To generate a Rivest, Shamir, and Adelman (RSA) key pair, use the crypto key generate rsa command in XR EXEC mode and XR Config mode. .
crypto key generate rsa [usage-keys | general-keys | system-enroll-key | system-root-key] [keypair-label]
Syntax Description
|
usage-keys
|
(Optional) Generates separate RSA key pairs for signing and encryption.
|
|
general-keys
|
(Optional) Generates a general-purpose RSA key pair for signing and encryption.
|
|
keypair-label
|
(Optional) RSA key pair label that names the RSA key pairs.
|
| system-enroll-key |
Specifies key pair generation for the leaf certificate.
Note: Crypto key generation in XR Config Mode does not support this option.
|
| system-root-key |
Specifies key pair generation for the root certificate.
Note: Crypto key generation in XR Config Mode does not support this option.
|
Command Default
RSA key pairs do not exist.
The default RSA key is 3072 bits.
Command Modes
XR EXEC mode and XR Config mode
Command History
|
Release
|
Modification
|
|
Release 26.1.1
|
The default size for RSA keys is 3072 bits from this release.
|
| Release 7.3.2 |
This command was introduced in XR Config mode
|
|
Release 7.0.12
|
This command was introduced in XR EXEC mode.
|
Usage Guidelines
Use the crypto key generate rsa command to generate RSA key pairs for your router.
RSA keys are generated in pairs—one public RSA key and one private RSA key.
If your router already has RSA keys when you issue this command, you are warned and prompted to replace the existing keys
with new keys. The keys generated by this command are saved in the secure NVRAM (which is not displayed to the user or backed
up to another device).
If the usage-keys keyword is not used, general-purpose keys are generated. If no RSA label is specified, the key is generated as the default
RSA key.
To remove an RSA key generated in XR Config mode, use no form of this command in XR Config mode.
To remove an RSA key generated in XR EXEC mode, use the crypto key zeroize rsa command.
Starting with Cisco IOS XR Release 26.1.1, the default RSA key size is 3072 bits; any RSA key < 3072 bits makes the host SSH
key weak, triggering a syslog warning during the system boot or process restart.
Task ID
|
Task ID
|
Operations
|
|
crypto
|
execute
|
Examples
The following example shows how to generate an RSA key pair:
Router# crypto key generate rsa
The name for the keys will be: the_default
Choose the size of the key modulus in the range of 360 to 2048 for your
General Purpose Keys. Choosing a key modulus greater than 512 may take
a few minutes.
How many bits in the modulus[3072]: <return>
Router#
This example shows how to generate an RSA key pair for the root certificate:
Router#crypto key generate rsa system-root-key
This example shows how to generate an RSA key pair for the leaf certificate:
Router#crypto key generate rsa system-enroll-key
The following example shows how to generate an RSA key-pair in XR Config mode:
Router#conf t
Router(config)#crypto key generate rsa user1 general-keys 3072
Router(config)#commit
This example shows how to delete en RSA key-pair in XR Config mode:
Router# conf t
Router(config)#no crypto key generate rsa user1 general-keys 3072
Router(config)#commit
The router sends a syslog warning if the DSA keys and weak RSA keys are found during the system boot or process restart.Router# process restart cepki
Tue Dec 9 04:50:55.396 UTC
RP/0/RP0/CPU0:Dec 9 04:50:55.445 UTC: sysmgr_control[66932]: %OS-SYSMGR-4-PROC_RESTART_NAME : User cafyauto (con0_RP0_CPU0) requested a restart of process cepki at 0/RP0/CPU0
Router#
This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply third-party
authority to import, export, distribute or use encryption. Importers,
exporters, distributors and users are responsible for compliance with
U.S. and local country laws. By using this product you agree to comply
with applicable laws and regulations. If you are unable to comply with
U.S. and local laws, return this product immediately.
A summary of U.S. laws governing Cisco cryptographic products may be
found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by sending email to
export@cisco.com.
RP/0/RP0/CPU0:Dec 9 04:50:56.430 UTC: cepki[277]: %INFRA-WARN_INSECURE-4-INSECURE_FEATURE_WARN : Feature 'Weak RSA SSH host key present' utilized or configured. This feature is deprecated as it is known to be insecure; it will be removed in a future release. Consider upgrading RSA (crypto key generate rsa) to at least 3072 bits
Feedback