Configuration Guide for Cisco NCS 1004, IOS XR Release 25.x.x

PDF

Configuration Guide for Cisco NCS 1004, IOS XR Release 25.x.x

Certification authority interoperability

Updated: July 31, 2026

Want to summarize with AI?

Log in

Describes certification authority (CA) interoperability for the IP Security (IPSec), Secure Socket Layer (SSL), and Secure Shell (SSH) protocols on Cisco NCS 1004, and explains how a CA helps devices obtain and use digital certificates.

Certification authority (CA) interoperability is a security capability on Cisco NCS 1004 that

  • supports IPSec, SSL, and SSH protocols.

  • provides manageability and scalability for IPSec deployments.

  • allows devices to obtain and use digital certificates issued by a CA.

CA interoperability permits devices and CAs to communicate so that a device can obtain and use digital certificates from the CA. Although IPSec can be implemented in a network without the use of a CA, using a CA provides manageability and scalability for IPSec.

Note

IPSec is not currently supported on Cisco NCS 1004.

Prerequisites for CA interoperability

Ensure that the user permissions and the certification authority (CA) requirements are in place on Cisco NCS 1004 before you configure CA interoperability.

The prerequisites for implementing CA interoperability on Cisco NCS 1004 include the following requirements:

  • You must be in a user group that is associated with a task group that includes the proper task IDs. The command reference guides include the task IDs that are required for each command. If you suspect that user group assignment is preventing you from using a command, contact your AAA administrator for assistance.

  • You must have a CA available to your network before you configure this interoperability feature. The CA must support the Cisco Systems PKI protocol and the Simple Certificate Enrollment Protocol (SCEP), which was formerly called Certificate Enrollment Protocol (CEP).

Maximum supported CA key size for interoperability on Cisco NCS 1004

The following restriction applies when configuring CA interoperability on Cisco NCS 1004:

  • The restriction for CA interoperability on Cisco NCS 1004 is that the software does not support CA server public keys that are greater than 2048 bits.

Enroll RSA key pairs for device certificates

Secure the Cisco NCS 1004 device by obtaining signed certificates from the certification authority for each RSA key pair.

You must obtain a signed certificate from the CA for each of the RSA key pairs on the Cisco NCS 1004 device. If you generated general-purpose RSA keys, the Cisco NCS 1004 device has only one RSA key pair and needs only one certificate. If you previously generated special usage RSA keys, the Cisco NCS 1004 device has two RSA key pairs and needs two certificates.

Procedure

1.

Request certificates for all of your RSA key pairs using the command crypto ca enroll ca-name .

  • This command causes Cisco NCS 1004 to request as many certificates as there are RSA key pairs. Run this command only once, even if you have special usage RSA key pairs.

  • This command requires you to create a challenge password that is not saved with the configuration. This password is required if your certificate must be revoked, so you must remember this password.

  • A certificate may be issued immediately, or Cisco NCS 1004 sends a certificate request every minute until the enrollment retry period is reached and a timeout occurs. If a timeout occurs, contact your system administrator to get your request approved, and then enter this command again.

Example:

RP/0/RP0/CPU0:ios# crypto ca enroll myca
2.

(Optional) Display information about the CA certificate using the command show crypto ca certificates .

Example:

RP/0/RP0/CPU0:ios# show crypto ca certificates
The Cisco NCS 1004 device receives signed certificates for each RSA key pair from the CA. If the request times out, contact your administrator and retry the enrollment.

Configure certificate enrollment using cut-and-paste

Set up the trustpoint CA that Cisco NCS 1004 uses, and enable manual certificate enrollment through terminal-based cut-and-paste.

Manual cut-and-paste certificate enrollment lets you import the CA certificate and your own certificate by pasting them at the terminal, instead of using a network-based enrollment protocol.

Procedure

1.

Enter the XR Config mode.

Example:

RP/0/RP0/CPU0:ios# configure
2.

Declare the CA that Cisco NCS 1004 must use, and enter trustpoint configuration mode. Use the ca-name argument to specify the name of the CA.

Example:

RP/0/RP0/CPU0:ios(config)# crypto ca trustpoint myca
3.

Specify manual cut-and-paste certificate enrollment.

Example:

RP/0/RP0/CPU0:ios(config-trustp)# enrollment terminal
4.

Save the configuration changes by using the commit or end command.
5.

Authenticate the CA by obtaining the certificate of the CA. Use the ca-name argument to specify the name of the CA. Use the same name that you entered in step 2.

Example:

RP/0/RP0/CPU0:ios# crypto ca authenticate myca
6.

Obtain the certificates for Cisco NCS 1004 from the CA. Use the ca-name argument to specify the name of the CA. Use the same name that you entered in step 2.

Example:

RP/0/RP0/CPU0:ios# crypto ca enroll myca
7.

Import a certificate manually at the terminal. Use the ca-name argument to specify the name of the CA. Use the same name that you entered in step 2.

Note

You must enter the crypto ca import command twice if usage keys (signature and encryption keys) are used. The first time the command is entered, one of the certificates is pasted into Cisco NCS 1004; the second time the command is entered, the other certificate is pasted into Cisco NCS 1004. The order in which the certificates are pasted is not significant.

Example:

RP/0/RP0/CPU0:ios# crypto ca import myca certificate
8.

Display information about your certificate and the CA certificate.

Example:

RP/0/RP0/CPU0:ios# show crypto ca certificates

The following example shows how to configure CA interoperability. Comments are included within the configuration to explain various commands.

RP/0/RP0/CPU0:ios# configure
RP/0/RP0/CPU0:ios(config)# hostname mydevice
RP/0/RP0/CPU0:ios(config)# domain name mydomain.com
RP/0/RP0/CPU0:ios(config)# end

Uncommitted changes found, commit them? [yes]:yes

RP/0/RP0/CPU0:ios(config)# crypto key generate rsa mykey

The name for the keys will be:mykey
Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose Keypair
Choosing a key modulus greater than 512 may take a few minutes.
How many bits in the modulus [1024]:
Generating RSA keys ...
Done w/ crypto generate keypair
[OK]

! The following commands declare a CA and configure a trusted point.

RP/0/RP0/CPU0:ios# configure
RP/0/RP0/CPU0:ios(config)# crypto ca trustpoint myca
RP/0/RP0/CPU0:ios(config)# enrollment url http://xyz-ultra5
RP/0/RP0/CPU0:ios(config)# enrollment retry count 25
RP/0/RP0/CPU0:ios(config)# enrollment retry period 2
RP/0/RP0/CPU0:ios(config)# rsakeypair mykey
RP/0/RP0/CPU0:ios(config)# end

Uncommitted changes found, commit them? [yes]:yes

! The following command authenticates the CA to your device.

RP/0/RP0/CPU0:ios(config)# crypto ca authenticate myca

! The following command requests certificates for all of your RSA key pairs.

RP/0/RP0/CPU0:ios(config)# crypto ca enroll myca

! The following command displays information about your certificate and the CA certificate.

RP/0/RP0/CPU0:ios# show crypto ca certificates
Cisco NCS 1004 is successfully configured to use the specified trustpoint CA and manual certificate enrollment via cut-and-paste. Certificates are authenticated, imported, and validated.

Public key pair capabilities in XR Config mode

A public key pair capability in XR Config mode is a security mechanism on Cisco NCS 1004 that

  • supports the generation of crypto key pairs in both FIPS (Federal Information Processing Standard) and non-FIPS modes,

  • enables selection of multiple key types and key sizes, and

  • controls overwriting, deleting, and viewing keys based on XR Config and XR EXEC mode distinctions.

Supported key types for non-FIPS and FIPS modes

The following table lists the key types and key sizes that are supported in non-FIPS and FIPS modes.

Table 1. Supported Key Types for non-FIPS and FIPS modes

Key Types

Non-FIPS mode

FIPS mode

RSA

Supported for all key sizes from 512 to 4096

Supported for key sizes 2048, 3072, and 4096

DSA

Supported for key sizes 512, 768, and 1024

Supported for key size 2048

ECDSA

Supported for key sizes nistp256, nistp384, and nistp512

Supported for key sizes nistp256, nistp384, and nistp512

ED25519

Supported

Not supported

Guidelines and restrictions

When you generate crypto key pairs in XR Config mode, the following guidelines and restrictions apply:

  • This feature does not support the generation of system-root-key and system-enroll-key .

  • The key pairs that are generated in XR Config mode overwrite any previously generated key pairs in XR EXEC mode.

  • Cisco NCS 1004 does not support overwriting key pairs that are generated in XR Config mode from XR EXEC mode.

  • When you run the no form of the crypto key generate command in XR Config mode, only the keys that are generated in XR Config mode are deleted.

  • Cisco NCS 1004 does not support deleting key pairs that are generated in XR Config mode from XR EXEC mode.

  • When you run the crypto key generate command in XR EXEC mode, the keys that are generated in XR Config mode are not overwritten or deleted.

  • The show crypto key mypubkey command displays the keys that are generated in XR EXEC mode first, followed by the keys that are generated in XR Config mode.

Configuration exampl

This example shows the creation of key pairs in XR Config mode:

RP/0/RP0/CPU0:ios# conf t
RP/0/RP0/CPU0:ios(config)# crypto key generate dsa 512
RP/0/RP0/CPU0:ios(config)# crypto key generate rsa user1 general-keys 2048
RP/0/RP0/CPU0:ios(config)# crypto key generate rsa user2 usage-keys 2048
RP/0/RP0/CPU0:ios(config)# crypto key generate rsa 2048
RP/0/RP0/CPU0:ios(config)# crypto key generate ecdsa nistp256
RP/0/RP0/CPU0:ios(config)# crypto key generate ecdsa nistp384
RP/0/RP0/CPU0:ios(config)# crypto key generate ecdsa nistp521
RP/0/RP0/CPU0:ios(config)# crypto key generate ed25519
RP/0/RP0/CPU0:ios(config)# commit

Use the no form of the command in XR Config mode to delete any of the key pairs.

System logs and error messages

Cisco NCS 1004 generates the following system logs on successful creation of key pairs:

cepki[287]: %SECURITY-CEPKI-6-KEY_INFO : crypto key DSA generated, label:the_default, modBits:1024
cepki[287]: %SECURITY-CEPKI-6-KEY_INFO : crypto key ECDSA_NISTP256 generated, label:the_default, modBits:256

Cisco NCS 1004 generates the following system logs on deletion of key pairs:

cepki[287]: %SECURITY-CEPKI-6-KEY_INFO : crypto key RSA zeroized, label:user1
cepki[287]: %SECURITY-CEPKI-6-KEY_INFO : crypto key DSA zeroized, label:the_default

Cisco NCS 1004 generates the following error messages if you try to overwrite key pairs that are generated in XR Config mode from XR EXEC mode:

RP/0/RP0/CPU0:ios# conf t
RP/0/RP0/CPU0:ios(config)# crypto key generate ed25519
RP/0/RP0/CPU0:ios(config)# commit
RP/0/RP0/CPU0:ios(config)# crypto key generate ed25519
Cannot execute the command : Operation not permitted
ce_cmd[68727]: %SECURITY-CEPKI-6-ERR_2 : Cannot       execute the command :   Operation not permitted
ce_cmd[68736]: %SECURITY-CEPKI-6-ERR : Key is added as part of config mode, key deletion is not allowed , delete key from config mode

Cisco NCS 1004 generates the following error messages if you try to delete key pairs that are generated in XR Config mode from XR EXEC mode:

RP/0/RP0/CPU0:ios# conf t
RP/0/RP0/CPU0:ios(config)# crypto key generate ed25519
RP/0/RP0/CPU0:ios(config)# commit
RP/0/RP0/CPU0:ios(config)# crypto key zeroize ed25519
Cannot execute the command : Operation not permitted
ce_cmd[68736]: %SECURITY-CEPKI-6-ERR_2 : Cannot execute the command :   Operation not permitted

Viewing the generated key pairs

You can view the key pairs that are generated in XR Config mode, listed under Public keys from config sysdb in the following command output:

RP/0/RP0/CPU0:ios# show crypto key mypubkey ecdsa
Key label: the_default
Type     : ECDSA General Curve Nistp256
Degree   : 256
Created  : 11:49:22 IST Wed Apr 21 2021
Data     :
 04D6D132 2253ABD0 81449E3F 9D5CEA3A 1107950A 829E9090 8960FBD5 ABA039B7
 24A4E217 7EA47475 91C60AC7 013DBC2E EA8434D9 0BD5B0FC 694913AE 0098A4F5
 77

Key label: the_default
Type     : ECDSA General Curve Nistp521
Degree   : 521
Created  : 22:44:22 IST Thu Mar 18 2021
Data     :
 04017798 4369F493 8D0E57D1 1975FC46 CDC03A78 03A9F90E B38CA504 17DB9A64
 D1DEA6A6 D23E7E20 4D8D4D31 C7878BDB BF5EEE40 1978A889 70C5D703 BB033B77
 0FFD9201 366A9AC8 35E69BB3 97FF4E91 6B498510 39425971 C5E43858 83286088
 A6A7BF92 0EA2B416 BD4E81CE DCEB65F1 15CC75B5 91204E89 3339A168 2382CAB6
 40170131 8F

-----------------------------
 Public keys from config sysdb:
 -----------------------------
 Key label: the_default
Type     : ECDSA General Curve Nistp384
Degree   : 384
Created  : 11:51:52 IST Wed Apr 21 2021
Data     :
 045F7C14 1A88C27E 9CED3FF1 7FEDFA03 B49575FA 7AD88370 BC9C7D7F F99C8917
 33620916 758BDEFC 7187E33A 2D3CCD33 14FF3267 9855A5E9 E3BD166C CE838462
 40742231 6198EE12 3E189F42 22A8149A 8E7B186D 88E728D4 7F47D565 53441061
 79