System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

System Security Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

Configure the EST protocol

Updated: September 18, 2026

Want to summarize with AI?

Log in

Configures EST authentication, PKI trustpoints, certificate enrollment, and certificate verification for secure automated provisioning.

Configure the EST protocol on the router to enable secure and automated certificate provisioning.

Before you begin

Before configuring EST, ensure that:

  • Access to the EST server is established and operational.

  • The certificates and keys required for configuration are available.

  • For HTTP-based authentication, create an RSA key with the crypto key generate rsa key command and use the generated key to configure the EST trustpoint.

  • Enable Type 6 encryption with the password6 encryption aes command for secure password handling.

  • Create a master key and store it in the Trust Anchor Module (TAM) with the key config-key password-encryption command.

A master key for Type 6 encryption is stored in the device internal memory in a protected area known as the TAM.

Procedure

  1. Select the authentication method.

    Configure TLS certificate-based authentication, HTTP-based authentication, or both. Use this table to select the appropriate substep.

    Table 1. Bootstrap certificate and authentication method

    If...

    Then follow ...

    A bootstrap certificate is not available

    HTTP-based authentication substep.

    A bootstrap certificate is available

    TLS-based authentication substep.
    1. For HTTP-based authentication, create client authentication profiles for enrollment and re-enrollment.

      Example:

      Router(config)# client-authentication profile sample-P1_enroll
Router(config-client-authentication-profile)# username sample-estuser password Encrypt6 sample-estpwd_enrol
Router(config-client-authentication-profile)# exit
Router(config)# client-authentication profile sample-P2_re-enroll
Router(config-client-authentication-profile)# username sample-estuser password Encrypt6 sample-estpwd_re_enrol
Router(config-client-authentication-profile)# commit
Router(config-client-authentication-profile)# exit
Router(config)# crypto ca trustpoint sample-EST_TRUSTPOINT
Router(config-trustp)# method est
Router(config-trustpoint)# enrollment url https://192.168.30.1:port
Router(config-trustpoint)# authentication-profile sample-P1_enroll
Router(config-trustpoint)# re-enrollment authentication-profile sample-P2_re-enroll
Router(config-trustpoint)# rsakeypair sample-est-client
Router(config-trustpoint)# commit

      You can use IPv4, IPv6, or hostname addresses as the enrollment URL.

      Table 2. HTTP-based re-enrollment

      If...

      Then...

      Separate profiles are configured for enrollment and re-enrollment

      Use the enrollment profile for enrollment and the re-enrollment profile for re-enrollment.

      Only an enrollment profile is configured

      Use the enrollment profile for both enrollment and re-enrollment.

      If you use a multi-tier CA certificate system, import the CA root certificate into another trustpoint using the terminal, SCEP, or local file method.

    2. For TLS-based authentication, configure an SSL profile with the bootstrap certificate.

      Example:

      Router# configure terminal
Router(config)# ssl profile sample-EST_SSL_profile
Router(config-SSL-profile)# certificate sample-EST_BOOTSTRAP_TP
Router(config-SSL-profile)# commit

      For initial enrollment, add a bootstrap certificate using an existing method such as terminal or SCEP.

  2. Configure a PKI trustpoint with EST and attach the authentication profiles.

    Example:

    Router# configure terminal
Router(config)# crypto ca trustpoint sample-EST-TP
Router(config)# ssl-profile sample-EST_enroll
Router(config-trustp)# method est
Router(config-method-est)# commit
Router(config-trustp)# enrollment authentication-profile sample-P1_enroll
Router(config-trustp)# re-enrollment authentication-profile sample-P2_re-enroll
Router(config-trustp)# commit

    The method est command initializes EST for the specified trustpoint. The example attaches both HTTP-based and TLS-based authentication profiles.

  3. Authenticate and enroll the certificates.

    Example:

    Router# crypto ca authenticate sample-EST_TP
Router# crypto ca enroll sample-EST_TP

  4. Verify that certificate enrollment through EST is successful.

    Example:

    Router# show run crypto ca trustpoint sample-EST_TP
crypto ca trustpoint sample-EST-TP
 ssl-profile sample-EST_enroll
 method est
 !
 enrollment authentication-profile sample-P1_enroll
 re-enrollment authentication-profile sample-P2_re-enroll
!

    The output displays the trustpoint, SSL profile, EST method, and enrollment and re-enrollment authentication profiles.

  5. Verify that the certificates are enrolled on the trustpoint.

    Example:

    Router# show crypto ca certificates sample-EST_TP
Trustpoint : EST_TP
CA certificate
Serial Number : 10:01
Subject:
CN=SUB_CA_CERT,OU=SPBU,O=CSCO,L=BGL,ST=KA,C=IN
Issued By:
CN=TWO-LEVEL-CA,OU=SPBU,O=CSCO,L=BGL,ST=KA,C=IN
Validity Start : 12:31:40 UTC Sun Jun 14 2020
Validity End : 12:31:40 UTC Wed Jun 12 2030
CRL Distribution Point
http://10.105.236.78/crl.der
SHA1 Fingerprint:
D8E0C11ECED96F67FDBC800DB6A126676A76BD62
Trusted Certificate Chain
Serial Number : 0F:A0:06:7A:C9:5E:A9:E7:61:A2:B9:2B:27:D1:D6:8F:3D:51:43:3B
Router certificate
Key usage : General Purpose
Status : Available
Serial Number : 28:E5
Subject:
CN=test
Associated Trustpoint: EST_TP

    Verify the CA certificate, trusted certificate chain, router certificate, validity period, certificate fingerprints, and associated trustpoint.

The router uses EST to authenticate the server, enroll certificates, and verify the resulting certificate chain on the configured trustpoint.