:
Router# crypto pki server MYCA stopCertificate server 'shut' event has been queued for processing.Related Commands
crypto pki server start
Enables a Cisco IOS certificate server.
show crypto pki server
Displays the current state and configuration of a certificate server.
crypto pki server trim
To trim certificates from the certificate revocation list (CRL), use the crypto pki server trim command in privileged EXEC mode.
crypto pki server cs-label trim {expired [start number [end number]] | url url} [verbose]
Syntax Description
Command Default
All certificates in the specified certificate server database will be searched to locate and to trim expired certificates.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
This command trims expired certificates from the CRL. Only certificates that are expired and have accurate and complete information in the certificate database can be trimmed from the database.
Depending on the size and location of the certificate database, searching the database for expired certificates may be a time consuming process. Depending on your environment, you may choose one of three methods to search and to trim your CRL:
•
This is usually the most time consuming and resource consuming method.
•
If there are a large number of certificates in your certificate database or if your certificate database is stored at a remote location (for example, TFTP or SCP) you may limit the range of certificates to search by specifying both the starting and ending certificate serial numbers. If no starting and ending certificate serial numbers are specified, the entire certificate database will be searched and all expired certificates will be trimmed.
•
Usually the most scalable method because it breaks the process into two steps: searching the certificate database for expired certificates and trimming the CRL. An input file listing expired certificate serial numbers may be generated using a Perl script or similar program, manually, or by issuing the crypto pki server trim generate expired-list command. The input list must follow the format as shown:
# CRL Trimming file generated on 01/31/2008version=13537Lines that begin with a pound sign (#) are inserted comments. The second line contains a version string indicating the file type. Each remaining line, in this example lines 35 and 37, contains a certificate serial number indicating one certificate to be removed from the CRL.
Examples
Router# crypto pki server mycs trim expired start 34 end 38Router# crypto pki server mycs trim generate expired-list start 34 end 38 url http://databaselocation/expired-certs.1stRouter# crypto pki server mycs trim url http://databaselocation/expired-certs.1stRouter# crypto pki server mycs trim expired start 45Certificate 2: Expired. Removed from CRL.Certificate F4240: Expired. Removed from CRL.Certificate 4593: Not Removed.Certificate 1234: Not Removed.Related Commands
crypto pki server trim generate expired-list
To generate a list of expired certificates in the current certificate revocation list (CRL), use the
crypto pki server trim generate expired-list command in privileged EXEC mode.crypto pki server cs-label trim generate expired-list [start number end number] [url url]
Syntax Description
Command Default
All certificates in the specified certificate server database will be searched to locate expired certificates.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
This command generates a list of expired certificates that are in the CRL for the specified certificate server. The resulting list of expired certificates may be used as input to the crypto pki server trim command to remove the listed certificates from the CRL resulting in trimming, or revoking, the expired certificates.
Only certificates that have accurate and complete information in the certificate database can be automatically added to the list of expired certificates and later trimmed from the database. Only CRL entries for expired certificates can be trimmed.
If there are a large number of certificates in your certificate database or if your certificate database is stored at a remote location, for example TFTP or SCP, you may limit the range of certificates to search by specifying both the starting and ending certificate serial numbers. If no starting and ending certificate serial numbers are specified, the entire certificate database will be searched and all expired certificates will be added to the expired certificates list.
A URL may be specified to save the list of expired certificates to a specified location. If no URL is specified, the list of expired certificates will be printed on your terminal. The list may then be cut and pasted to a file.
Examples
Router# crypto pki server mycs trim generate expired-list start 34 end 38 url http://databaselocation/expired-certs.1stThe following example shows the resulting list of expired certificates in the file expired-certs.1st:
Lines that begin with a pound sign (#) are inserted comments. The second line contains a version string indicating the file type. Each remaining line, in this example lines 35 and 37, contains a certificate serial number indicating one certificate to be removed from the CRL.
Related Commands
crypto pki server unrevoke
To recover a revoked certificate, that is to remove a certificate from the certificate revocation list (CRL), use the crypto pki server unrevoke command in privileged EXEC mode.
crypto pki server cs-label unrevoke certificate-serial-number
Syntax Descriptionstart
Command Default
None.
Command Modes
Privileged EXEC (#)
Command History
Usage Guidelines
If a certificate is erroneously revoked, either the client has to reenroll in the PKI or the administrator may recover the revoked certificate by issuing the crypto pki server unrevoke command. This command removes a certificate, specified by its serial number, from the CRL. The CRL is then resigned and can be republished.
Examples
The following examples show how to unrevoke a certificate with the serial number 76, or 0x4c in hexidecimal, from the certificate server "mycs":
Router# crypto pki server mycs unrevoke 76Router# crypto pki server mycs unrevoke 0x4cRelated Commands
crypto pki token change-pin
To change the user PIN on the USB eToken, use the crypto pki token change-pin command in privileged EXEC mode.
crypto pki token token-name [admin] change-pin [pin]
Syntax Description
Command Default
None
Command Modes
Privileged EXEC
Command History
12.3(14)T
This command was introduced.
12.4(11)T
This command was integrated into the Cisco 7200VXR NPE-G2 platform.
Usage Guidelines
If you want to change the administrative PIN on the token, you must be logged into the eToken as an admin via the crypto pki token admin login command.
After the user PIN has been changed, you must reset the login failure count to zero (via the crypto pki token max-retries command). The maximum number of allowable login failures is set (by default) to 15.
Examples
The following example shows that the user PIN was changed to 1234:
crypto pki token usbtoken0 admin login 5678crypto pki token usbtoken0 change-pin 1234Related Commands
crypto pki token login
Logs into the USB eToken.
crypto pki token max-retries
Sets the maximum number of allowed failed login attempts.
crypto pki token encrypted-user-pin
To encrypt a USB token PIN that is stored in private NVRAM, use the crypto pki token encrypted-user-pin command in global configuration mode. To decrypt the token's PIN, use the no form of this command.
crypto pki token token-name encrypted-user-pin [write] [passphrase passphrase]
no crypto pki token token-name encrypted-user-pin [write] [passphrase passphrase]
Syntax Description
Command Default
The PIN stored in private NVRAM is not encrypted.
Command Modes
Global configuration
Command History
12.4(4)T
This command was introduced.
12.4(11)T
This command was integrated into the Cisco 7200VXR NPE-G2 platform.
Usage Guidelines
After the token's PIN is encrypted with the crypto pki token encrypted-user-pin command, no action is taken when you insert the token into the router. The user must log into the router and enter the passphrase to decrypt the PIN before the router can use the PIN to log into the token.
After the PIN has been successfully decrypted, the router will execute the configuration commands from the token at privilege level 15.
Tip
Also, the user should log into the token as a "normal user" (a privilege level 1 user), so the user cannot access commands that can alter the configuration of the router.Examples
The following example shows the configuration of a user PIN and the encryption of that user PIN:
! Configure the user PIN.
Router(config)# crypto pki token usbtoken0: user-pin
Enter password:
!
! Now, the user PIN can be encrypted.
!
Router(config)# crypto pki token usbtoken0: encrypted-user-pin
Enter passphrase:
Router(config)# exit
Router#
Router# show running config
.
.
.
crypto pki token usbtoken0 user-pin *encrypted*
.
.
.
Related Commands
crypto pki token label
To set or change the name of a USB token label, use the crypto pki token label command in global configuration mode.
crypto pki token device: label token-label
Syntax Description
Command Default
No label is set. The USB token is known by its factory name.
Command Modes
Global configuration
Command History
12.4(4)T
This command was introduced.
12.4(11)T
This command was integrated into the Cisco 7200VXR NPE-G2 platform.
Usage Guidelines
After you have logged in your USB token to the router, you may want to change the factory default label. Changing the default factory name to a unique name is useful when configuring multiple USB tokens for automatic login, secondary configuration files, or other token specific settings.
Note
If using the device name, it is followed by a colon, ":".Examples
The following example shows how to change the USB token label from the "oldlabel" to "newlabel" after the token has been logged in. The router will not use the "newlabel" until the next time the token is inserted or the router is reloaded:
Router#
Router# configure terminal
Router(config)# crypto pki token oldlabel label newlabel
Token label changed.
Related Commands
crypto pki token user-pin
Creates a PIN that automatically allows the router to log into the USB token at router startup.
crypto pki token lock
To lock the token, use the crypto pki token lock command in privileged EXEC mode.
crypto pki token token-name lock [user-pin] [passphrase passphrase]
Syntax Description
Command Default
The token is not locked.
Command Modes
Privileged EXEC
Command History
12.4(4)T
This command was introduced.
12.4(11)T
This command was integrated into the Cisco 7200VXR NPE-G2 platform.
Usage Guidelines
After you have locked a token with the crypto pki token lock command, all Rivest, Shamir, and Adelman (RSA) keys that have been loaded from the token will be deleted and, if configured, the secondary "unconfig" file will run with full privileges.
Examples
The following example shows how to reload a router, unlock the PIN, and then lock the PIN again:
Router> enable
Password:
Router# crypto pki token usbtoken0: unlock
Token eToken is usbtoken0
!
Enter passphrase:
Token login to usbtoken0(eToken) successful
Router#
Sep 20 22:31:13.128: %CRYPTO-6-TOKENLOGIN: Cryptographic Token eToken
Login SuccessfulRouter# crypto pki token usbtoken0: lock
Related Commands
crypto pki token login
To log into the USB eToken, use the crypto pki token login command in privileged EXEC mode.
crypto pki token token-name [admin] login [pin]
Syntax Description
Command Default
None
Command Modes
Privileged EXEC
Command History
12.3(14)T
This command was introduced.
12.4(11)T
This command was integrated into the Cisco 7200VXR NPE-G2 platform.
Usage Guidelines
This command allows you to manually log into a USB eToken. To automatically log into an eToken, issue the crypto pki token user-pin command, which allows you to create a PIN for automatic login.
Examples
The following example shows how to log into the USB eToken manually:
crypto pki token usbtoken0:login 1234567890Related Commands
crypto pki token logout
To log the router out of the USB eToken, use the crypto pki token logout command in privileged EXEC mode.
crypto pki token token-name logout
Syntax Description
Command Default
None
Command Modes
Privileged EXEC
Command History
12.3(14)T
This command was introduced.
12.4(11)T
This command was integrated into the Cisco 7200VXR NPE-G2 platform.
Usage Guidelines
If you want to save any data to the USB eToken, you must log back into the eToken.
Examples
The following example shows how to successfully log out of a USB eToken:
crypto pki token usbtoken0:logoutToken eToken is usbtoken0Token logout from usbtoken0(eToken) successful*Jan 28 05:46:59.544:%CRYPTO-6-TOKENLOGOUT:Cryptographic Token eToken Logout SuccessfulRelated Commands
crypto pki token max-retries
To set the maximum number of allowed failed login attempts, use the crypto pki token max-retries command in global configuration mode. To return to the default functionality (which is 15 failed login attempts), use the no form of this command.
crypto pki token {token-name | default} max-retries [number]
no crypto pki token {token-name | default} max-retries [number]
Syntax Description
Defaults
15 failed login attempts are allowed
Command Modes
Global configuration
Command History
12.3(14)T
This command was introduced.
12.4(11)T
This command was integrated into the Cisco 7200VXR NPE-G2 platform.
Usage Guidelines
After the user PIN is changed via the crypto pki token change-pin command, the login failure count is automatically reset to 15; however, it is recommended that the login failure count be set to zero.
Examples
The following example shows how to change the allowed maximum number of failed login attempts to 20:
crypto pki token usbtoken0 max-retries 20
Related Commands
crypto pki token change-pin
Changes the user PIN number on the USB eToken.
crypto pki token login
Logs into the USB eToken.
crypto pki token removal timeout
To set the time interval that the router waits before removing the Rivest, Shamir, and Adelman (RSA) keys that are stored in the eToken, use the crypto pki token removal timeout command in global configuration mode. To return to the default functionality (which is no timeout), use the no form of this command.
crypto pki token {token-name | default} removal timeout [seconds]
no crypto pki token {token-name | default} removal timeout [seconds]
Syntax Description
Defaults
RSA keys are automatically removed after the eToken is removed from the router.
Command Modes
Global configuration
Command History
12.3(14)T
This command was introduced.
12.4(11)T
This command was integrated into the Cisco 7200VXR NPE-G2 platform.
Usage Guidelines
After the eToken is removed from the router, you can clear from your router any RSA keys that were obtained from the eToken; all IPSec tunnels that used those RSA keys for authentication are also torn down. Both the keys and tunnels are immediately cleared unless otherwise specified via the crypto pki token removal timeout command.
Although the RSA keys remain on the eToken, they can only be accessed with the correct PIN. Too many unsuccessful attempts to log into the eToken will disable the PIN and any further login attempts will be refused.
Note
Examples
The following example shows how to set the time that the router will wait before removing the RSA keys that are stored in the eToken after the eToken has been removed from the router:
crypto pki token usbtoken0 removal timeout 60Related Commands
crypto pki token logout
Logs the router out of the USB token.
crypto pki token max-retries
Sets the maximum number of allowed failed login attempts.
crypto pki token secondary config
To merge a specified file with the running configuration after the eToken is logged into the router, use the crypto pki token secondary config command in privileged EXEC mode.
crypto pki token token-name secondary config file
Syntax Description
Defaults
A secondary configuration file does not exist.
Command Modes
Privileged EXEC
Command History
12.3(14)T
This command was introduced.
12.4(11)T
This command was integrated into the Cisco 7200VXR NPE-G2 platform.
Usage Guidelines
Use the crypto pki token secondary config command if you want to merge, not overwrite, a file with the running configuration on the router.
The secondary configuration is processed after the eToken is logged into the router.
Examples
The following example shows how to merge the secondary configuration file "CONFIG1.CFG" with the current running configuration:
crypto pki token default secondary config CONFIG1.CFGRelated Commands
crypto pki token login
Logs into the USB eToken.
crypto pki token user-pin
Creates a PIN that automatically allows the router to log into the USB eToken at router startup.
crypto pki token secondary unconfig
To specify a secondary "unconfig" file and its location for a USB token, use the crypto pki token secondary unconfig command in global configuration mode. To remove secondary configuration elements from the running configuration, use the no form of this command.
crypto pki token token-name secondary unconfig file
no crypto pki token token-name secondary unconfig file
Syntax Description
token-name
Name of the token that is to be unlocked.
file
Name and location of the secondary configuration file.
Command Default
Secondary "unconfig" file will not be processed.
Command Modes
Global configuration
Command History
12.4(4)T
This command was introduced.
12.4(11)T
This command was integrated into the Cisco 7200VXR NPE-G2 platform.
Usage Guidelines
Configuration files that exist on a USB token are called secondary configuration files. If you create and configure a secondary configuration file, it is executed after the token is logged in. The existence of a secondary configuration file is determined by the presence of a secondary configuration file option in the Cisco IOS configuration stored in NVRAM.
When the token is removed, logged out, or the removal timer (if set) expires, a separate "unconfig" file is processed to remove all secondary configuration elements from the running configuration. Secondary configuration and secondary "unconfig" files are executed at privilege level 15 and are not dependent on the level of the user logged in.
Examples
The following example shows a how a secondary "unconfig" file might be used to remove secondary configuration elements from the running config. For example, a secondary configuration file might be used to set up a public key infrastructure (PKI) trustpoint. A corresponding "unconfig" file, named mysecondaryunconfigfile.cfg, might contain the following command:
no crypto pki trustpoint token-tp
If the token were removed and the following commands executed, the trustpoint and associated certificates would be removed from the router's running configuration:
Router# configure terminal
Router(config)# no crypto pki token mytoken secondary unconfig mysecondaryunconfigfile.cfg
Related Commands
crypto pki token unlock
To unlock the token and decrypt the PIN that is stored in private NVRAM, use the crypto pki token unlock command in privileged EXEC mode.
crypto pki token token-name unlock [user-pin] [passphrase passphrase]
Syntax Description
Command Default
USB token is not unlocked, or decrypted.
Command Modes
Privileged EXEC
Command History
12.4(4)T
This command was introduced.
12.4(11)T
This command was integrated into the Cisco 7200VXR NPE-G2 platform.
Usage Guidelines
After you unlock a token via the crypto pki token unlock command, the Cisco IOS software will treat the token as if it is automatically logged into the router. Any Rivest, Shamir, and Adelman (RSA) keys on the token are loaded onto the router and the secondary configuration file on the token is executed (if a secondary configuration file has been configured by the user). Secondary configuration files are executed with full user privileges.
Examples
The following example shows the configuration and encryption of a user PIN and then that the router is reloading and the user PIN is being unlocked.
! Configuring the user PIN
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)# crypto pki token usbtoken0: user-pin
Enter password:
! Encrypt the user PIN
Router (config)# crypto pki token usbtoken0: encrypted-user-pin
Enter passphrase:
Router(config)# exit
Router#
Sep 20 21:51:38.076: %SYS-5-CONFIG_I: Configured from console by console
!
Router# show running-config
.
.
.
crypto pki token usbtoken0 user-pin *encrypted*
.
.
.
! Reloading the router.
!
Router> enable
Password:
!
! Decrypting the user pin.
!
Router# crypto pki token usbtoken0: unlock
Token eToken is usbtoken0
!
Enter passphrase:
Token login to usbtoken0(eToken) successful
Router#
Sep 20 22:31:13.128: %CRYPTO-6-TOKENLOGIN: Cryptographic Token eToken
Login Successful
Related Commands
crypto pki token user-pin
Creates a PIN that automatically allows the router to log into the USB token at router startup.
crypto pki token user-pin
To create a PIN that automatically allows the router to log into the USB eToken at router startup, use the crypto pki token user-pin command in global configuration mode. To remove the stored PIN from the configuration, use the no form of this command.
crypto pki token token-name user-pin [pin]
no crypto pki token token-name user-pin [pin]
Syntax Description
Defaults
If this command is not issued, the router cannot access the eToken.
Command Modes
Global configuration
Command History
12.3(14)T
This command was introduced.
12.4(11)T
This command was integrated into the Cisco 7200VXR NPE-G2 platform.
Usage Guidelines
After the eToken is plugged into the router, the router will use the specified PIN (or the default PIN if no PIN is specified) to automatically log in as the user.
Examples
The following example shows how to access the eToken via the user PIN "12345":
crypto pki token usbtoken0 user-pin 12345Related Commands
crypto pki login
Logs into the USB eToken.
crypto pki token logout
Logs the router out of the USB eToken.
crypto pki trustpoint
To declare the trustpoint that your router should use, use the crypto pki trustpoint command in global configuration mode. To delete all identity information and certificates associated with the trustpoint, use the no form of this command.
crypto pki trustpoint name redundancy
no crypto pki trustpoint name
Syntax Description
Defaults
Your router does not recognize any trustpoints until you declare a trustpoint using this command.
Your router uses unique identifiers during communication with Online Certificate Status Protocol (OCSP) servers, as configured in your network.
Command Modes
Global configuration
Command History
Usage Guidelines
Declaring Truspoints
Use the crypto pki trustpoint command to declare a trustpoint, which can be a self-signed root certificate authority (CA) or a subordinate CA. Issuing the crypto pki trustpoint command puts you in ca-trustpoint configuration mode.
You can specify characteristics for the trustpoint using the following subcommands:
•
•
•
•
•
•
•
•
•
Specifying Use of Unique Identifiers
When using OCSP as your revocation method, unique identifiers, or nonces, are sent by default during peer communications with the OCSP server. The use of unique identifiers during OCSP server communications enables more secure and reliable communications. However, not all OCSP servers support the use of unique dentures, see your OCSP manual for more information. To disable the use of unique identifiers during OCSP communications, use the ocsp disable-nonce subcommand.
Examples
The following example shows how to declare the CA named ka and specify enrollment and CRL parameters:
crypto pki trustpoint kaenrollment url http://kahului:80The following example shows a certificate-based ACL with the label Group defined in a crypto pki certificate map command and included in the match certificate subcommand of the crypto pki trustpoint command:
crypto pki certificate map Group 10subject-name co ou=WANsubject-name co o=Cisco!crypto pki trustpoint pki1match certificate GroupThe following example shows a self-signed certificate being designated for a trustpoint named local using the enrollment selfsigned subcommand of the crypto pki trustpoint command:
crypto pki trustpoint localenrollment selfsignedThe following example shows the unique identifier being disabled for OCSP communications for a previously created trustpoint named ts:
crypto pki trustpoint tsocsp disable-nonceThe following example shows the redundancy keyword specified in the crypto pki trustpoint command:
Router(config)#crypto pki trustpoint mytpRouter(ca-trustpoint)#redundancyRouter(ca-trustpoint)#showredundancyrevocation-check crlendRelated Commands
crypto provisioning petitioner
To configure a device to become an easy secure device provisioning (SDP) petitioner and enter tti-petitioner configuration mode, use the crypto provisioning petitioner command in global configuration mode. To disable petitioner support, use the no form of this command.
crypto provisioning petitioner
no crypto provisioning petitioner
Syntax Description
This command has no arguments or keywords.
Defaults
A device (with a crypto image) is configured to be an SDP petitioner.
Command Modes
Global configuration
Command History
12.3(8)T
The crypto wui tti petitioner command was introduced.
12.3(14)T
This command replaced the crypto wui tti petitioner command.
Usage Guidelines
SDP uses Trusted Transitive Introduction (TTI) to easily deploy public key infrastructure (PKI) between two end devices. TTI, which is a communication protocol that provides a bidirectional introduction between two end entities, involves the following three entities:
•
•
•
Note
Examples
After the SDP exchange is complete, the petitioner will automatically enroll with the registrar and obtain a certificate. The following sample output from the show running-config command shows an automatically generated configuration at the petitioner.
Note
crypto pki trustpoint tti! Enrollment url contains the registrar CS detailsenrollment url http://pki1-36a.cisco.com:80revocation-check crlrsakeypair tti 1024auto-enroll 70Related Commands
crypto provisioning registrar
To configure a device to become an easy secure device provisioning (SDP) registrar and enter tti-registrar configuration mode, use the crypto provisioning registrar command in global configuration mode. To disable registrar support, use the no form of this command.
crypto provisioning registrar
no crypto provisioning registrar
Syntax Description
This command has no arguments or keywords.
Defaults
The registrar is not enabled.
Command Modes
Global configuration
Command History
12.3(8)T
The crypto wui tti registrar command was introduced.
12.3(14)T
This command replaced the crypto wui tti registrar command.
Usage Guidelines
SDP uses Trusted Transitive Introduction (TTI) to easily deploy public key infrastructure (PKI) between two end devices. TTI, which is a communication protocol that provides a bidirectional introduction between two end entities, involves the following three entities:
•
•
•
Although any device that contains a crypto image can be the registrar, it is recommended that the registrar be either a Cisco IOS certificate server registration authority (RA) or a Cisco IOS certificate server root.
Examples
The following sample output from the show running-config command verifies that the certificate server "cs1" was configured and associated with the TTI exchange between the registrar and petitioner:
crypto pki server cs1issuer-name CN = ioscs,L = Santa Cruz,C =USlifetime crl 336lifetime certificate 730!crypto pki trustpoint pki-36aenrollment url http://pki-36a:80ip-address FastEthernet0/0revocation-check none!crypto pki trustpoint cs1revocation-check crlrsakeypair cs1!!crypto pki certificate chain pki-36acertificate 03308201D0 30820139 A0030201 02020103 300D0609 2A864886 F70D0101 0405003034310B30 09060355 04061302 55533114 30120603 55040713 0B205361 6E7461204372757A 310F300D 06035504 03130620 696F7363 73301E17 0D303430 3133313039333334 345A170D 30363031 33303039 33333434 5A303A31 38301606 092A864886F70D01 09081309 31302E32 332E322E 32301E06 092A8648 86F70D01 09021611706B692D 3336612E 63697363 6F2E636F 6D305C30 0D06092A 864886F7 0D0101010500034B 00304802 4100AFFA 8F429618 112FAB9D 01F3352E 59DD3D2D AE67E31D370AC4DA 619735DF 9CF4EA13 64E4B563 C239C5F0 1578B773 07BED641 A18CA629191884B5 61B66ECF 4D110203 010001A3 30302E30 0B060355 1D0F0404 030205A0301F0603 551D2304 18301680 141DA8B1 71652961 3F7D69F0 02903AC3 2BADB137C6300D06 092A8648 86F70D01 01040500 03818100 67BAE186 327CED31 D642CB39AD585731 95868683 B950DF14 3BCB155A 2B63CFAD B34B579C 79128AD9 296922E94DEDFCAF A7B5A412 AB1FC081 09951CE3 08BFFDD9 9FB1B9DA E9AA42C8 D1049268C524E58F 11C6BA7F C750320C 03DFB6D4 CBB3E739 C8C76359 CE939A97 B51B3F7F3FF;A9D82 9CFDB6CF E2503A14 36D0A236 A1CCFEAEquitcertificate ca 0130820241 308201AA A0030201 02020101 300D0609 2A864886 F70D0101 0405003034310B30 09060355 04061302 55533114 30120603 55040713 0B205361 6E7461204372757A 310F300D 06035504 03130620 696F7363 73301E17 0D303430 3133313039333132 315A170D 30373031 33303039 33313231 5A303431 0B300906 0355040613025553 31143012 06035504 07130B20 53616E74 61204372 757A310F 300D060355040313 0620696F 73637330 819F300D 06092A86 4886F70D 01010105 0003818D00308189 02818100 FC0695AF 181CE90A 1B34B348 BA957178 680C8B51 07802AC3BF77B9C6 CB45092E 3C22292D C7D5FFC1 899185A1 FD8F37D5 C44FC206 6D1FA581E2264C83 1CC7453E 548C89C6 F3CD25BC 9BFFE7C5 E6653A06 62133950 78BED51B49128428 AB237F80 83A530EA 6F896193 F2134B54 D181F059 348AA84B 21EE6D80727BF668 EB004341 02030100 01A36330 61300F06 03551D13 0101FF04 0530030101FF300E 0603551D 0F0101FF 04040302 0186301D 0603551D 0E041604 141DA8B171652961 3F7D69F0 02903AC3 2BADB137 C6301F06 03551D23 04183016 80141DA8B1716529 613F7D69 F002903A C32BADB1 37C6300D 06092A86 4886F70D 0101040500038181 00885895 A0141169 3D754EB2 E6FEC293 5BF0A80B E424AA2F A3F597653463AAD1 55E71F0F B5D1A35B 9EA79DAC DDB40721 1344C01E 015BAB73 1E148E039DD01431 A5E2887B 4AEC8EF4 48ACDB66 A6F9401E 8F7CA588 8A4199BB F8A437A0F25064E7 112805D3 074A154F 650D09B9 8FA19347 ED359EAD 4181D9ED 0C667C108A7BCFB0 FBquitcrypto pki certificate chain cs1certificate ca 0130820241 308201AA A0030201 02020101 300D0609 2A864886 F70D0101 0405003034310B30 09060355 04061302 55533114 30120603 55040713 0B205361 6E7461204372757A 310F300D 06035504 03130620 696F7363 73301E17 0D303430 3133313039333132 315A170D 30373031 33303039 33313231 5A303431 0B300906 0355040613025553 31143012 06035504 07130B20 53616E74 61204372 757A310F 300D060355040313 0620696F 73637330 819F300D 06092A86 4886F70D 01010105 0003818D00308189 02818100 FC0695AF 181CE90A 1B34B348 BA957178 680C8B51 07802AC3BF77B9C6 CB45092E 3C22292D C7D5FFC1 899185A1 FD8F37D5 C44FC206 6D1FA581E2264C83 1CC7453E 548C89C6 F3CD25BC 9BFFE7C5 E6653A06 62133950 78BED51B49128428 AB237F80 83A530EA 6F896193 F2134B54 D181F059 348AA84B 21EE6D80727BF668 EB004341 02030100 01A36330 61300F06 03551D13 0101FF04 0530030101FF300E 0603551D 0F0101FF 04040302 0186301D 0603551D 0E041604 141DA8B171652961 3F7D69F0 02903AC3 2BADB137 C6301F06 03551D23 04183016 80141DA8B1716529 613F7D69 F002903A C32BADB1 37C6300D 06092A86 4886F70D 0101040500038181 00885895 A0141169 3D754EB2 E6FEC293 5BF0A80B E424AA2F A3F597653463AAD1 55E71F0F B5D1A35B 9EA79DAC DDB40721 1344C01E 015BAB73 1E148E039DD01431 A5E2887B 4AEC8EF4 48ACDB66 A6F9401E 8F7CA588 8A4199BB F8A437A02;F25064E7 112805D3 074A154F 650D09B9 8FA19347 ED359EAD 4181D9ED 0C667C108A7BCFB0 FBquit!crypto provisioning registrarpki-server cs1!!!crypto isakmp policy 1hash md5!!crypto ipsec transform-set test_transformset esp-3des!crypto map test_cryptomap 10 ipsec-isakmpset peer 10.23.1.10set security-association lifetime seconds 1800set transform-set test_transformsetmatch address 170Related Commands
crypto wui tti petitioner
Note
To configure a device to become an easy secure device deployment (EzSDD) petitioner and enter tti-petitioner configuration mode, use the crypto wui tti petitioner command in global configuration mode. To disable petitioner support, use the no form of this command.
crypto wui tti petitioner
no crypto wui tti petitioner
Syntax Description
This command has no arguments or keywords.
Defaults
A device (with a crypto image) is configured to be an EzSDD petitioner.
Command Modes
Global configuration
Command History
Usage Guidelines
EzSDD uses Trusted Transitive Introduction (TTI) to easily deploy public key infrastructure (PKI) between two end devices. TTI, which is a communication protocol that provides a bidirectional introduction between two end entities, involves the following three entities:
•
•
•
Note
Examples
After the EzSDD exchange is complete, the petitioner will automatically enroll with the registrar and obtain a certificate. The following sample output from the show running-config command shows an automatically generated configuration at the petitioner. (Note that petitioner will not have any TTI-specific configuration in the beginning except that the http server will be turned on and the Domain Name System (DNS) server needs to be properly configured.)
crypto pki trustpoint tti! Enrollment url contains the registrar CS detailsenrollment url http://pki1-36a.cisco.com:80revocation-check crlrsakeypair tti 1024auto-enroll 70Related Commands
crypto wui tti registrar
Note
To configure a device to become an easy secure device deployment (EzSDD) registrar and enter tti-registrar configuration mode, use the crypto wui tti registrar command in global configuration mode. To disable registrar support, use the no form of this command.
crypto wui tti registrar
no crypto wui tti registrar
Syntax Description
This command has no arguments or keywords.
Defaults
The registrar is not enabled.
Command Modes
Global configuration
Command History
Usage Guidelines
EzSDD uses Trusted Transitive Introduction (TTI) to easily deploy public key infrastructure (PKI) between two end devices. TTI, which is a communication protocol that provides a bidirectional introduction between two end entities, involves the following three entities:
•
•
•
Although any device that contains a crypto image can be the registrar, it is recommended that the registrar be either a Cisco IOS certificate server registration authority (RA) or a Cisco IOS certificate server root.
Examples
The following sample output from the show running-config command verifies that the certificate server "cs1" was configured and associated with the TTI exchange between the registrar and petitioner:
crypto pki server cs1issuer-name CN = ioscs,L = Santa Cruz,C =USlifetime crl 336lifetime certificate 730!crypto pki trustpoint pki-36aenrollment url http://pki-36a:80ip-address FastEthernet0/0revocation-check none!crypto pki trustpoint cs1revocation-check crlrsakeypair cs1!!crypto pki certificate chain pki-36acertificate 03308201D0 30820139 A0030201 02020103 300D0609 2A864886 F70D0101 0405003034310B30 09060355 04061302 55533114 30120603 55040713 0B205361 6E7461204372757A 310F300D 06035504 03130620 696F7363 73301E17 0D303430 3133313039333334 345A170D 30363031 33303039 33333434 5A303A31 38301606 092A864886F70D01 09081309 31302E32 332E322E 32301E06 092A8648 86F70D01 09021611706B692D 3336612E 63697363 6F2E636F 6D305C30 0D06092A 864886F7 0D0101010500034B 00304802 4100AFFA 8F429618 112FAB9D 01F3352E 59DD3D2D AE67E31D370AC4DA 619735DF 9CF4EA13 64E4B563 C239C5F0 1578B773 07BED641 A18CA629191884B5 61B66ECF 4D110203 010001A3 30302E30 0B060355 1D0F0404 030205A0301F0603 551D2304 18301680 141DA8B1 71652961 3F7D69F0 02903AC3 2BADB137C6300D06 092A8648 86F70D01 01040500 03818100 67BAE186 327CED31 D642CB39AD585731 95868683 B950DF14 3BCB155A 2B63CFAD B34B579C 79128AD9 296922E94DEDFCAF A7B5A412 AB1FC081 09951CE3 08BFFDD9 9FB1B9DA E9AA42C8 D1049268C524E58F 11C6BA7F C750320C 03DFB6D4 CBB3E739 C8C76359 CE939A97 B51B3F7F3FF;A9D82 9CFDB6CF E2503A14 36D0A236 A1CCFEAEquitcertificate ca 0130820241 308201AA A0030201 02020101 300D0609 2A864886 F70D0101 0405003034310B30 09060355 04061302 55533114 30120603 55040713 0B205361 6E7461204372757A 310F300D 06035504 03130620 696F7363 73301E17 0D303430 3133313039333132 315A170D 30373031 33303039 33313231 5A303431 0B300906 0355040613025553 31143012 06035504 07130B20 53616E74 61204372 757A310F 300D060355040313 0620696F 73637330 819F300D 06092A86 4886F70D 01010105 0003818D00308189 02818100 FC0695AF 181CE90A 1B34B348 BA957178 680C8B51 07802AC3BF77B9C6 CB45092E 3C22292D C7D5FFC1 899185A1 FD8F37D5 C44FC206 6D1FA581E2264C83 1CC7453E 548C89C6 F3CD25BC 9BFFE7C5 E6653A06 62133950 78BED51B49128428 AB237F80 83A530EA 6F896193 F2134B54 D181F059 348AA84B 21EE6D80727BF668 EB004341 02030100 01A36330 61300F06 03551D13 0101FF04 0530030101FF300E 0603551D 0F0101FF 04040302 0186301D 0603551D 0E041604 141DA8B171652961 3F7D69F0 02903AC3 2BADB137 C6301F06 03551D23 04183016 80141DA8B1716529 613F7D69 F002903A C32BADB1 37C6300D 06092A86 4886F70D 0101040500038181 00885895 A0141169 3D754EB2 E6FEC293 5BF0A80B E424AA2F A3F597653463AAD1 55E71F0F B5D1A35B 9EA79DAC DDB40721 1344C01E 015BAB73 1E148E039DD01431 A5E2887B 4AEC8EF4 48ACDB66 A6F9401E 8F7CA588 8A4199BB F8A437A0F25064E7 112805D3 074A154F 650D09B9 8FA19347 ED359EAD 4181D9ED 0C667C108A7BCFB0 FBquitcrypto pki certificate chain cs1certificate ca 0130820241 308201AA A0030201 02020101 300D0609 2A864886 F70D0101 0405003034310B30 09060355 04061302 55533114 30120603 55040713 0B205361 6E7461204372757A 310F300D 06035504 03130620 696F7363 73301E17 0D303430 3133313039333132 315A170D 30373031 33303039 33313231 5A303431 0B300906 0355040613025553 31143012 06035504 07130B20 53616E74 61204372 757A310F 300D060355040313 0620696F 73637330 819F300D 06092A86 4886F70D 01010105 0003818D00308189 02818100 FC0695AF 181CE90A 1B34B348 BA957178 680C8B51 07802AC3BF77B9C6 CB45092E 3C22292D C7D5FFC1 899185A1 FD8F37D5 C44FC206 6D1FA581E2264C83 1CC7453E 548C89C6 F3CD25BC 9BFFE7C5 E6653A06 62133950 78BED51B49128428 AB237F80 83A530EA 6F896193 F2134B54 D181F059 348AA84B 21EE6D80727BF668 EB004341 02030100 01A36330 61300F06 03551D13 0101FF04 0530030101FF300E 0603551D 0F0101FF 04040302 0186301D 0603551D 0E041604 141DA8B171652961 3F7D69F0 02903AC3 2BADB137 C6301F06 03551D23 04183016 80141DA8B1716529 613F7D69 F002903A C32BADB1 37C6300D 06092A86 4886F70D 0101040500038181 00885895 A0141169 3D754EB2 E6FEC293 5BF0A80B E424AA2F A3F597653463AAD1 55E71F0F B5D1A35B 9EA79DAC DDB40721 1344C01E 015BAB73 1E148E039DD01431 A5E2887B 4AEC8EF4 48ACDB66 A6F9401E 8F7CA588 8A4199BB F8A437A02;F25064E7 112805D3 074A154F 650D09B9 8FA19347 ED359EAD 4181D9ED 0C667C108A7BCFB0 FBquit!crypto wui tti registrarpki-server cs1!!!crypto isakmp policy 1hash md5!!crypto ipsec transform-set test_transformset esp-3des!crypto map test_cryptomap 10 ipsec-isakmpset peer 10.23.1.10set security-association lifetime seconds 1800set transform-set test_transformsetmatch address 170Related Commands
csd enable
To enable Cisco Secure Desktop (CSD) support for SSL VPN sessions, use the csd enable command in webvpn context configuration mode. To remove CSD support from the SSL VPN context configuration, use the no form of this command.
csd enable
no csd enable
Syntax Description
This command has no keywords or arguments.
Command Default
CSD support is not enabled.
Command Modes
Webvpn context configuration
Command History
Usage Guidelines
The CSD software installation package must be present in a local file system, such as flash memory, and it must be cached for distribution to end users (remote PC or networking device). The webvpn install command is used to install the software installation package to the distribution cache.
Examples
The following example enables CSD support for SSL VPN sessions:
Router(config)# webvpn install csd flash:/securedesktop_3_1_0_9.pkgSSLVPN Package Cisco-Secure-Desktop : installed successfullyRouter(config)# webvpn context context1Router(config-webvpn-context)# csd enableRelated Commands
ctcp port
To set the port number for Cisco Tunneling Control Protocol (cTCP) encapsulation for Easy VPN, use the ctcp port command in crypto ipsec client ezvpn configuration mode. To disable the port that was configured, use the no form of this command.
ctcp port port-number
no ctcp port
Syntax Description
Command Default
If a port is not specified, the default port is the port on which the cTCP server listens.
Command Modes
Crypto ipsec client ezvpn configuration (config-crypto-ezvpn)
Command History
Usage Guidelines
This command is used only on the Easy VPN remote device.
Examples
The following example shows that the cTCP port number has been set to 10:
Router (config)# crypto ipsec client ezvpn client1Router (config-crypto-ezvpn)# ctcp port 10Related Commands
ctype
To preauthenticate calls on the basis of the call type, use the ctype command in AAA preauthentication configuration mode. To remove the ctype command from your configuration, use the no form of this command.
ctype [if-avail | required] [accept-stop] [password password] [digital | speech | v.110 | v.120]
no ctype [if-avail | required] [accept-stop] [password password] [digital | speech | v.110 | v.120]
Syntax Description
Defaults
The if-avail and required keywords are mutually exclusive. If the if-avail keyword is not configured, the preauthentication setting defaults to required.
The default password string is cisco.
Command Modes
AAA preauthentication configuration
Command History
Usage Guidelines
You may configure more than one of the AAA preauthentication commands (clid, ctype, dnis) to set conditions for preauthentication. The sequence of the command configuration decides the sequence of the preauthentication conditions. For example, if you configure dnis, then clid, then ctype, in this order, then this is the order of the conditions considered in the preauthentication process.
In addition to using the preauthentication commands to configure preauthentication on the Cisco router, you must set up the preauthentication profiles on the RADIUS server.
Set up the RADIUS preauthentication profile with the call type string as the username and with the password that is defined in the ctype command as the password. Table 37 shows the call types that you may use in the preauthentication profile.
Examples
The following example specifies that incoming calls be preauthenticated on the basis of the call type:
aaa preauthgroup radiusctype requiredRelated Commands
