Configuration Guide for Cisco NCS 1004, IOS XR Release 25.x.x

How to implement CA interoperability

Updated: July 31, 2026

Want to summarize with AI?

Describes the end-to-end process to enable certification authority (CA) interoperability on Cisco NCS 1004 by configuring the device identity, generating keys, and establishing trust with the CA.

This process enables Cisco NCS 1004 devices to obtain digital certificates from a certification authority (CA) by ensuring device identity, key generation, and trustpoint configuration before requesting certificates.

Summary

The key components involved in the process are:

Network administrator: Configures the device identity, generates RSA key pairs, and declares the trustpoint that points to the CA.
Cisco NCS 1004: Stores the keys and trustpoint configuration, and uses them to interact with the CA.
Certification authority (CA): Issues the digital certificate that the device uses to establish trust with peers.

The process configures the prerequisites that the device needs before it can authenticate the CA and request certificates.

Workflow

The process involves the following stages:

Configure the hostname and IP domain name of Cisco NCS 1004 so that the device can build the fully qualified domain name (FQDN) that is used by IPSec keys and certificates. For details, see Configure hostname and IP domain name.
Generate an RSA key pair on Cisco NCS 1004. The device uses RSA keys to sign and encrypt IKE key management messages and to obtain a certificate from the CA. For details, see Generate RSA key pair.
Import the public key into Cisco NCS 1004 so that the device can authenticate the user. For details, see Import public key to Cisco NCS 1004.
Declare the CA and configure the trusted point so that Cisco NCS 1004 can verify certificates issued to peers. For details, see Declare certification authority and configure trusted point.

Result

Cisco NCS 1004 is ready to authenticate the CA and request its own certificates.

What’s next

After you complete this process, authenticate the CA on Cisco NCS 1004. For details, see Authenticate certification authority.

Configure the hostname and IP domain name on Cisco NCS 1004

Use this task to configure the hostname and IP domain name of Cisco NCS 1004.

You must configure the hostname and IP domain name of Cisco NCS 1004 if they are not already configured. The hostname and IP domain name are required because Cisco NCS 1004 assigns a fully qualified domain name (FQDN) to the keys and certificates that are used by IPSec, and the FQDN is based on the hostname and IP domain name that you assign to the Cisco NCS 1004 device. For example, a certificate that is named ncs1k.example.com is based on the Cisco NCS 1004 hostname of ncs1k and a device IP domain name of example.com.

Procedure

	1.	Enter the XR Config mode. Example: `RP/0/RP0/CPU0:ios#configure`
	2.	Configure the hostname of the Cisco NCS 1004 device. Example: `RP/0/RP0/CPU0:ios(config)# hostname myhost`
	3.	Configure the IP domain name of Cisco NCS 1004. Example: `RP/0/RP0/CPU0:ios(config)# domain name mydomain.com`
	4.	Save the configuration changes by using the commit or end command. Example: `RP/0/RP0/CPU0:ios(config)# commit RP/0/RP0/CPU0:ios(config)# end`

The hostname and IP domain name are configured, enabling Cisco NCS 1004 to generate the FQDN required for IPSec keys and certificates.

Generate an RSA key pair on Cisco NCS 1004

Enable secure key management and certificate enrollment for Cisco NCS 1004 devices by generating RSA key pairs.

RSA key pairs are required to sign and encrypt IKE key management messages and to obtain certificates from a certification authority. Cisco NCS 1004 automatically generates RSA keys at boot, but you should manually generate keys if none are present. Details for both RSA and DSA keys appear in the running configuration.

Note

RSA keys are auto-generated when Cisco NCS 1004 boots. Generate the key pair only if the RSA key pair is missing on the device.

The details of RSA and DSA keys are displayed in the running configuration.

Procedure

Generate the RSA key pairs using the command crypto key generate rsa [usage-keys | general-keys] [keypair-label]

Use the usage-keys keyword to specify special usage keys, or use the general-keys keyword to specify general-purpose RSA keys.
The keypair-label argument is the RSA key pair label that names the RSA key pairs.
You can also configure this command from XR Config mode. For details about generating key pairs in XR Config mode, see Public key pair generation in XR Config mode.

To delete the RSA keys, use the no form of the command: no crypto key generate rsa .

Example:

RP/0/RP0/CPU0:ios# crypto key generate rsa general-keys

(Optional) Delete all RSA keys from Cisco NCS 1004.

crypto key zeroize rsa [keypair-label]

Run the crypto key zeroize command only in EXEC mode.
Delete all RSA keys from Cisco NCS 1004 if you suspect that the keys are compromised and must no longer be used.
To remove a specific RSA key pair, use the keypair-label argument.
You can also delete key pairs with the no form of the command from XR Config mode. For details about deleting key pairs in XR Config mode, see Public key pair generation in XR Config mode.

Example:

RP/0/RP0/CPU0:ios# crypto key zeroize rsa key1

(Optional) Display the RSA public keys for Cisco NCS 1004.

show crypto key mypubkey rsa

The show running-config command also displays the RSA keys. The keys in the following example are in OpenSSL format.

Note

Only those keys that are generated in XR Config mode are visible in the running configuration.

Example:

RP/0/RP0/CPU0:ios# show crypto key mypubkey rsa
Fri Mar 27 14:00:20.954 IST
Key label: system-root-key
Type : RSA General purpose
Size : 2048
Created : 01:13:10 IST Thu Feb 06 2020
Data :
 30820122 300D0609 2A864886 F70D0101 01050003 82010F00 3082010A 02820101
 00A93DE0 1E485EE3 0E7F0964 C48361D1 B6014BE7 A303D8D6 F7790E92 88E69C4B
 B97B7A9C D1B277E3 1569093C 82BD3258 7F67FB49 94860ECD 34498F1F 59B45757
 F32C8E8F 7CEE23EC C36A43D1 9F85C0D9 B96A14DD DD3BBD4C A1FB0888 EED210A7
 39D9A403 7ACE0F6E 39107226 CA621AD8 6E8102CA 9761B86F D33F2871 9DD16559
 AFCB4729 EFCEDBAF 83DF76E4 9A439844 EE3B1180 4022F575 99E11A2C E25BB23D
 9DD74C81 4E5C1345 D9E3CC79 1B98B1AA 6C06F004 22B901EC 36C099FE 10DE2622
 EB7CE618 9A555769 12D94C90 D9BEE5EA A664E7F6 4DF8D8D4 FE7EAB07 1EF4FEAB
 22D9E55F 62BA66A0 72153CEC 81F2639F B5F2B5C5 25E10364 19387C6B E8DB8990
 11020301 0001
Key label: system-enroll-key
Type : RSA General purpose
Size : 2048
Created : 01:13:16 IST Thu Feb 06 2020
Data :
 30820122 300D0609 2A864886 F70D0101 01050003 82010F00 3082010A 02820101
 009DBC14 C83604E4 EB3D3CF8 5BA7FDDB 80F7E85B 427332D8 BBF80148 F0A9C281
 49F87D5C 0CEBA532 EBE797C5 7F174C69 0735D13A 493670CB 63B04A12 4BCA7134
 EE0031E9 047CAA1E 802030C5 6071E8C2 F8ECE002 CC3B54E7 5FD24E5C 61B7B7B0
 68FA2EFA 0B83799F 77AE4621 435D9DFF 1D713108 37B614D3 255020F9 09CD32E8
 82B07CD7 01A53896 6DD92B5D 5119597C 98D394E9 DBD1ABAF 6DE949FE 4A8BF1E7
 851EB3F4 60B1114A 1456723E 063E50C4 2D410906 BDB7590B F1D58480 F3FA911A
 6C9CD02A 58E68D04 E94C098F 0F0E81DB 76B40C55 64603499 2AC0547A D652412A
 BCBBF69F 76B351EE 9B2DF79D E490C0F6 92D1BB97 B905F33B FAB53C20 DDE2BB22
 C7020301 0001

RSA key pairs are generated on Cisco NCS 1004, enabling secure communication and certificate management. You can delete or display keys as needed for maintenance or troubleshooting.

Import a public key to Cisco NCS 1004

Import a public key to Cisco NCS 1004 to enable user authentication prior to digital certificate requests.a public key to Cisco NCS 1004.

Use this task when you need Cisco NCS 1004 to authenticate a user with a public key before requesting a certificate from the certification authority.

Procedure

Import the RSA public key using the command crypto key import authentication rsa [usage-keys | general-keys] [keypair-label] .

Use the usage-keys keyword to specify special usage keys, or use the general-keys keyword to specify general-purpose RSA keys.
The keypair-label argument is the RSA key pair label that names the RSA key pairs.

Example:

RP/0/RP0/CPU0:ios# crypto key import authentication rsa general-keys

(Optional) Display the RSA public keys for Cisco NCS 1004 using the show crypto key mypubkey rsa command.

The show running-config command also displays the RSA keys. The keys in the following example are in OpenSSL format.

Note

Only those keys that are generated in XR Config mode are visible in the running configuration.

Example:

RP/0/RP0/CPU0:ios# show crypto key mypubkey rsa
Fri Mar 27 14:00:20.954 IST
Key label: system-root-key
Type : RSA General purpose
Size : 2048
Created : 01:13:10 IST Thu Feb 06 2020
Data :
 30820122 300D0609 2A864886 F70D0101 01050003 82010F00 3082010A 02820101
 00A93DE0 1E485EE3 0E7F0964 C48361D1 B6014BE7 A303D8D6 F7790E92 88E69C4B
 B97B7A9C D1B277E3 1569093C 82BD3258 7F67FB49 94860ECD 34498F1F 59B45757
 F32C8E8F 7CEE23EC C36A43D1 9F85C0D9 B96A14DD DD3BBD4C A1FB0888 EED210A7
 39D9A403 7ACE0F6E 39107226 CA621AD8 6E8102CA 9761B86F D33F2871 9DD16559
 AFCB4729 EFCEDBAF 83DF76E4 9A439844 EE3B1180 4022F575 99E11A2C E25BB23D
 9DD74C81 4E5C1345 D9E3CC79 1B98B1AA 6C06F004 22B901EC 36C099FE 10DE2622
 EB7CE618 9A555769 12D94C90 D9BEE5EA A664E7F6 4DF8D8D4 FE7EAB07 1EF4FEAB
 22D9E55F 62BA66A0 72153CEC 81F2639F B5F2B5C5 25E10364 19387C6B E8DB8990
 11020301 0001
Key label: system-enroll-key
Type : RSA General purpose
Size : 2048
Created : 01:13:16 IST Thu Feb 06 2020
Data :
 30820122 300D0609 2A864886 F70D0101 01050003 82010F00 3082010A 02820101
 009DBC14 C83604E4 EB3D3CF8 5BA7FDDB 80F7E85B 427332D8 BBF80148 F0A9C281
 49F87D5C 0CEBA532 EBE797C5 7F174C69 0735D13A 493670CB 63B04A12 4BCA7134
 EE0031E9 047CAA1E 802030C5 6071E8C2 F8ECE002 CC3B54E7 5FD24E5C 61B7B7B0
 68FA2EFA 0B83799F 77AE4621 435D9DFF 1D713108 37B614D3 255020F9 09CD32E8
 82B07CD7 01A53896 6DD92B5D 5119597C 98D394E9 DBD1ABAF 6DE949FE 4A8BF1E7
 851EB3F4 60B1114A 1456723E 063E50C4 2D410906 BDB7590B F1D58480 F3FA911A
 6C9CD02A 58E68D04 E94C098F 0F0E81DB 76B40C55 64603499 2AC0547A D652412A
 BCBBF69F 76B351EE 9B2DF79D E490C0F6 92D1BB97 B905F33B FAB53C20 DDE2BB22
 C7020301 0001

The RSA public key is imported to Cisco NCS 1004, enabling the device to authenticate the user before requesting a digital certificate.

Declare a certification authority and configure a trusted point

Set up the certificate infrastructure by declaring a certification authority and configuring a trusted point on Cisco NCS 1004, allowing secure verification of certificates issued to peers.

Configuring a trusted point that references the CA enables Cisco NCS 1004 to request and verify certificates issued to peer devices for secure communication.

Procedure

	1.	Enter the XR Config mode. Example: `RP/0/RP0/CPU0:ios# configure`
	2.	Declare the CA, configure a trusted point with a selected name so that Cisco NCS 1004 can verify the certificates that are issued to peers, and enter trustpoint configuration mode. Example: `RP/0/RP0/CPU0:ios(config)# crypto ca trustpoint myca`
	3.	Specify the URL of the CA. The URL must include any non-standard cgi-bin script location. enrollment url CA-URL Example: `RP/0/RP0/CPU0:ios(config-trustp)# enrollment url http://ca.domain.com/certsrv/mscep/mscep.dll`
	4.	(Optional) Specify the location of the LDAP server if your CA system supports the LDAP protocol. query url LDAP-URL Example: `RP/0/RP0/CPU0:ios(config-trustp)# query url ldap://my-ldap.domain.com`
	5.	(Optional) Specify a retry period usnig the command enrollment retry period minutes . After Cisco NCS 1004 requests a certificate, the device waits to receive a certificate from the CA. If the device does not receive a certificate within the retry period, it sends another certificate request. The range is from 1 to 60 minutes. The default is 1 minute. Example: `RP/0/RP0/CPU0:ios(config-trustp)# enrollment retry period 2`
	6.	(Optional) Specify how many times Cisco NCS 1004 continues to send unsuccessful certificate requests before giving up. The range is from 1 to 100. Example: `RP/0/RP0/CPU0:ios(config-trustp)# enrollment retry count 10`
	7.	(Optional) Use the rsakeypair keypair-label command to specify a named RSA key pair that is generated by using the crypto key generate rsa command for this trustpoint. If you do not set this key pair, the trustpoint uses the default RSA key in the current configuration. Example: `RP/0/RP0/CPU0:ios(config-trustp)# rsakeypair mykey`
	8.	Save the configuration changes by using the commit or end command.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.