The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
The HTTPS--HTTP Server and Client with SSL 3.0 feature provides Secure Socket Layer (SSL) version 3.0 support for the HTTP 1.1 server and HTTP 1.1 client within Cisco IOS XE software. SSL provides server authentication, encryption, and message integrity to allow secure HTTP communications. SSL also provides HTTP client authentication. HTTP over SSL is abbreviated as HTTPS.
Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
To configure the HTTP with SSL 3.0 (HTTPS) feature, you should understand the following concepts:
A secure HTTP connection means that data sent to and received from an HTTP server are encrypted before being sent out over the Internet. HTTP with SSL encryption provides a secure connection to allow such functions as configuring a router from a web browser. Cisco’s implementation of the secure HTTP server and secure HTTP client uses an implementation of the SSL version 3.0. Application layer encryption provides an alternative to older methods such as having to set up a tunnel to the HTTP server for remote management. HTTP over SSL is abbreviated as HTTPS; the URL of a secure connection will begin with https:// instead of http://.
The Cisco IOS XE HTTP secure server’s primary role is to listen for HTTPS requests on a designated port (the default HTTPS port is 443) and to pass the request to the HTTP 1.1 web server. The HTTP 1.1 server processes requests and passes responses (served pages) back to the HTTP secure server, which, in turn, responds to the original request.
The Cisco IOS XE HTTP secure client’s primary role is to respond to Cisco IOS XE application requests for HTTPS User Agent services, perform HTTPS User Agent services on the application’s behalf, and pass the response back to the application.
Certificate authorities (CAs) are responsible for managing certificate requests and issuing certificates to participating IPSec network devices. These services provide centralized security key and certificate management for the participating devices. Specific CA servers are referred to as “trustpoints.”
The HTTPS server provides a secure connection by providing a certified X.509v3 certificate to the client when a connection attempt is made. The certified X.509v3 certificate is obtained from a specified CA trustpoint. The client (usually a web browser), in turn, has a public key that allows it to authenticate the certificate.
Configuring a CA trustpoint is highly recommended for secure HTTP connections. However, if a CA trustpoint is not configured for the routing device running the HTTPS server, the server will certify itself and generate the needed RSA key pair. Because a self-certified (self-signed) certificate does not provide adequate security, the connecting client will generate a notification that the certificate is self-certified, and the user will have the opportunity to accept or reject the connection. This option is available for internal network topologies (such as testing).
The HTTPS--HTTP Server and Client with SSL 3.0 feature also provides an optional command (ip http secure-client-auth) that, when enabled, has the HTTPS server request an X.509v3 certificate from the client. Authenticating the client provides more security than server authentication by itself.
For additional information on certificate authorities, see the “Configuring Certification Authority Interoperability” chapter in the Cisco IOS XE Security Configuration Guide .
A CipherSuite specifies the encryption algorithm and digest algorithm to use on an SSL connection. Web browsers offer a list of supported CipherSuites when connecting to the HTTPS server, and the client and server will negotiate the best encryption algorithm to use from those that are supported by both. For example, Netscape Communicator 4.76 supports U.S. security with RSA Public Key Cryptography, MD2, MD5, RC2-CBC, RC4, DES-CBC, and DES-EDE3-CBC.
For the best possible encryption, you should use a browser that supports 128-bit encryption, such as Microsoft Internet Explorer version 5.5 (or later), or Netscape Communicator version 4.76 (or later). The SSL_RSA_WITH_DES_CBC_SHA CipherSuite provides less security than the other CipherSuites, because it does not offer 128-bit encryption.
In terms of router processing load (speed), the following list ranks the CipherSuites from fastest to slowest (slightly more processing time is required for the more secure and more complex CipherSuites):
SSL_RSA_WITH_DES_CBC_SHA
SSL_RSA_WITH_RC4_128_MD5
SSL_RSA_WITH_RC4_128_SHA
SSL_RSA_WITH_3DES_EDE_CBC_SHA
Configuring a CA trustpoint is highly recommended for secure HTTP connections. The certified X.509v3 certificate for the secure HTTP server (or client) is obtained from the specified CA trustpoint. If you do not declare a CA trustpoint, then a self-signed certificate will be used for secure HTTP connections. The self-signed certificate is generated automatically.
1.
enable
2.
configure
terminal
3.
hostname
name
4.
ip
domain-name
name
5.
crypto
key
generate
rsa
usage-keys
6.
crypto
ca
trustpoint
name
7.
enrollment
url
url
8.
enrollment
http-proxy
host-name
port-number
9.
crl
{query
url |
optional |
best-effort}
10.
primary
11.
exit
12.
crypto
ca
authenticate
name
13.
crypto
ca
enrollment
name
14.
Do one of the
following:
To disable the standard HTTP server and configure the HTTPS server with SSL 3.0, complete the procedure in this section.
If a certificate authority is to be used for certification, you should declare the CA trustpoint on the routing device before enabling the secure HTTP server.
1.
enable
2. Device# show ip http server status
3.
configure
terminal
4.
no
ip
http
server
5.
ip
http
secure-server
6.
ip
http
secure-port
port-number
7.
ip
http
secure-ciphersuite
[3des-ede-cbc-sha] [rc4-128-sha] [rc4-128-md5] [des-cbc-sha]
8.
ip
http
secure-client-auth
9.
ip
http
secure-trustpoint
name
10.
end
11.
show
ip
http
server
secure
status
| Command or Action | Purpose | |||
|---|---|---|---|---|
| Step 1 |
enable
Example: Device> enable |
Enables privileged EXEC mode. | ||
| Step 2 | Device#
show
ip
http
server
status
Example: Device# show ip http server status Example: |
(Optional) Displays the status of the HTTP server.
| ||
| Step 3 |
configure
terminal
Example: Device# configure terminal |
Enters global configuration mode. | ||
| Step 4 |
no
ip
http
server
Example: Device(config)# no ip http server |
Disables the standard HTTP server.
| ||
| Step 5 |
ip
http
secure-server
Example: Device(config)# ip http secure-server |
Enables the HTTPS server. | ||
| Step 6 |
ip
http
secure-port
port-number
Example: Device(config)# ip http secure-port 1025 |
(Optional) Specifies the port number that should be used for the HTTPS server. The default port number is 443. Valid options are 443 or any number in the range 1025 to 65535. | ||
| Step 7 |
ip
http
secure-ciphersuite
[3des-ede-cbc-sha] [rc4-128-sha] [rc4-128-md5] [des-cbc-sha]
Example: Device(config)# ip http secure-ciphersuite rc4-128-sha rc4-128-md5 |
(Optional) Specifies the CipherSuites (encryption algorithms) that should be used for encryption over the HTTPS connection.
| ||
| Step 8 |
ip
http
secure-client-auth
Example: Device(config)# ip http secure-client-auth |
(Optional) Configures the HTTP server to request an X.509v3 certificate from the client in order to authenticate the client during the connection process.
| ||
| Step 9 |
ip
http
secure-trustpoint
name
Example: Device(config)# ip http secure-trustpoint trustpoint-01 |
Specifies the CA trustpoint that should be used to obtain an X.509v3 security certificate and to authenticate the connecting client’s certificate.
| ||
| Step 10 |
end
Example: Device(config)# end |
Ends the current configuration session and returns you to privileged EXEC mode. | ||
| Step 11 |
show
ip
http
server
secure
status
Example: Device# show ip http server secure status |
Displays the status of the HTTP secure server configuration. |
To verify the configuration of the HTTPS server, connect to the router running the HTTPS server with a web browser by entering https://url , where url is the IP address or hostname of the router. Successful connection using the https prefix (instead of the standard http) indicates that the HTTPS server is configured properly. If a port other than the default port is configured (using the ip http secure-port command), you must also specify the port number after the URL. For example:
https://209.165.202.129:1026
or
https://host.domain.com:1026
Generally, you can verify that the HTTPS server is configured and that you have a secure connection by locating an image of a padlock at the bottom of your browser window. Also note that secure HTTP connections have a URL that starts with “https:” instead of “http:”.
The configuration of the standard HTTP server applies to the secure HTTP server as well. To provide additional security and efficiency to both the standard HTTP server and the HTTPS server, complete the procedure in this section.
1.
enable
2.
configure
terminal
3.
ip
http
path
path-name
4.
ip
http
access-class
access-list-number
5.
ip
http
max-connections
value
6.
ip
http
timeout-policy
idle
seconds
life
seconds
requests
value
| Command or Action | Purpose | |
|---|---|---|
| Step 1 |
enable
Example: Device> enable |
Enables privileged EXEC mode. |
| Step 2 |
configure
terminal
Example: Device# configure terminal |
Enters global configuration mode. |
| Step 3 |
ip
http
path
path-name
Example: Device(config)# ip http path slot1: |
(Optional) Sets the base HTTP path for HTML files.
|
| Step 4 |
ip
http
access-class
access-list-number
Example: Device(config)# ip http access-class 20 |
(Optional) Specifies the access list that should be used to allow access to the HTTP server. |
| Step 5 |
ip
http
max-connections
value
Example: Device(config)# ip http max-connections 10 |
(Optional) Sets the maximum number of concurrent connections to the HTTP server that will be allowed. The default value is 5. |
| Step 6 |
ip
http
timeout-policy
idle
seconds
life
seconds
requests
value
Example: Device(config)# ip http timeout-policy idle 30 life 120 requests 100 |
(Optional) Sets the characteristics that determine how long a connection to the HTTP server should remain open. The characteristics are:
|
To configure the HTTPS client with SSL 3.0, complete the procedure in this section.
The standard HTTP client and the secure HTTP client are always enabled.
A certificate authority is required for secure HTTP client certification; the following steps assume that you have previously declared a CA trustpoint on the routing device. If a CA trustpoint is not configured, and the remote HTTPS server requires client authentication, connections to the secure HTTP client will fail.
1.
enable
2.
configure
terminal
3.
ip
http
client
secure-trustpoint
trustpoint-name
4.
ip
http
client
secure-ciphersuite
[3des-ede-cbc-sha] [rc4-128-sha] [rc4-128-md5] [des-cbc-sha]
5.
end
6.
show
ip
http
client
secure
status
| Command or Action | Purpose | |
|---|---|---|
| Step 1 |
enable
Example: Device> enable |
Enables privileged EXEC mode. |
| Step 2 |
configure
terminal
Example: Device# configure terminal |
Enters global configuration mode. |
| Step 3 |
ip
http
client
secure-trustpoint
trustpoint-name
Example: Device(config)# ip http client secure-trustpoint trustpoint01 |
(Optional) Specifies the CA trustpoint that should be used if the remote HTTP server requests client authentication.
|
| Step 4 |
ip
http
client
secure-ciphersuite
[3des-ede-cbc-sha] [rc4-128-sha] [rc4-128-md5] [des-cbc-sha]
Example: Device(config)# ip http client secure-ciphersuite rc4-128-sha rc4-128-md5 |
(Optional) Specifies the CipherSuites (encryption algorithms) that should be used for encryption over the HTTPS connection.
|
| Step 5 |
end
Example: Device(config)# end |
Ends the current configuration session and returns to privileged EXEC mode. |
| Step 6 |
show
ip
http
client
secure
status
Example: Device# show ip http client secure status |
Displays the status of the HTTP secure server configuration. |
The following example shows a configuration session in which the secure HTTP server is enabled, the port for the secure HTTP server is configured as 1025, and the remote CA trustpoint server “CA-trust-local” is used for certification.
Device# show ip http server status HTTP server status: Disabled HTTP server port: 80 HTTP server authentication method: enable HTTP server access class: 0 HTTP server base path: Maximum number of concurrent server connections allowed: 5 Server idle time-out: 600 seconds Server life time-out: 600 seconds Maximum number of requests allowed on a connection: 1 HTTP secure server capability: Present HTTP secure server status: Disabled HTTP secure server port: 443 HTTP secure server ciphersuite: 3des-ede-cbc-sha des-cbc-sha rc4-128-md5 rc4-12a HTTP secure server client authentication: Disabled HTTP secure server trustpoint: Device# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Device(config)# ip http secure-server Device(config)# ip http client secure-trustpoint CA-trust-local Device(config)# ip http secure-port 1024 Invalid secure port value. Device(config)# ip http secure-port 1025 Device(config)# ip http secure-ciphersuite rc4-128-sha rc4-128-md5 Device(config)# end
Device# show ip http server secure status
HTTP secure server status: Enabled
HTTP secure server port: 1025
HTTP secure server ciphersuite: rc4-128-md5 rc4-128-sha
HTTP secure server client authentication: Disabled
HTTP secure server trustpoint: CA-trust-local
In the following example, the CA trustpoint CA-trust-local is specified, and the HTTPS client is configured to use this trustpoint for client authentication requests:
Device# config terminal Enter configuration commands, one per line. End with CNTL/Z. Device(config)# crypto ca trustpoint CA-trust-local Device(ca-trustpoint)# enrollment url http://example.com Device(ca-trustpoint)# crl query ldap://example.com Device(ca-trustpoint)# primary Device(ca-trustpoint)# exit Device(config)# ip http client secure-trustpoint CA-trust-local Device(config)# end Device# copy running-config startup-config
The following sections provide references related to the HTTPS--HTTP Server and Client with SSL 3.0 feature.
|
Related Topic |
Document Title |
|---|---|
|
SSL 3.0 |
The SSL Protocol Version 3.0 This document is available from various sources online. |
|
Standard Cisco Web Client |
HTTP 1.1 Web Client |
|
Standard Cisco Web Server |
HTTP 1.1 Web Server |
|
Certification Authority Interoperability |
|
|
Standard |
Title |
|---|---|
|
No new or modified standards are supported by this feature. |
-- |
|
MIBs |
MIBs Link |
|---|---|
|
To locate and download MIBs for selected platforms, Cisco IOS XE releases, and feature sets, use Cisco MIB Locator found at the following URL: |
|
RFCs |
Description |
|---|---|
|
RFC 2616 |
Cisco’s implementation of HTTP is based on RFC 2616: Hypertext Transfer Protocol -- HTTP/1.1 . |
|
Description |
Link |
|---|---|
|
The Cisco Support website provides extensive online resources, including documentation and tools for troubleshooting and resolving technical issues with Cisco products and technologies. To receive security and technical information about your products, you can subscribe to various services, such as the Product Alert Tool (accessed from Field Notices), the Cisco Technical Services Newsletter, and Really Simple Syndication (RSS) Feeds. Access to most tools on the Cisco Support website requires a Cisco.com user ID and password. |
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.|
Feature Name |
Releases |
Feature Information |
|---|---|---|
|
HTTPS--HTTP Server and Client with SSL 3.0 |
Cisco IOS XE Release 2.1 |
This feature provides Secure Socket Layer (SSL) version 3.0 support for the HTTP 1.1 server and HTTP 1.1 client within Cisco IOS XE software. SSL provides server authentication, encryption, and message integrity to allow secure HTTP communications. SSL also provides HTTP client authentication. This feature is supported only in Cisco software images that support SSL. Specifically, SSL is supported in “IPSec 56” and “IPSec 3DES” images (contains “k8” or “k9” in the image name). The following commands are introduced or modified in the feature or features documented in this module.
|
RSA--RSA is a widely used Internet encryption and authentication system that uses public and private keys for encryption and decryption. The RSA algorithm was invented in 1978 by Ron Rivest, Adi Shamir, and Leonard Adleman. The abbreviation RSA comes from the first letter of the last names of the three original developers. The RSA algorithm is included in many applications, such as the web browsers from Microsoft and Netscape. The RSA encryption system is owned by RSA Security.
SHA --The Secure Hash Algorithm. SHA was developed by NIST and is specified in the Secure Hash Standard (SHS, FIPS 180). Often used as an alternative to Digest 5 algorithm.
signatures, digital--In the context of SSL, “signing” means to encrypt with a private key. In digital signing, one-way hash functions are used as input for a signing algorithm. In RSA signing, a 36-byte structure of two hashes (one SHA and one MD5) is signed (encrypted with the private key).
SSL 3.0--Secure Socket Layer version 3.0. SSL is a security protocol that provides communications privacy over the Internet. The protocol allows client and server applications to communicate in a way that is designed to prevent eavesdropping, tampering, or message forgery. SSL uses a program layer located between the Internet’s HTTP and TCP layers. SSL is included as part of most web server products and as part of most Internet browsers.
Feedback