Introduces Public Key Infrastructure concepts and GUI-based management, highlighting restrictions such as CSR generation hanging indefinitely and providing foundational information for secure certificate administration.

A public key infrastructure (PKI) management is a network application tool that

enables graphical configuration of PKI components using GUI.
provides tabs for configuring and monitoring trustpoints, certificate authorities, keys, and certificates,
allows administrators to generate, enroll, and manage cryptographic credentials for secure communications, and

Feature history


Feature Name	Release	Description
Enhanced Certificate Management Through GUI	Cisco IOS XE 17.3.1	The PKI Management page now includes tabs for Trustpoints, CA Server, Key Pair Generation, and Certificate Management operations.

Tabs for PKI management in GUI

Trustpoints tab: Add, create, or enroll a new trustpoint, view the current trustpoints and their usage.
CA Server tab: Enable or disable Certificate Authority (CA) server functionality. This is required for generating a self-signed certificate (SSC).
Key Pair Generation tab: Generate key pairs.
Certificate Management tab: Generate and manage certificates, and perform all certificate-related operations.

Restriction: CSR generation on the GUI may hang indefinitely

The controller's GUI-based certificate management feature relies on Embedded Event Manager (EEM) scripts. If TACACS command authorization is enabled, the user is authenticated on the GUI but the controller does not pass the user details to the EEM environment. As a result, the user is not authorized, and the user cannot enter the configuration mode using the EEM scripts.

The restriction applies if you have this command-authorization configuration:

aaa authorization commands 1 MethodName group GroupName local if-authenticated
aaa authorization commands 15 MethodName group GroupName local if-authenticated
ip http authentication aaa command-authorization 1 MethodName
ip http authentication aaa command-authorization 15 MethodName

To resolve this issue, enter this command before you generate the Certificate Signing Request (CSR) using the GUI. For proper authorization, configure the desired username.

event manager session cli username <username>

After you issue the CSR using the GUI, remove this configuration.

The restriction does not affect CSR generation through the CLI.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.