Details GUI-driven configuration tasks for PKI, including trustpoint authentication and enrollment, AP self-signed certificate generation, CA server addition, RSA or EC key setup, and certificate management, covering CSR generation and PKCS12 import procedures.

Generate an AP self-signed certificate (GUI)

Create a self-signed certificate (SSC) for APs on a virtual controller using the graphical interface.

Use this procedure only for virtual controllers.

Cisco Catalyst 9800-CL Wireless Controller for Cloud
Cisco Catalyst 9800-40 Wireless Controller
Cisco Catalyst 9800-80 Wireless Controller
Cisco Catalyst 9800-L Wireless Controller (Copper uplink)
Cisco Catalyst 9800-L Wireless Controller (Fiber uplink)

Procedure

	1.	Choose Configuration > Security > PKI Management.
	2.	In the AP SSC Trustpoint area, click Generate to generate an AP SSC trustpoint.
	3.	From the RSA Key-Size drop-down list, choose a key size.
	4.	From the Signature Algorithm drop-down list, choose an option.
	5.	From the Password Type drop-down list, choose a password type.
	6.	In the Password field, enter a password. The valid range is between 8 and 32 characters.
	7.	Click Apply to Device.

The controller creates and applies a new self-signed certificate for the AP.

Add the CA server (GUI)

Perform this task when you need to establish a new certificate authority for PKI management.

Procedure

	1.	Choose Configuration > Security > PKI Management.
	2.	In the PKI Management window, click the CA Server tab.
	3.	In the CA Server section, click the Shutdown Status to enable the status. If you choose the shutdown status as Enabled, enter and confirm the password.
	4.	If you choose the shutdown status as Disabled, you must enter the Country Code, State, Location, Organization, Domain Name, and Email Address.
	5.	Click Apply to add the CA server.
	6.	Click Remove CA Server to delete the CA server.

The certificate authority server is added and configured as specified.

Add an RSA or EC Key for PKI trustpoint (GUI)

To enable certificate-based authentication, add an RSA or EC key to a PKI trustpoint.

Procedure

	1.	Choose Configuration > Security > PKI Management.
	2.	In the PKI Management window, click the Key Pair Generation tab.
	3.	In the Key Pair Generation section, click Add.
	4.	In the dialog box that is displayed, provide this information: Note To allow Japanese characters in Key Name field, ensure that the line vty configuration includes "exec-character-bits 8". Note To allow Japanese characters in Key Name field, ensure that the line vty configuration includes "exec-character-bits 8". In the Key Name field, enter the key name. In the Key Type options, select either RSA Key or EC Key. In the Modulus Size field, enter the modulus value for the RSA key or the EC key. The default modulus size for the RSA key is 4096 and the default value for the EC key is 521. Check the Key Exportable check box to export the key. By default, this is checked. Click Generate.

A new RSA or EC key is created for the PKI trustpoint and is ready for use in certificate operations.

Add and manage certificates

To add and manage certificates, use one of these methods.

Generate and import a certificate signing request (CSR)

Secure the system by adding and managing device certificates.

Perform this task when onboarding a new device, renewing expiring certificates, or updating trust relationships.

Before you begin

When configuring a password for the .pfx file, avoid using these ASCII characters: "*, ^, (), [], \, ", and +". Using these ASCII characters results in a configuration error and prevents the certificate from being imported to the controller.
Ensure you have the required certificate files and CA information.

Before you begin

You can add and manage certificates using either of the following methods:

Procedure

	1.	Choose Configuration > Security > PKI Management > Add Certificate.
	2.	Click Generate Certificate Signing Request. In the Certificate Name field, enter the certificate name. From the Key Name drop-down list, choose an RSA key pair. (Click the plus (+) icon under the Key Pair Generation tab to create new RSA key pairs.). Enter values in the Country Code, Location, Organization, State, Organizational Unit, and the Domain Name fields. Click Generate. The generated Certificate Signing Request (CSR) is displayed on the right. Click Copy to copy and save a local copy. Click Save to Device to save the generated CSR to the /bootflash/csr directory. Note If an IP address is used on the Domain Name field the controller creates the CSR without a Subject Alternative Name (SAN), since the IP address is not supported as an attribute in the SAN field of the CSR when the CSR is generated from the controller.
	3.	Click Authenticate Root CA. From the Trustpoint drop-down list, choose the trustpoint label generated in Step 2, or any other trustpoint label that you want to authenticate. In the Root CA Certificate (.pem) field, copy and paste the certificate that you have received from the CA. Note Ensure that you copy and paste the PEM Base64 certificate of the issuing CA of the device certificate. Click Authenticate.
	4.	Click Import Device Certificate. From the Trustpoint drop-down list, choose the trustpoint label that was generated in Step 2, or any other trustpoint label that you want to authenticate. In the Signed Certificate (.pem) field, copy and paste the signed certificate that you received, from your CA. Click Import.

This completes the device certificate import process and the certificate can now be assigned to features.

Import a PKCS12 certificate

Import a PKCS12 certificate into the system to enable secure authentication and encryption for network communications.

Use this task when you need to install a PKCS12 certificate file for system, server, or application authentication.

The certificate can be located on any of these sources: FTP, SFTP, TFTP, SCP, or Desktop (HTTPS).

Before you begin

Obtain the PKCS12 certificate file and its password.

Procedure

Click Import PKCS12 Certificate.

From the Transport Type drop-down list, choose either FTP, SFTP, TFTP, SCP, or Desktop (HTTPS).

Transport Type	Action
For FTP, SFTP, and SCP	enter values in the Server IP Address (IPv4/IPv6), Username, Password, Certificate File Path, Certificate Destination File Name, and Certificate Password fields.
For TFTP	enter values in the Server IP Address (IPv4/IPv6), Certificate File Path, Certificate Destination File Name, and Certificate Password fields.
For Desktop (HTTPS)	enter values in the Source File Path and Certificate Password fields.

Click Import.

The system imports the PKCS12 certificate. You see a confirmation message when the process completes successfully.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.