System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Certificate authority trust pools

Updated: September 18, 2026

Want to summarize with AI?

Log in

Introduces the concept of CA trust pools, describing trust models, foundational principles, and their significance in establishing trusted entities for secure network communications.

A certificate authority trust pool is a certificate authority interoperability component that

  • supports certificate-based trust in Cisco IOS XR deployments

  • authenticates sessions—such as HTTPS—between devices using commonly recognized trusted agents (certificate authorities or CAs), and

  • provisions, stores, and manages a pool of certificates from known CAs, including both built-in and downloaded certificates.

Additional reference information

The trust pool feature is enabled by default in Cisco IOS XR software to create a scheme similar to a browser’s service for securing sessions. A special trusted point called a trust pool is designated, containing multiple known CA certificates from Cisco and potentially other vendors. The trust pool includes both built-in and downloaded CA certificates, supporting flexible interoperability across certification authorities. The feature also includes the child topic "CA Certificate Bundling in the Trust Pool."

CA certificate bundles in trust pools

A CA certificate bundle is a certificate authority interoperability component that

  • supports certificate-based trust in Cisco IOS XR deployments

  • contains certificates packaged into a baseline image in a dedicated store called a CA trust pool, and

  • is updated automatically by Cisco and recognized by other vendors.

Additional reference information

The CA certificate bundle is available in different formats to enhance interoperability:

  • Privilege Management Infrastructure (PMI) certificates in Distinguished Encoding Rules (DER) binary format, encapsulated in Public-Key Cryptographic Message Syntax Standard 7 (PKCS7).

  • Files with concatenated X.509 certificates in Privacy Enhanced Mail (PEM) format using PEM headers.

Consider a router running Cisco IOS XR:

The router uses a built-in CA certificate bundle stored in a special trust pool. This bundle is automatically updated to maintain interoperability with multiple certification authorities, ensuring secure communications.

Requirement: CA trust pool prerequisites

To use the certification authority, ensure that the software image includes a crypto subsystem. Crypto is Cisco's proprietary encryption mechanism, available in the baseline software image, and is required for secure certificate authority operations.

Requirement: Follow CA trust pool restrictions

Ensure you follow these requirements and restrictions for CA trust pools:

  • Device certificates that use CA certificates cannot be enrolled in a CA trust pool.

  • Starting with Cisco IOS XR software version 7.3.3, server certificates (leaf certificates) on the router must include a Fully Qualified Domain Name (FQDN) in the Common Name (CN) field.

  • To add an IP address in the Subject Alternate Name (SAN) field of server certificates, add the extension type as IP address in the certificate. If the IP address extension type configuration isn't available, use the crypto ca fqdn-check ip-address allow command for the router to validate the IP address in the SAN field successfully.

How CA trust pools are updated

Cisco IOS XR considers the CA trust pool as a single entity. Any update replaces the entire trust pool. Built-in certificates in the trust pool cannot be physically replaced, but if their X.509 subject-name attribute matches a certificate in the updated bundle, the built-in certificate is deactivated after an update.

The CA trust pool is considered as a single entity, As such, any update you perform will replace the entire trustpool.

Summary

The key components involved in the process are:

  • CA trust pool: The consolidated set of trusted certificate authority certificates maintained on the device.

  • Certificate bundle source: The URL or location from which updated certificate bundles are obtained for replacement or augmentation.

  • Administrator: Manages manual updates and reviews certificate warnings or errors presented by the system.

CA trust pools are updated in Cisco IOS XR to maintain interoperability with certificate authorities and ensure secure communications. Updates are triggered by certificate expiration, reissuance, the addition of new trusted certificates, or corruption of the trust pool configuration.

Workflow

These stages describe how CA trust pools are updated.

  1. Trigger conditions: The process begins when:

    • A certificate in the trust pool expires or is reissued.

    • The published CA certificate bundle contains additional certificates required by specific applications.

    • The device configuration is found to be corrupted.

  2. Update method selection: The system or administrator chooses either of the following methods:

    • Automatic update:

      • A timer is established based on the certificate with the earliest expiration time.

      • If a bundle location is not configured or not explicitly disabled, syslog warnings are issued at intervals to notify the administrator.

      • Automatic updates use the configured bundle URL. Upon trust pool expiration, the system reads the policy, loads the bundle, and replaces the PKI trust pool.

      • If automatic update encounters problems, the system retries with the following schedule: 20 days, 15 days, 10 days, 5 days, 4 days, 3 days, 2 days, 1 day, then once every hour until the download is successful.

    • Manual update:

      • The administrator manually initiates an update using provided commands or procedures.

  3. Trust pool replacement: The CA trust pool is replaced as a single unit, making sure all necessary certificates are active. Built-in certificates that match those in the published bundle are deactivated.

  4. Result confirmation: The system confirms the update. The administrator reviews the new trust pool and resolves any syslog warnings or errors.

Result

The process ensures that the CA trust pools remain up to date, certificates are valid and trusted, and interoperability with certificate authorities is successfully maintained.

Configure manual trust pool certificate updates

Manually update the trust pool certificate bundle when automatic updates are unavailable or certain certificates require replacement.

The CA trust pool feature is enabled by default and uses a built-in CA certificate bundle, which receives automatic updates from Cisco. Manual updates are necessary if certificates are outdated, corrupt, or need specific replacement.

Before you begin

Review certificate authority prerequisites for your environment.

Procedure

  1. (Optional) Remove all downloaded CA certificates.

    Example:

    Router# crypto ca trustpool import url clean

    (Optional) Manually removes all downloaded CA certificates. This command is run in the EXEC mode.

  2. Import the updated CA certificate bundle.

    Example:

    Router# crypto ca trustpool import url
http://www.cisco.com/security/pki/trs/ios.p7b

    Specify the URL from which the CA trust pool certificate bundle must be downloaded. This manually imports (downloads) the CA certificate bundle into the CA trust pool to update or replace the existing CA certificate bundle.

  3. Verify the trust pool configuration and operational state.

    Example:

    Example:

    Router# show crypto ca trustpool

Trustpool: Built-In
==================================================
CA certificate
  Serial Number  : 5F:F8:7B:28:2B:54:DC:8D:42:A3:15:B5:68:C9:AD:FF
  Subject:
        CN=Cisco Root CA 2048,O=Cisco Systems
Issued By      :
        CN=Cisco Root CA 2048,O=Cisco Systems
  Validity Start : 20:17:12 UTC Fri May 14 2004
  Validity End   : 20:25:42 UTC Mon May 14 2029
  SHA1 Fingerprint:
         DE990CED99E0431F60EDC3937E7CD5BF0ED9E5FA

Trustpool: Built-In
==================================================
CA certificate
  Serial Number  : 2E:D2:0E:73:47:D3:33:83:4B:4F:DD:0D:D7:B6:96:7E
Subject:
        CN=Cisco Root CA M1,O=Cisco
  Issued By      :
        CN=Cisco Root CA M1,O=Cisco
  Validity Start : 20:50:24 UTC Tue Nov 18 2008
  Validity End   : 21:59:46 UTC Fri Nov 18 2033
  SHA1 Fingerprint:
         45AD6BB499011BB4E84E84316A81C27D89EE5CE7

    Displays the CA trust pool certificates of the router in a verbose format.

Manual trust pool certificate updates are complete when the configuration and verification outputs confirm that the certificate bundle has been successfully updated and matches the intended interoperability behavior.

CRL retrievals through HTTP proxy servers

A CRL retrieval through HTTP proxy servers is a certificate authority interoperability mechanism that

  • allows Cisco IOS XR routers to download Certificate Revocation Lists (CRLs) from certification authorities as part of certificate validation

  • enables reuse of a CRL with the same certificate multiple times until the CRL expires, and

  • retrieves new CRLs automatically when a certificate is received and the previous CRL has expired.

If the CRL Distribution Point (CDP) is not directly reachable, you can obtain the CRL through an HTTP proxy server using this feature.

Feature history

Table 1. Feature History Table

Feature Name

Release Information

Feature Description

Retrieve CRL through the HTTP Proxy Server

 Release 25.4.1

Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only*)

*This feature is supported on:

  • 8011-32Y8L2H2FH

  • 8011-12G12X4Y-A/D

Retrieve CRL through the HTTP Proxy Server

Release 25.1.1

Introduced in this release on: Fixed Systems (8700 [ASIC: K100], 8010 [ASIC: A100])(select variants only*)

*This feature is supported on:

  • 8712-MOD-M

  • 8011-4G24Y4H-I

Retrieve CRL through the HTTP Proxy Server

Release 24.4.1

Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100])(select variants only*); Modular Systems (8800 [LC ASIC: P100])(select variants only*)

*This feature is supported on:

  • 8212-48FH-M

  • 8711-32FH-M

  • 88-LC1-36EH

  • 88-LC1-12TH24FH-E

  • 88-LC1-52Y8H-EM

Retrieve CRL through the HTTP Proxy Server

Release 7.3.1

CRL contains the serial numbers of the third-party certificates that are invalidated by the issuing Certificate Authority.

In the event that the CRL Distribution point (CDP) is not directly reachable, you can fetch the CRL through the http proxy server using the newly introduced crypto ca http-proxy command.

Command modified for this feature:

crypto ca crl request

Examples

Configuration example: To retrieve a CRL through the HTTP proxy server for smart licensing, use the following commands:

Router# config
Router(config)# crypto ca HTTP-proxy 10.10.10.1 port 1
Router(config)# commit


Router# license smart register idtoken NWRkMTJjZjYtMzJhNi00YzYxLWI3M$
Router# commit

Verification example:

Smart licensing registration is validated by fetching the CRL from the CDP, through the HTTP proxy server. If the validation is successful, the show crypto ca crls command displays the CRLs. If validation fails, no output is shown.

Router# show crypto ca crls
Thu Jun  6 13:43:00.763 UTC
CRL Entry
===============================================
  Issuer : CN=xyz-w2k Root CA 2,O=xyz Limited,C=BM
  Last Update : Dec 17 18:18:14 2018 GMT
  Next Update : Jun 15 18:18:14 2019 GMT
  CRL Distribution Point :
        http://xyz-w2k.cisco.com/CertEnroll/xyz-w2k-root.crl
CRL Entry
===============================================
  Issuer : CN=zxy-w2k SSL ICA G2,O=zxy,C=US
  Last Update : Jun  6 12:57:04 2019 GMT
  Next Update : Jun  9 12:57:04 2019 GMT
  CRL Distribution Point :
        http://zxy-w2k.cisco.com/CertEnroll/zxy-w2k-root.crl
RP/0/RP0/CPU0:ios#


Router# show license status
Smart Licensing is ENABLED
Utility:
  Status: DISABLED
Data Privacy:
  Sending Hostname: yes
    Callhome hostname privacy: DISABLED
    Smart Licensing hostname privacy: DISABLED
  Version privacy: DISABLED
Transport:
  Type: Callhome
Registration:
  Status: REGISTERED
  Smart Account: BU Production Test 1
  Virtual Account:
  Export-Controlled Functionality: ALLOWED
  Initial Registration: SUCCEEDED on Jun 06 2019 13:42:46 UTC
  Last Renewal Attempt: None
  Next Renewal Attempt: Dec 03 2019 13:42:46 UTC
  Registration Expires: Jun 05 2020 13:37:45 UTC
License Authorization:
  Status: AUTHORIZED on Jun 06 2019 13:42:55 UTC
  Last Communication Attempt: SUCCEEDED on Jun 06 2019 13:42:55 UTC
  Next Communication Attempt: Jul 06 2019 13:42:54 UTC
  Communication Deadline: Sep 04 2019 13:37:55 UTC

Export Authorization Key:
  Features Authorized:
    <none>
Note

To fetch the latest CRL from a specific CDP, use the crypto ca crl request <cdp-url> [HTTP-proxy <ip-address> port <port-number>] command.

Configure optional trust pool policy parameters

Allow you to customize certificate authority trust pool policy parameters, such as CA bundle URL, revocation list checking, and policy description, for enhanced certificate management and interoperability.

Adjusting optional trust pool policy parameters fine-tunes how your router interacts with certificate authorities. Use this task when you need to customize the CA trust pool policy for improved interoperability or compliance.

Before you begin

Review the related certificate authority prerequisites for your deployment.

Procedure

  1. Enter global configuration mode.

    Example:

    Router# configure

    Enters global configuration mode.

  2. Enter ca-trust pool configuration mode where commands can be accessed to configure CA trust pool policy parameters.

    Example:

    Router(config)# crypto ca trust pool policy

    Enters ca-trustpool configuration mode where commands can be accessed to configure CA trust pool policy parameters.

  3. Configure the CA bundle URL.

    Example:

    Router(config-trustpool)# cabundle url
http://www.cisco.com/security/pki/crl/crca2048.crl

    Specifies the URL from which the CA trust pool certificate bundle is downloaded.

  4. Configure certificate revocation list (CRL) checking.

    Example:

    Router(config-trustpool)# crl optional

    Disables revocation checking when the trust pool policy is being used. By default, the router enforces a check of the revocation status of the certificate by querying the certificate revocation list (CRL).

  5. Set the trust pool policy description.

    Example:

    Router(config-trustpool)# description Trustpool for Test.

The optional trust pool policy parameters are correctly configured when your configuration and verification outputs match the examples provided.

How CA certificates work in trust pools and trustpoints

There may be cases where a Certificate Authority (CA) resides in both a trust pool and a trustpoint; for example, a trustpoint uses a CA and then a CA bundle is downloaded containing the same CA. In such scenarios, the router considers the CA and its policy in the trustpoint before considering the CA in the trust pool or its policy. This approach ensures that the implementation of the trust pool feature does not alter the router’s existing behavior or authentication mechanisms.

The policy defines how the security appliance obtains the CA certificate and the authentication policies enforced for user certificates issued by the CA.

Summary

The key components involved in the process are:

  • CA certificate: Provides authority for user certificate authentication.

  • Trustpoint: Stores specific CA certificates and associated policies for authentication.

  • Trust pool: Contains bundles of CA certificates and associated policies downloaded to the router.

CA certificates can reside in both trust pools and trustpoints within Cisco IOS XR. The workflow determines which certificate and policy are used when there are overlaps, ensuring current behaviors remain consistent as the trust pool feature is implemented.

Workflow

These stages describe how CA certificates work in trust pools and trustpoints.

  1. When a CA certificate exists in both the trust pool and a trustpoint, Cisco IOS XR first evaluates the certificate and policy in the trustpoint.

  2. The trustpoint’s policy determines how the security appliance obtains the CA certificate and enforces authentication for user certificates issued by that CA.

  3. If no relevant certificate or policy exists in the trustpoint, the system evaluates the trust pool and its associated policy.

  4. This order ensures that existing authentication behaviors are not changed when the trust pool feature is implemented.

Result

The router attains certificate authority interoperability, prioritizing trustpoint configuration and policies over the trust pool, thereby preserving established authentication behaviors during trust pool feature integration.