Home
Support
Product Support
Routers
Cisco 8000 Series Routers
Configuration Guides

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Releases

How does SCEP automate the certificate enrollment process?
What is the role of a trustpoint when interacting with a CA?
What is the difference between PEM and DER encoded certificates?

View all Saved Content

PDF

Is this content helpful?

Helpful Unhelpful

Suggestions for Improvement

Thank you for your feedback. Your response has been recorded.

Ask about this content

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

How does SCEP automate the certificate enrollment process?
What is the role of a trustpoint when interacting with a CA?
What is the difference between PEM and DER encoded certificates?

Expand all sections

About this content

YANG Data Models for System Security Features

Using YANG Data Models

Trustworthy Systems

Trustworthy systems
Hardware trust
Software trust components
How trustworthiness works
Key security terms for trustworthy systems
TCG-compliant trusted platform module
ECC P256-based Secure Unique Device Identifiers

Maintaining Trust

Steady-state trust

AAA Access Model and Local User Administration

AAA service capabilities
User identities
AAA administrative models
Configure the first router user
Configure a task group

AAA Password Security and Authorization Policies

AAA password types
AAA password security for FIPS compliance
Task-based authorization
AAA method lists
Command accounting methods
Local command authorizations with user accounts
Configuration patterns for AAA services

RADIUS Server Configuration and Secure Transport

RADIUS protocol
RADIUS with DTLS protection
RADIUS with TLS protection
Router-to-RADIUS server communications
RADIUS dead-server detection features
RADIUS server groups
Per-VRF AAA for RADIUS

TACACS+ Services for AAA

Differentiated Services Code Point (DSCP) values for TACACS+ packets
TACACS+ servers
TACACS+ server groups
Per-VRF TACACS+ server groups
TACACS+ operational statistics
TACACS+ with TLS protection

CA Interoperability and Certificate Enrollment

Certification authority interoperability
Certification authority interoperability facts

CA Trust Pools and PKI Certificate Lifecycle

Certificate authority trust pools
PKI certificate expiry notifications
Automatic PKI certificate renewal

Crosswork Trust Insights and Public-Key Systems

How Cisco IOS XR and Crosswork Trust Insights integrate
Ed25519 public-key signatures
Public key-pairs

Keychain Management

Keychains

MACsec using EAP-TLS Authentication

MACsec EAP-TLS authentication sessions

uRPF Source Address Validation

uRPF source validation mechanisms

Type 6 Password Encryption

Type 6 password encryption

Management Plane Protection

Management plane protection features

Secure Shell Fundamentals and Configuration

Secure Shell fundamentals
CiscoSSH
Requirements for Secure Shell
Secure Shell restrictions
Configure an SSH server
NETCONF access controls
Automatic generation of SSH host keys
Configure an SSH client
SSH client authentication order
SSH multichannel connections
Configure an OpenSSH client for multiplexing

Certificate and Public-Key Authentication for SSH

SSH certificate and public-key authentication
X.509v3 certificate authentication
OpenSSH certificate authentication
TACACS+ authorization for OpenSSH certificate users
Public-key authentication for SSH clients
Public-key authentication to SSH servers

SSH Access and Connection Management

SSH access and connection controls
FIDO2 authentication for SSH
SSH authentication attempt limits
Multifactor authentication for SSH
Selective SSH server authentication methods
SSH port forwarding
DSCP marking for SSH packets
SSH server timeouts

FIPS Mode and Cryptographic Services

FIPS mode
FIPS-compliant cryptographic keys
Cryptographic services in FIPS mode
SSH clients and servers in FIPS mode

Implementing Secure Logging

System logging over Transport Layer Security (TLS)
Security template framework for TLS applications
TLS RFC 5289 compliance for security template

802.1X and MAC-Based Port Authentication

Port-based authentication methods
802.1X authentication with MAC Authentication Bypass fallback
RADIUS Change of Authorization for 802.1X and MAB sessions

Device Ownership and Authorized Operations

Trusted ownership and authorized operations
Device ownership
Cisco MASA service
How routers are provisioned using ownership vouchers
Third-party key packages
Consent tokens

Implementing Lawful Intercept

Lawful intercept
LI package installation and removal
SNMPv3 access for lawful intercept
Additional lawful intercept information

EST Protocol for Automated Certificate Provisioning

EST protocol for automated certificate provisioning
EST protocol configuration guidelines and limitations
Certificate types and their uses in the EST protocol
Trust anchor databases and their uses in the EST protocol
EST message types
Configure the EST protocol

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

CA Interoperability and Certificate Enrollment

Updated: September 18, 2026

Explains CA interoperability concepts and certificate enrollment processes, covering configuration requirements, enrollment methods, and operational workflows for managing digital certificates across integrated systems.

Certification authority interoperability

Describes how CA interoperability enables communication between certification authorities, outlining configuration steps, supported protocols, and trust establishment to facilitate secure certificate management in multi-CA environments.

Certification authority interoperability facts

Lists key facts, examples, and lookup details for certification authority interoperability to help you verify and plan certificate deployments.

Need help?

Open a support case

(Requires a Cisco Service Contract)

Bias-free language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.