Configuration Guide for Cisco NCS 1004, IOS XR Release 25.x.x

Authenticate certification authority

Updated: July 31, 2026

Want to summarize with AI?

Authenticates the certification authority (CA) to Cisco NCS 1004 by obtaining the self-signed CA certificate that contains the public key of the CA.

Use this task to authenticate the CA to your Cisco NCS 1004 device.

The Cisco NCS 1004 device must authenticate the CA by obtaining the self-signed certificate of the CA, which contains the public key of the CA. Because the certificate of the CA is self-signed (the CA signs its own certificate), manually authenticate the public key of the CA by contacting the CA administrator to compare the fingerprint of the CA certificate.

Procedure

	1.	Authenticate the CA to your Cisco NCS 1004 device by obtaining a CA certificate that contains the public key for the CA. crypto ca authenticate ca-name Example: `RP/0/RP0/CPU0:ios# crypto ca authenticate myca`
	2.	(Optional) Display information about the CA certificate. show crypto ca certificates Example: `RP/0/RP0/CPU0:ios# show crypto ca certificates`

Multi-tier certificate authority for trustpoint authentication

Multi-tier certificate authority for trustpoint authentication is a security capability on Cisco NCS 1004 that lets a complete CA hierarchy, from the Root CA to the subordinate CA that issues the certificate, be imported as part of a single terminal-based authentication request.

Supports a maximum of 8 tiers, that is, a chain of CAs with one Root CA and seven subordinate CAs, for trustpoint authentication.
Lets you import the complete CA hierarchy in a single authentication request.
Provides flexibility and security in network topologies that use a multi-tier CA hierarchy for enrollment.

Feature history for multi-tier certificate authority for trustpoint authentication

Table 1. Feature History Table
Feature Name	Release Information	Description
Multi-Tier Certificate Authority for Trustpoint Authentication	Cisco IOS XR Release 7.10.1	Apart from the Root certificate authority (CA), you can now use a subordinate CA to issue certificates and authenticate your network devices. This feature is beneficial when you have an existing CA hierarchy where it is not the Root CA but the subordinate CA that issues the leaf or certificates. In earlier releases, you could associate only a single CA, not a multi-tier CA, to a trustpoint. And, you could use only the Root CA certificate to enroll the certificates. This feature modifies the show crypto ca certificates command to display the Trusted Certificate Chain field.

Need for multi-tier certificate authority for trustpoint authentication

During terminal-based enrollment of a CA trustpoint, Cisco IOS XR network devices accepted only Root CA certificates. Some network topologies use a multi-tier CA hierarchy for enrollment because it provides more flexibility and security. From Cisco IOS XR Release 7.10.1 and later, as part of terminal-based authentication, you can import a complete CA hierarchy (from the Root CA to the subordinate CA that issues the certificate) as part of a single authentication request. With this feature, you can provide a certificate chain that includes the Root CA and intermediate subordinate CAs as part of the terminal-based enrollment process. This feature is useful if you have an existing multi-tier CA hierarchy where the Root CA does not issue any certificates directly, and if you want only subordinate CAs to issue certificates to authenticate your network devices.

Using multi-tier CA for trustpoint authentication

The crypto ca authenticate command is used to authenticate a trustpoint with a multi-tier CA hierarchy. You must use only Privacy Enhanced Mail (PEM)-encoded certificates for trustpoint authentication that uses multi-tier CAs. The enrollment process is the same as enrollment that uses a single-tier CA, except that Cisco NCS 1004 displays a console message that prompts you to use only PEM-encoded certificates.

Prerequisite for using multi-tier CA for trustpoint authentication

You must generate a key pair, import a public key, and configure a trustpoint on Cisco NCS 1004 as detailed in the previous sections.

Configuration example for multi-tier CA trustpoint authentication

The following example shows the trustpoint authentication for a multi-tier CA on Cisco NCS 1004.

RP/0/RP0/CPU0:ios#crypto ca authenticate test-ca
Mon Feb  6 08:17:48.943 UTC


Enter the base 64/PEM encoded certificate/certificates.
Please note: for multiple certificates use only PEM
End with a blank line or the word "quit" on a line by itself

-----BEGIN CERTIFICATE-----
MIIF5TCCA82gAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwXTELMAkGA1UEBhMCSU4x
CzAJBgNVBAgMAktBMQwwCgYDVQQHDANCR0wxDTALBgNVBAoMBENTQ08xDTALBgNV
.
.
.
/4UzeeX6ll0gGJVbDwGeIZTH00artqxHquKQ2P7eXQ1pg0PRNRqWN90SvT5yE33N
eHgbtvdHg1K6K6IAj/NGnd7xUrA1TQ4bdmouCNkgbXM/G9DwgkOOvZ8KYRP9JW57
LYIv2ZcRS2vdnZRD9JPGVig2EgcfVPtj+Q==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIF9TCCA92gAwIBAgIUD6AGesleqedhorkrJ9HWjz1RQzswDQYJKoZIhvcNAQEL
BQAwXTELMAkGA1UEBhMCSU4xCzAJBgNVBAgMAktBMQwwCgYDVQQHDANCR0wxDTAL
.
.
.
+6rMWd6BmfSy2PT3Qz5AjO2+3N1dd67qRRrX7skklkX4JXY42n5/l9PQtSp0wTBh
uy5yUAagynu0z07GczE7E9V+tJHRmNTbnd8pxLk4lTwqtiCIXwQLZA75SkwCS5wh
fn7OrV7uFjMaggNkvj0kSSOkWxqJ+j/KqMAA2zQMUV+qdvT6i+ZV44U=
-----END CERTIFICATE-----
Serial Number  : 10:01
  Subject:
        CN=SUB_CA_CERT,OU=SPBU,O=CSCO,L=BGL,ST=KA,C=IN
  Issued By      :
        CN=TWO-LEVEL-CA,OU=SPBU,O=CSCO,L=BGL,ST=KA,C=IN
  Validity Start : 12:31:40 UTC Sun Jun 14 2020
  Validity End   : 12:31:40 UTC Wed Jun 12 2030

  CRL Distribution Point
        http://10.105.236.78/crl_akshath_two_level_ca/crl.der
  SHA1 Fingerprint:
         D8E0C11ECED96F67FDBC800DB6A126676A76BD62
  Serial Number  : 0F:A0:06:7A:C9:5E:A9:E7:61:A2:B9:2B:27:D1:D6:8F:3D:51:43:3B
  Subject:
        CN=TWO-LEVEL-CA,OU=SPBU,O=CSCO,L=BGL,ST=KA,C=IN
  Issued By      :
        CN=TWO-LEVEL-CA,OU=SPBU,O=CSCO,L=BGL,ST=KA,C=IN
  Validity Start : 13:12:32 UTC Sun Jun 07 2020
  Validity End   : 13:12:32 UTC Sat Jun 02 2040

  CRL Distribution Point
        http://10.105.236.78/crl_akshath_two_level_ca/crl.der
  SHA1 Fingerprint:
         08E71248FB7578614442E713AC87C461D173952F

CA Certificate validated using issuer certificate.
RP/0/RP0/CPU0:ios#

Verification of multi-tier CA trustpoint authentication

Use the show crypto ca certificates test-ca command to view the CA certificate chain. The command output displays the Trusted Certificate Chain field if one or more subordinate CAs are involved in the hierarchy.

RP/0/RP0/CPU0:ios#show crypto ca certificates test-ca
Mon Feb  6 09:03:53.019 UTC

Trustpoint       : test-ca
==================================================
CA certificate
  Serial Number  : 10:01
  Subject:
            CN=SUB_CA_CERT,OU=SPBU,O=CSCO,L=BGL,ST=KA,C=IN
  Issued By      :
            CN=TWO-LEVEL-CA,OU=SPBU,O=CSCO,L=BGL,ST=KA,C=IN
  Validity Start : 12:31:40 UTC Sun Jun 14 2020
  Validity End   : 12:31:40 UTC Wed Jun 12 2030

  CRL Distribution Point
            http://10.105.236.78/crl_akshath_two_level_ca/crl.der
  SHA1 Fingerprint:
             D8E0C11ECED96F67FDBC800DB6A126676A76BD62
Trusted Certificate Chain
  Serial Number  : 0F:A0:06:7A:C9:5E:A9:E7:61:A2:B9:2B:27:D1:D6:8F:3D:51:43:3B
  Subject:
            CN=TWO-LEVEL-CA,OU=SPBU,O=CSCO,L=BGL,ST=KA,C=IN
  Issued By      :
            CN=TWO-LEVEL-CA,OU=SPBU,O=CSCO,L=BGL,ST=KA,C=IN
  Validity Start : 13:12:32 UTC Sun Jun 07 2020
  Validity End   : 13:12:32 UTC Sat Jun 02 2040

  CRL Distribution Point
            http://10.105.236.78/crl_akshath_two_level_ca/crl.der
  SHA1 Fingerprint:
             08E71248FB7578614442E713AC87C461D173952F
certificate
  Key usage      : General Purpose
  Status         : Available
  Serial Number  : 28:E5
  Subject:
            CN=test
  Issued By      :
            CN=SUB_CA_CERT,OU=SPBU,O=CSCO,L=BGL,ST=KA,C=IN
  Validity Start : 08:49:54 UTC Mon Feb 06 2023
  Validity End   : 08:49:54 UTC Wed Mar 08 2023
  SHA1 Fingerprint:
             6C8644FA67D9CEBC7C5665C35838265F578835AB
Associated Trustpoint: test-ca

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.