System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Certification authority interoperability

Updated: September 18, 2026

Want to summarize with AI?

Describes how CA interoperability enables communication between certification authorities, outlining configuration steps, supported protocols, and trust establishment to facilitate secure certificate management in multi-CA environments.

A certification authority interoperability capability is a security feature that

enables Cisco IOS XR devices to use digital certificates for secure communication
supports certificate-based trust across IPSec, SSL, and SSH protocols, and
allows devices and certification authorities (CAs) to interact for efficient certificate management and scalable security.

Certification authority (CA) interoperability allows devices and CAs to communicate, permitting retrieval and use of digital certificates in network deployments. While IPSec can operate without a CA, using a CA improves manageability and scalability for IPSec.

Note

IPSec is not currently supported.

Requirement: You must meet certification authority prerequisites

To implement certificate authority (CA) interoperability successfully, you must meet the following requirements:

You must belong to a user group associated with a task group that includes the required task IDs. Command reference guides list the task IDs for each command. If your user group assignment prevents you from using a command, contact your AAA administrator for assistance.
You need to have a CA available to your network before you configure this interoperability feature. The CA must support Cisco Systems PKI protocol and the Simple Certificate Enrollment Protocol (SCEP), formerly called Certificate Enrollment Protocol (CEP).

How CA interoperability works

CA interoperability is essential for establishing secure identities and encrypted communications between network devices and external systems. By integrating with certificate authorities, Cisco IOS XR devices can obtain, validate, and manage certificates required for security protocols such as IPsec and SSL. Administrators must follow a defined process to ensure each device is properly authenticated and authorized to participate in secure networking.

Summary

The key components involved in the process are:

Router: Initiates CA operations and interacts with certificate authorities to request and manage certificates.
Certificate Authority (CA): Issues and manages digital certificates, validating requests and ensuring authenticity.
Administrator: Configures device settings for CA interactions, including certificate requests and trustpoint configuration.

Certificate authority (CA) interoperability in Cisco IOS XR allows network devices to manage secure communications by interacting with external CAs to issue, authenticate, and manage digital certificates.

Workflow

These stages describe how CA interoperability works.

Configure the router hostname and IP domain name: The administrator sets the router identity required for certificate requests.
Generate RSA key pairs: The router creates cryptographic keys for secure certificate transactions.
Import public key to the router: The administrator loads the public key from the CA onto the router.
Declare certification authority and configure trustpoint: The administrator defines the CA as a trusted source.
Authenticate the CA: The router validates the CA credentials.
Request device certificates: The router sends a certificate signing request (CSR) to the CA to obtain its own certificate.
Configure certificate enrollment using cut-and-paste: The administrator can manually enroll certificates if automated enrollment is unavailable.
Save or discard configuration changes:
- The administrator can:
  - Save and commit changes to exit the configuration session.
  - Exit without saving changes.
  - Cancel and remain in the session without committing changes.
Digitally sign IKE key management messages: The router uses issued certificates to authenticate and ensure the integrity of IKE communications.

Result

The CA interoperability process enables secure certificate management and authentication in Cisco IOS XR, ensuring trusted communication across network devices.

Configure the router hostname and IP domain name

Assign a hostname and IP domain name to the router, enabling it to generate a fully qualified domain name (FQDN) for keys and certificates used in IPSec.

Routers require both a hostname and an IP domain name to generate FQDNs for IPSec keys and certificates. For example, a certificate named router20.example.com is created when the router's hostname is set to router20 and its IP domain name is set to example.com.

Before you begin

Review certificate authority prerequisites.

Procedure

Enter global configuration mode.
Example:
```
Router# configure
```
Enters global configuration mode.
Configure the router hostname.
Example:
```
Router(config)# hostname myhost
```
Configures the hostname of the router.
Configure the IP domain name.
Example:
```
Router(config)# domain name mydomain.com
```
Configures the IP domain name of the router.
Save or discard the configuration changes.
Example:
```
commit
end
```
Use one of these options:
- Commit: Saves the configuration changes and remains within the configuration session.
- End: Prompts you to save, discard, or cancel the configuration changes before leaving the configuration session.
- Yes: Saves configuration changes and exits the configuration session.
- No: Exits the configuration session without committing the configuration changes.
- Cancel: Remains in the configuration session without committing the configuration changes.

The router's hostname and IP domain name are configured. You can verify successful configuration by checking the output against the provided examples and confirming intended certificate authority interoperability behavior.

RSA key pairs

A set of RSA key pairs is a certificate authority interoperability component that

enables both digital signing and encryption, securing IKE key management messages
acts as a required prerequisite for obtaining a digital certificate for the router, and
supports compliance with current cryptographic security standards by enforcing minimum key sizes and removal of weak or deprecated keys.

RSA key pairs play a crucial role in securing IKE key management messages by enabling digital signing and encryption. Their use is required before a certificate can be obtained for your router.

Specifically, RSA key pairs:

digitally sign IKE key management messages, ensuring their authenticity and integrity,
encrypt IKE key management messages, protecting sensitive information from unauthorized access, and
satisfy prerequisites for obtaining a digital certificate for the router, which further enhances security in network communications.

Feature history

Table 1. Feature History Table
Feature Name	Release Information	Feature Description
Syslog warnings for RSA keys and DSA keys	Release 26.1.1	Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100, K100], 8010 [ASIC: A100])(select variants only); Modular Systems (8800 [LC ASIC: P100])(select variants only) This enhancement ensures Cisco IOS XR devices remain compliant with evolving security standards. During system reboot, the device now sends syslog warnings if weak SSH host keys are detected—specifically, RSA keys less than 3072 bits or any DSA keys. Additionally, the default RSA key size has been increased from 2048 to 3072 bits to further strengthen security. This feature introduces these changes: CLI: . The crypto key generate rsa command has been modified. The crypto key generate dsa command has been modified. The show crypto key mypubkey rsa command has been modified.
RSA and DSA Keys Available in Running Configuration	Release 25.4.1	Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only) This feature is supported on: 8011-32Y8L2H2FH 8011-12G12X4Y-A/D
RSA and DSA Keys Available in Running Configuration	Release 25.1.1	Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100])(select variants only) This feature is supported on: 8712-MOD-M 8011-4G24Y4H-I
RSA and DSA Keys Available in Running Configuration	Release 24.4.1	Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100])(select variants only); Modular Systems (8800 [LC ASIC: P100])(select variants only) *This feature is supported on: 8212-48FH-M 8711-32FH-M 88-LC1-36EH 88-LC1-12TH24FH-E 88-LC1-52Y8H-EM
RSA and DSA Keys Available in Running Configuration	Release 7.3.4	You can now view the RSA and DSA keys in the running configuration by using the show running-configuration command.

Syslog warnings for RSA keys and DSA key

Starting with Cisco IOS XR Release 26.1.1, the default RSA key size is 3072 bits. The system triggers a syslog warning during boot if a SSH host RSA key is less than 3072 bits. DSA keys are no longer auto-generated at boot, and their presence prompts a syslog warning for removal. These changes ensure compliance with cryptographic security standards and bolster device protection against new threats.

Configure RSA key pairs

Enable secure communications by generating, labeling, and verifying RSA key pairs as required by certificate authority interoperability.

RSA key pairs are used for authentication and encryption. Cisco routers often auto-generate RSA keys during boot-up. However, manual configuration is required when specific key pairs are needed or existing keys must be changed or deleted. RSA key details are visible in the running configuration.

Before you begin

Review certificate authority prerequisites relevant to your environment.
Confirm you understand the implications of deleting or regenerating keys, especially if keys have been compromised.

Procedure

Renerate an RSA key pair.

This step is requied only iff the RSA key pair is missing after router boot-up.
Example:
```
Router# crypto key generate rsa general-keys
```
From Cisco IOS XR Release 7.3.2 onwards, you can configure this command from XR Config mode.

To delete the RSA keys, use the no form: no crypto key generate rsa
Delete a specific RSA key pair or all RSA keys.

For example, if key compromise is suspected or the keys should no longer be used).
Example:
```
Router# crypto key zeroize rsa key1
```
The keypair-label argument is the RSA key pair label that names the RSA key pairs.

You can run the crypto key zeroize command only in the exec mode.
- In some situations, where you believe that the RSA keys were compromised in some way or the RSA keys should no longer be used, you should delete all the RSA keys from you router using the rypto key zeroize rsa command.
- To remove a specific RSA key pair, use the keypair-label argument.
- From Cisco IOS XR Release 7.3.2 onwards, you can delete key-pairs with the no form of the command from XR Config mode.

Use the show crypto key mypubkey rsa command to view the key details.

Keys generated in config mode are visible in the running configuration.

Example:

Router# show crypto key mypubkey rsa
Fri Mar 27 14:00:20.954 IST
Key label: the_default
Type : RSA General purpose
Size : 3072
Created : 01:13:10 IST Thu Feb 06 2025
Data :
 30820122 300D0609 2A864886 F70D0101 01050003 82010F00 3082010A 02820101
 00A93DE0 1E485EE3 0E7F0964 C48361D1 B6014BE7 A303D8D6 F7790E92 88E69C4B
 B97B7A9C D1B277E3 1569093C 82BD3258 7F67FB49 94860ECD 34498F1F 59B45757
 F32C8E8F 7CEE23EC C36A43D1 9F85C0D9 B96A14DD DD3BBD4C A1FB0888 EED210A7
 39D9A403 7ACE0F6E 39107226 CA621AD8 6E8102CA 9761B86F D33F2871 9DD16559
 AFCB4729 EFCEDBAF 83DF76E4 9A439844 EE3B1180 4022F575 99E11A2C E25BB23D
 9DD74C81 4E5C1345 D9E3CC79 1B98B1AA 6C06F004 22B901EC 36C099FE 10DE2622
 EB7CE618 9A555769 12D94C90 D9BEE5EA A664E7F6 4DF8D8D4 FE7EAB07 1EF4FEAB
 22D9E55F 62BA66A0 72153CEC 81F2639F B5F2B5C5 25E10364 19387C6B E8DB8990
 11020301 0001

The keys in this example are in OpenSSL format. Only those keys that are generated in the config mode are visible in the running configuration.

Your router is configured with the required RSA key pairs. You can confirm RSA key presence and validity using the verification command output.

Import a public key to a router

Import a public RSA key to your router for user authentication and certificate authority interoperability.

This task demonstrates how to import a public key to a router to authenticate users and establish a secure relationship with a certificate authority.

Before you begin

Review all prerequisites required by your certificate authority.
Make sure you have the public RSA key to be imported.

Procedure

Import the public key to the router.
Example:
```
Router# crypto key import authentication rsa general-keys
```
Generates RSA key pairs.
- Use the usage keys keyword to specify special usage keys; use the general-keys keyword to specify general- purpose RSA keys.
- The keypair-label argument is the RSA key pair label that names the RSA key pairs.

Verify the imported key configuration.

Example:

Router# show crypto key mypubkey rsa
Fri Mar 27 14:00:20.954 IST
Key label: system-root-key
Type : RSA General purpose
Size : 2048
Created : 01:13:10 IST Thu Feb 06 2020
Data :
 30820122 300D0609 2A864886 F70D0101 01050003 82010F00 3082010A 02820101
 00A93DE0 1E485EE3 0E7F0964 C48361D1 B6014BE7 A303D8D6 F7790E92 88E69C4B
 B97B7A9C D1B277E3 1569093C 82BD3258 7F67FB49 94860ECD 34498F1F 59B45757
 F32C8E8F 7CEE23EC C36A43D1 9F85C0D9 B96A14DD DD3BBD4C A1FB0888 EED210A7
 39D9A403 7ACE0F6E 39107226 CA621AD8 6E8102CA 9761B86F D33F2871 9DD16559
 AFCB4729 EFCEDBAF 83DF76E4 9A439844 EE3B1180 4022F575 99E11A2C E25BB23D
 9DD74C81 4E5C1345 D9E3CC79 1B98B1AA 6C06F004 22B901EC 36C099FE 10DE2622
 EB7CE618 9A555769 12D94C90 D9BEE5EA A664E7F6 4DF8D8D4 FE7EAB07 1EF4FEAB
 22D9E55F 62BA66A0 72153CEC 81F2639F B5F2B5C5 25E10364 19387C6B E8DB8990
 11020301 0001
Key label: system-enroll-key
Type : RSA General purpose
Size : 2048
Created : 01:13:16 IST Thu Feb 06 2020
Data :
 30820122 300D0609 2A864886 F70D0101 01050003 82010F00 3082010A 02820101
 009DBC14 C83604E4 EB3D3CF8 5BA7FDDB 80F7E85B 427332D8 BBF80148 F0A9C281
 49F87D5C 0CEBA532 EBE797C5 7F174C69 0735D13A 493670CB 63B04A12 4BCA7134
 EE0031E9 047CAA1E 802030C5 6071E8C2 F8ECE002 CC3B54E7 5FD24E5C 61B7B7B0
 68FA2EFA 0B83799F 77AE4621 435D9DFF 1D713108 37B614D3 255020F9 09CD32E8
 82B07CD7 01A53896 6DD92B5D 5119597C 98D394E9 DBD1ABAF 6DE949FE 4A8BF1E7
 851EB3F4 60B1114A 1456723E 063E50C4 2D410906 BDB7590B F1D58480 F3FA911A
 6C9CD02A 58E68D04 E94C098F 0F0E81DB 76B40C55 64603499 2AC0547A D652412A
 BCBBF69F 76B351EE 9B2DF79D E490C0F6 92D1BB97 B905F33B FAB53C20 DDE2BB22
 C7020301 0001

(Optional) Displays the RSA public keys for your router.

The show running-config command also displays the RSA keys. The keys in the following example are in OpenSSL format.

Note

Only those keys that are generated in the config mode are visible in the running configuration.

The router will have the imported public RSA key available for authentication and certificate authority interoperability. Successful configuration is confirmed when the verification output matches the example data.

Configure CA trustpoints

Set up a certificate authority (CA) trustpoint on the router so it can verify peer certificates for secure communication.

This task establishes a trusted CA by configuring trustpoint parameters, setting enrollment methods, and defining certificate request behavior.

Before you begin

Review the prerequisites for your specific certificate authority system.
Ensure you have access to all required URLs and configuration information.

Procedure

Create the CA trustpoint with a specific name.
Example:
```
Router# configure
Router(config)# crypto ca trustpoint myca
```
Declares a CA.
- Configures a trusted point with a selected name so that your router can verify certificates issued to peers.
- Enters trustpoint configuration mode.
Specify the enrollment method by setting the CA URL.
Example:
```
Router(config-trustp)# enrollment url http://ca.domain.com/certsrv/mscep/mscep.dll
```
Specifies the URL of the CA.
- The URL should include any nonstandard cgi-bin script location.
(Optional) Configure an LDAP query URL
Example:
```
Router(config-trustp)# query url ldap://my-ldap.domain.com
```
Specifies the location of the LDAP server if your CA system supports the LDAP protocol.
(Optional) Set certificate request retry parameters.
Example:
```
Router(config-trustp)# enrollment retry period 2
```
Example:
```
Router(config-trustp)# enrollment retry count 10
```
Specifies a retry period and retry count.
- After requesting a certificate, the router waits to receive a certificate from the CA. If the router does not receive a certificate within a period of time (the retry period) the router will send another certificate request.
- Range is from 1 to 60 minutes. Default is 1 minute.
(Optional) Specify a named RSA key pair for this trustpoint.
Example:
```
Router(config-trustp)# rsakeypair mykey
```
Specifies a named RSA key pair generated using the crypto key generate rsa command for this trustpoint.
- Not setting this key pair means that the trustpoint uses the default RSA key in the current configuration.
Save or discard the configuration changes.
Example:
```
commit
end
```
Use one of these options:
- Commit: Saves the configuration changes and remains within the configuration session.
- End: Prompts you to save, discard, or cancel the configuration changes before leaving the configuration session.
- Yes: Saves configuration changes and exits the configuration session.
- No: Exits the configuration session without committing the configuration changes.
- Cancel: Remains in the configuration session without committing the configuration changes.

The CA trustpoint is configured when your verification output matches the source example, confirming certificate authority interoperability.

Configure CA authentication

Establish trust between your router and the certificate authority by authenticating the CA certificate.

This task enables your router to authenticate the certificate authority (CA) by obtaining and verifying the CA's self-signed certificate, which contains the CA's public key. Manual authentication is required by comparing the fingerprint of the CA certificate with information provided by the CA administrator.

Before you begin

Review the certificate authority prerequisites for your router.

Procedure

Authenticate the certification authority.
Example:
```
Router# crypto ca authenticate myca
```
Authenticates the CA to your router by obtaining a CA certificate, which contains the public key for the CA.
Verify the configuration or operational state.
Example:
```
Router# show crypto ca certificates
```
(Optional) Displays information about the CA certificate.

The task is complete when the configuration and verification output matches the expected source examples.

Multi-tier certification authorities

A multi-tier certification authority is a certificate authority interoperability component that

supports certificate-based trust in Cisco IOS XR deployments
allows importing a complete CA hierarchy (from the Root CA to subordinate CAs) as part of terminal-based enrollment, and
provides flexibility and security by enabling use of a certificate chain (including Root and subordinate CAs) for trustpoint authentication.

Terminal-based enrollment: During terminal-based enrollment of a CA trustpoint, Cisco IOS XR network devices initially accepted only Root CA certificates. However, some network topologies use a multi-tier CA hierarchy, offering more flexibility and security. From Cisco IOS XR Software Release 7.10.1 and later, you can import a complete CA hierarchy—spanning the Root CA to the subordinate CA that issues the certificate—in a single authentication request. This includes providing the certificate chain (Root CA and all intermediate subordinate CAs) as part of the terminal-based enrollment process. This is especially useful when an existing CA hierarchy issues router certificates from a subordinate CA rather than the root.
CA tiering limit: You can have a maximum of 8 tiers—a chain of CA consisting of one Root CA and up to seven subordinate CAs—for trustpoint authentication.

Feature history

Table 2. Feature History Table
Feature Name	Release Information	Feature Description
Multi-Tier Certificate Authority for Trustpoint Authentication	Release 25.4.1	Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only) This feature is supported on: 8011-32Y8L2H2FH 8011-12G12X4Y-A/D
Multi-Tier Certificate Authority for Trustpoint Authentication	Release 25.1.1	Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100])(select variants only) This feature is supported on: 8712-MOD-M 8011-4G24Y4H-I
Multi-Tier Certificate Authority for Trustpoint Authentication	Release 24.4.1	Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100])(select variants only); Modular Systems (8800 [LC ASIC: P100])(select variants only) *This feature is supported on: 8212-48FH-M 8711-32FH-M 88-LC1-36EH 88-LC1-12TH24FH-E 88-LC1-52Y8H-EM
Multi-Tier Certificate Authority for Trustpoint Authentication	Release 7.10.1	Apart from the root certificate authority (CA), you can now use a subordinate CA to issue certificates and authenticate your network devices. This feature is beneficial when you have an existing CA hierarchy where it is not the root CA but the subordinate CA that issues the leaf or router certificates. In earlier releases, you could associate only a single CA, not a multi-tier CA, to a trustpoint. And, you could use only the root CA certificate to enroll the router certificates. This feature modifies the show crypto ca certificates command to display the Trusted Certificate Chain field.

Configure multi-tier CA trustpoint authentication

Establish trustpoint authentication with a multi-tier certificate authority (CA) by configuring the required PEM-encoded certificates.

Multi-tier CA trustpoint authentication allows routers to establish secure connections using multiple certificates in a CA hierarchy. Only PEM-encoded certificates are accepted for this process.

Before you begin

Generate a key pair on the router.
Import the public key.
Configure a trustpoint as detailed in prior sections.

Procedure

Authenticate the trustpoint using multi-tier CA certificates.

Example:

Router# crypto ca authenticate test-ca
Mon Feb  6 08:17:48.943 UTC


Enter the base 64/PEM encoded certificate/certificates.
Please note: for multiple certificates use only PEM
End with a blank line or the word "quit" on a line by itself

-----BEGIN CERTIFICATE-----
MIIF5TCCA82gAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwXTELMAkGA1UEBhMCSU4x
CzAJBgNVBAgMAktBMQwwCgYDVQQHDANCR0wxDTALBgNVBAoMBENTQ08xDTALBgNV
.
.
.
/4UzeeX6ll0gGJVbDwGeIZTH00artqxHquKQ2P7eXQ1pg0PRNRqWN90SvT5yE33N
eHgbtvdHg1K6K6IAj/NGnd7xUrA1TQ4bdmouCNkgbXM/G9DwgkOOvZ8KYRP9JW57
LYIv2ZcRS2vdnZRD9JPGVig2EgcfVPtj+Q==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIF9TCCA92gAwIBAgIUD6AGesleqedhorkrJ9HWjz1RQzswDQYJKoZIhvcNAQEL
BQAwXTELMAkGA1UEBhMCSU4xCzAJBgNVBAgMAktBMQwwCgYDVQQHDANCR0wxDTAL
.
.
.
+6rMWd6BmfSy2PT3Qz5AjO2+3N1dd67qRRrX7skklkX4JXY42n5/l9PQtSp0wTBh
uy5yUAagynu0z07GczE7E9V+tJHRmNTbnd8pxLk4lTwqtiCIXwQLZA75SkwCS5wh
fn7OrV7uFjMaggNkvj0kSSOkWxqJ+j/KqMAA2zQMUV+qdvT6i+ZV44U=
-----END CERTIFICATE-----
Serial Number  : 10:01
  Subject:
	CN=SUB_CA_CERT,OU=SPBU,O=CSCO,L=BGL,ST=KA,C=IN
  Issued By      :
	CN=TWO-LEVEL-CA,OU=SPBU,O=CSCO,L=BGL,ST=KA,C=IN
  Validity Start : 12:31:40 UTC Sun Jun 14 2020
  Validity End   : 12:31:40 UTC Wed Jun 12 2030

  CRL Distribution Point
	http://10.105.236.78/crl_akshath_two_level_ca/crl.der
  SHA1 Fingerprint:
	 D8E0C11ECED96F67FDBC800DB6A126676A76BD62
  Serial Number  : 0F:A0:06:7A:C9:5E:A9:E7:61:A2:B9:2B:27:D1:D6:8F:3D:51:43:3B
  Subject:
	CN=TWO-LEVEL-CA,OU=SPBU,O=CSCO,L=BGL,ST=KA,C=IN
  Issued By      :
	CN=TWO-LEVEL-CA,OU=SPBU,O=CSCO,L=BGL,ST=KA,C=IN
  Validity Start : 13:12:32 UTC Sun Jun 07 2020
  Validity End   : 13:12:32 UTC Sat Jun 02 2040

  CRL Distribution Point
	http://10.105.236.78/crl_akshath_two_level_ca/crl.der
  SHA1 Fingerprint:
	 08E71248FB7578614442E713AC87C461D173952F

CA Certificate validated using issuer certificate.
Router#

Verify the configuration.

Example:

Router# show crypto ca certificates test-ca
Mon Feb  6 09:03:53.019 UTC

Trustpoint       : test-ca
==================================================
CA certificate
  Serial Number  : 10:01
  Subject:
            CN=SUB_CA_CERT,OU=SPBU,O=CSCO,L=BGL,ST=KA,C=IN
  Issued By      :
            CN=TWO-LEVEL-CA,OU=SPBU,O=CSCO,L=BGL,ST=KA,C=IN
  Validity Start : 12:31:40 UTC Sun Jun 14 2020
  Validity End   : 12:31:40 UTC Wed Jun 12 2030

  CRL Distribution Point
            http://10.105.236.78/crl_akshath_two_level_ca/crl.der
  SHA1 Fingerprint:
             D8E0C11ECED96F67FDBC800DB6A126676A76BD62
Trusted Certificate Chain
  Serial Number  : 0F:A0:06:7A:C9:5E:A9:E7:61:A2:B9:2B:27:D1:D6:8F:3D:51:43:3B
  Subject:
            CN=TWO-LEVEL-CA,OU=SPBU,O=CSCO,L=BGL,ST=KA,C=IN
  Issued By      :
            CN=TWO-LEVEL-CA,OU=SPBU,O=CSCO,L=BGL,ST=KA,C=IN
  Validity Start : 13:12:32 UTC Sun Jun 07 2020
  Validity End   : 13:12:32 UTC Sat Jun 02 2040

  CRL Distribution Point
            http://10.105.236.78/crl_akshath_two_level_ca/crl.der
  SHA1 Fingerprint:
             08E71248FB7578614442E713AC87C461D173952F
Router certificate
  Key usage      : General Purpose
  Status         : Available
  Serial Number  : 28:E5
  Subject:
            CN=test
  Issued By      :
            CN=SUB_CA_CERT,OU=SPBU,O=CSCO,L=BGL,ST=KA,C=IN
  Validity Start : 08:49:54 UTC Mon Feb 06 2023
  Validity End   : 08:49:54 UTC Wed Mar 08 2023
  SHA1 Fingerprint:
             6C8644FA67D9CEBC7C5665C35838265F578835AB
Associated Trustpoint: test-ca

Use the show crypto ca certificates trustpoint-name command to view the CA certificate chain. The command output displays the Trusted Certificate Chain field if there is one or more subordinate CAs involved in the hierarchy.

The router successfully authenticates the multi-tier CA trustpoint and validates the certificate chain. You can view the CA certificate chain using the show crypto ca certificates trustpoint-name command. The process is complete when all certificates are validated and associated with the configured trustpoint.

Obtain router certificates for your router

Request and verify certificates from a certificate authority (CA) for each router RSA key pair.

You must obtain a signed certificate for each RSA key pair on your router. If using general-purpose keys, only one certificate is needed. If using special usage keys, two certificates are required. These certificates establish trust between your router and the CA for secure communication.

Before you begin

Review all prerequisites outlined by your certificate authority.
Prepare the challenge password you will use for certificate revocation.

Procedure

Request the router certificate from the CA.
Example:
```
Router# crypto ca enroll myca
```
Requests certificates for all of your RSA key pairs.
- This command requests certificates for all existing RSA key pairs. Perform this command only once, even if you have multiple key pairs.
- You will be prompted to create a challenge password. This password is not saved with your configuration and is required if the certificate needs to be revoked. Remember it securely.
- A certificate may be issued immediately. If not, the router will resend the request every minute until the retry period expires. If a timeout occurs, contact your system administrator to approve your request and repeat the command.
Verify the configuration or operational state to ensure certificates were obtained.
Example:
```
Router# show crypto ca certificates
```
(Optional) Displays information about the CA certificate.

Your router certificates are successfully obtained and verified when the output matches the expected configuration example.

CA enrollment URLs

A CA enrollment URL is a certificate authority interoperability component that

serves as a web address allowing routers to connect with a Certification Authority (CA) for certificate enrollment and renewal
automates the process of obtaining digital certificates, minimizing manual intervention, and
reduces the risk of potential errors associated with manual certificate management.

Feature history

Table 3. Feature History Table
Feature Name	Release Information	Description
IPv6 support for CA enrollment URL	Release 26.2.1	Introduced in this release on: Centralized Systems (8400 [ASIC: K100])(select variants only) This feature is now supported on Cisco 8404-SYS-D routers.
IPv6 support for CA enrollment URL	Release 25.1.1	Introduced in this release on: Fixed Systems (8700 [ASIC: K100]) (select variants only) This feature is supported on Cisco 8712-MOD-M routers.
IPv6 support for CA enrollment URL	Release 24.4.1	Introduced in this release on: Fixed Systems (8200 [ASIC: Q200, P100], 8700 [ASIC: P100, K100]); Centralized Systems (8600 [ASIC:Q200]) ; Modular Systems (8800 [LC ASIC: Q100, Q200, P100]) You can enhance network compatibility and simplify management in modern network environments using IPv6 addresses and CA server URLs that resolve to IPv6 addresses as enrollment URLs for the CA hosted on IPv6-based servers. This improvement addresses previous limitations that caused configuration issues and failures when using IPv6 CA enrollment URL.

How CA enrollment URLs work

When a router needs to enroll for a new certificate or renew an existing one, the router sends a request to the enrollment URL. The requests sent to the enrollment URL typically include the device's identity information and its public key.
Upon receiving a request at the enrollment URL, the CA processes it to verify the identity of the requester. The verification involves checking the authenticity and validity of the information provided in the enrollment request.
After the validation is successful, the CA issues a digital certificate. This certificate is then sent back to the router through the enrollment URL.
The router then installs and use this certificate for secure communications.

Summary

The key components involved in the process are:

Router: Initiates a request to the enrollment URL to obtain or renew a digital certificate, providing device identity and a public key.
Certificate Authority (CA): Receives and processes enrollment requests, verifies identity, and issues digital certificates.
Enrollment URL: Serves as the endpoint through which routers communicate with the CA to exchange requests and certificates.

Certificate Authority (CA) enrollment URLs in Cisco IOS XR facilitate secure certificate acquisition and renewal for routers by automating communication with the certificate authority.

Workflow

These stages describe how CA enrollment URLs work.

Request submission: When a router needs a new certificate or must renew an existing one, it sends a request to the enrollment URL containing its identity information and public key.
Identity verification: Upon receiving the request, the CA verifies the authenticity and validity of the router’s information.
Certificate issuance: If verification succeeds, the CA issues a digital certificate and sends it to the router via the enrollment URL.
Certificate installation: The router installs the received certificate, enabling secure communications.

Result

The process enables routers and certificate authorities to achieve certificate interoperability, securing communications through validated digital certificates.

IPv4 address interoperability for CA enrollment URLs

Routers support IPv4 addresses or web addresses that resolve to IPv4 addresses as valid CA server addresses when you specify the CA URL using the enrollment url command.

Key facts

You can specify either a direct IPv4 address or a domain name that resolves to an IPv4 address as the CA server address in the enrollment URL.
This configuration enables the router to enroll for certificates with certificate authorities that use IPv4 addressing.
Refer to these facts when planning, configuring, or validating CA interoperability for device certificate enrollment.

Reference purpose

Use this reference to quickly look up supported IPv4 formats or behaviors for CA enrollment URLs when planning certificate authority integration or troubleshooting certificate enrollment.

IPv6 address interoperability for CA enrollment URLs

Starting from Cisco IOS XR Release 24.4.1, you can configure IPv6 addresses or web addresses that resolve to an IPv6 address as the certificate authority (CA) server address when specifying the CA enrollment URL using the enrollment url command. This update removes previous limitations that prevented successful CA declaration using IPv6 in the crypto ca trust point command.

Use this reference to:

Look up configuration details and command usage for IPv6 CA enrollment URLs.
Verify certificate authority interoperability behavior when using IPv6 addresses.

Apply these facts when planning, configuring, or validating CA interoperability:

You can specify IPv6 addresses directly or use hostnames that resolve to IPv6.
The enrollment url command now supports IPv6, ensuring compatibility for certificate enrollment tasks.
Restrictions from earlier releases have been eliminated, so IPv6-based CAs can be configured successfully.

Requirement: You must follow CA enrollment URL guidelines

To ensure certificate authority deployment remains supported, you must follow these CA enrollment URL guidelines:

The enrollment URL string must start with http://CA_name, where CA_name is the host Domain Name System (DNS) name or IP address of the CA (for example, http://ca-server).
If the CA CGI-bin script location is not /CGI-bin/pkiclient.exe at the CA (the default), include the nonstandard script location in the enrollment URL as http://CA_name/script-location, where script-location is the full path to the CA scripts.

Configure CA enrollment URLs

Set up CA enrollment URLs to ensure your device can interact with a certificate authority for secure certificate enrollment.

Use this task when you need to establish a secure enrollment process between your device and a certificate authority by specifying the correct enrollment URL.

Before you begin

Review related certificate authority prerequisites.
Ensure your device is properly configured for certificate management.

Procedure

Configure the device for certificate authority trustpoint
Example:
```
Router# configure
Router(config)# crypto ca trustpoint myca
```

Set the CA enrollment URL

Example:

Router(config-trustp)# enrollment url http://ca.domain.com/certsrv/mscep/mscep.dll

Verify the enrollment URL configuration.

Example:

Router# show running-config crypto ca trustpoint myca
crypto ca trustpoint myca
  enrollment url http://ca.domain.com/certsrv/mscep/mscep.dll
 !

The CA enrollment URL is configured and verified; your device is ready to interact with the certificate authority using the specified URL.

Configure cut-and-paste certificate enrollment on your router

Set up and verify manual certificate enrollment with a certificate authority using cut-and-paste procedures.

This task lets you configure your router to manually enroll and import certificates from a certificate authority, enabling secure communication using trusted certificates.

Before you begin

Review the certificate authority prerequisites for your environment.
Ensure your router is prepared for certificate operations.

Procedure

Create the certificate authority (CA) trustpoint.
Example:
```
Router# crypto ca trustpoint myca
```
Declares the CA that your router should use and enters trustpoint configuration mode.
- Use the ca-name argument to specify the name of the CA.
Configure the manual enrollment method.
Example:
```
Router(config-trustp)# enrollment terminal
```
Specifies manual cut-and-paste certificate enrollment.
Save or discard the configuration changes.
Example:
```
commit
end
```
Use one of these options:
- Commit: Saves the configuration changes and remains within the configuration session.
- End: Prompts you to save, discard, or cancel the configuration changes before leaving the configuration session.
- Yes: Saves configuration changes and exits the configuration session.
- No: Exits the configuration session without committing the configuration changes.
- Cancel: Remains in the configuration session without committing the configuration changes.
Authenticate the certificate authority.
Example:
```
Router# crypto ca authenticate myca
```
Authenticates the CA by obtaining the certificate of the CA.
- Use the ca-name argument to specify the name of the CA. Use the same name that you entered previously.
Request the router certificate from the CA.
Example:
```
Router# crypto ca enroll myca
```
Obtains the certificates for your router from the CA.
- Use the ca-name argument to specify the name of the CA. Use the same name that you entered previously.
Import the certificate through cut-and-paste.
Example:
```
Router# crypto ca import myca certificate
```
Imports a certificate manually at the terminal.
- Use the ca-name argument to specify the name of the CA. Use the same name that you entered previously.
Note

You must enter the crypto ca import command twice if usage keys (signature and encryption keys) are used. The first time the command is entered, one of the certificates is pasted into the router; the second time the command is entered, the other certificate is pasted into the router. (It does not matter which certificate is pasted first.
Verify the configuration and certificates.
Example:
```
Router# show crypto ca certificates
```
Displays information about your certificate and the CA certificate.

Cut-and-paste certificate enrollment is complete when verification output matches the expected example and your router is properly enrolled with the CA.

You can configure CA interoperability with commands like:

configure
hostname myrouter
domain name mydomain.com
end

Uncommitted changes found, commit them? [yes]:yes

crypto key generate rsa mykey

The name for the keys will be:mykey
Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose Keypair
Choosing a key modulus greater than 512 may take a few minutes.
How many bits in the modulus [1024]:
Generating RSA keys ...
Done w/ crypto generate keypair
[OK]

show crypto key mypubkey rsa

Key label:mykey
Type     :RSA General purpose
Size     :1024
Created  :17:33:23 UTC Thu Sep 18 2003
Data     :
 30819F30 0D06092A 864886F7 0D010101 05000381 8D003081 89028181 00CB8D86
 BF6707AA FD7E4F08 A1F70080 B9E6016B 8128004C B477817B BCF35106 BC60B06E
 07A417FD 7979D262 B35465A6 1D3B70D1 36ACAFBD 7F91D5A0 CFB0EE91 B9D52C69
 7CAF89ED F66A6A58 89EEF776 A03916CB 3663FB17 B7DBEBF8 1C54AF7F 293F3004
 C15B08A8 C6965F1E 289DD724 BD40AF59 E90E44D5 7D590000 5C4BEA9D B5020301
 0001

! The following commands declare a CA and configure a trusted point.

configure
crypto ca trustpoint myca
enrollment url http://xyz-ultra5
enrollment retry count 25
enrollment retry period 2
rsakeypair mykey
end

Uncommitted changes found, commit them? [yes]:yes

! The following command authenticates the CA to your router.

crypto ca authenticate myca

Serial Number  :01
Subject Name   :
cn=Root coax-u10 Certificate Manager,ou=HFR,o=Cisco Systems,l=San Jose,st=CA,c=US
Issued By      :
cn=Root coax-u10 Certificate Manager,ou=HFR,o=Cisco Systems,l=San Jose,st=CA,c=US
Validity Start :07:00:00 UTC Tue Aug 19 2003
Validity End   :07:00:00 UTC Wed Aug 19 2020
Fingerprint:58 71 FB 94 55 65 D4 64 38 91 2B 00 61 E9 F8 05
Do you accept this certificate?? [yes/no]:yes

! The following command requests certificates for all of your RSA key pairs.

crypto ca enroll myca

% Start certificate enrollment ...
% Create a challenge password. You will need to verbally provide this
  password to the CA Administrator in order to revoke your certificate.
% For security reasons your password will not be saved in the configuration.
% Please make a note of it.

Password:
Re-enter Password:
    Fingerprint: 17D8B38D ED2BDF2E DF8ADBF7 A7DBE35A

! The following command displays information about your certificate and the CA certificate.

show crypto ca certificates

Trustpoint       :myca
==========================================================
CA certificate
  Serial Number  :01
  Subject Name   :
        cn=Root coax-u10 Certificate Manager,ou=HFR,o=Cisco Systems,l=San Jose,st=CA,c=US
  Issued By      :
        cn=Root coax-u10 Certificate Manager,ou=HFR,o=Cisco Systems,l=San Jose,st=CA,c=US
  Validity Start :07:00:00 UTC Tue Aug 19 2003
  Validity End   :07:00:00 UTC Wed Aug 19 2020
Router certificate
  Key usage      :General Purpose
  Status         :Available
  Serial Number  :6E
  Subject Name   :
        unstructuredName=myrouter.mydomain.com,o=Cisco Systems
  Issued By      :
        cn=Root coax-u10 Certificate Manager,ou=HFR,o=Cisco Systems,l=San Jose,st=CA,c=US
  Validity Start :21:43:14 UTC Mon Sep 22 2003
  Validity End   :21:43:14 UTC Mon Sep 29 2003
  CRL Distribution Point
        ldap://coax-u10.cisco.com/CN=Root coax-u10 Certificate Manager,O=Cisco Systems

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.