Configuration Examples for PKI Certificate Enrollment Requests

Configuring Certificate Enrollment or Autoenrollment Example

The following example shows the configuration for the “mytp-A” certificate server and its associated trustpoint, where RSA keys generated by the initial autoenrollment for the trustpoint will be stored on a USB token, “usbtoken0”:

crypto pki server mytp-A

database level complete

issuer-name CN=company, L=city, C=country

grant auto

! Specifies that certificate requests will be granted automatically.

!

crypto pki trustpoint mytp-A

revocation-check none

rsakeypair myTP-A

storage usbtoken0:

! Specifies that keys will be stored on usbtoken0:.

on usbtoken0:

! Specifies that keys generated on initial auto enroll will be generated on and stored on ! usbtoken0:

Configuring Autoenrollment Example

The following example shows how to configure the router to automatically enroll with a CA on startup, enabling automatic rollover, and how to specify all necessary enrollment information in the configuration:

crypto pki trustpoint trustpt1

enrollment url http://trustpt1.example.com//

subject-name OU=Spiral Dept., O=example.com

ip-address ethernet-0

serial-number none

usage ike

auto-enroll regenerate

password password1

rsa-key trustpt1 2048

!

crypto pki certificate chain trustpt1

certificate pki 0B

30820293 3082023D A0030201 0202010B 300D0609 2A864886 F70D0101 04050030

79310B30 09060355 04061302 5553310B 30090603 55040813 02434131 15301306

0355040A 130C4369 73636F20 53797374 656D3120 301E0603 55040B13 17737562

6F726420 746F206B 6168756C 75692049 50495355 31243022 06035504 03131B79

6E692D75 31302043 65727469 66696361 7465204D 616E6167 6572301E 170D3030

30373134 32303536 32355A17 0D303130 37313430 31323834 335A3032 310E300C

06035504 0A130543 6973636F 3120301E 06092A86 4886F70D 01090216 11706B69

2D343562 2E636973 636F2E63 6F6D305C 300D0609 2A864886 F70D0101 01050003

4B003048 024100B3 0512A201 3B4243E1 378A9703 8AC5E3CE F77AF987 B5A422C4

15E947F6 70997393 70CF34D6 63A86B9C 4347A81A 0551FC02 ABA62360 01EF7DD2

6C136AEB 3C6C3902 03010001 A381F630 81F3300B 0603551D 0F040403 02052030

1C060355 1D110415 30138211 706B692D 3435622E 63697363 6F2E636F 6D301D06

03551D0E 04160414 247D9558 169B9A21 23D289CC 2DDA2A9A 4F77C616 301F0603

551D2304 18301680 14BD742C E892E819 1D551D91 683F6DB2 D8847A6C 73308185

0603551D 1F047E30 7C307AA0 3CA03AA4 38303631 0E300C06 0355040A 13054369

73636F31 24302206 03550403 131B796E 692D7531 30204365 72746966 69636174

65204D61 6E616765 72A23AA4 38303631 0E300C06 0355040A 13054369 73636F31

24302206 03550403 131B796E 692D7531 30204365 72746966 69636174 65204D61

6E616765 72300D06 092A8648 86F70D01 01040500 03410015 BC7CECF9 696697DF

E887007F 7A8DA24F 1ED5A785 C5C60452 47860061 0C18093D 08958A77 5737246B

0A25550A 25910E27 8B8B428E 32F8D948 3DD1784F 954C70

quit

NoteIn this example, keys are neither regenerated nor rolled over.

Configuring Certificate Autoenrollment with Key Regeneration Example

The following example shows how to configure the router to automatically enroll with the CA named “trustme1” on startup and enable automatic rollover. The regenerate keyword is issued, so a new key will be generated for the certificate and reissued when the automatic rollover process is initiated. The renewal percentage is configured as 90 so if the certificate has a lifetime of one year, a new certificate is requested 36.5 days before the old certificate expires. The changes made to the running configuration are saved to the NVRAM startup configuration because autoenrollment will not update NVRAM if the running configuration has been modified but not written to NVRAM.

crypto pki trustpoint trustme1

enrollment url http://trustme1.example.com/

subject-name OU=Spiral Dept., O=example.com

ip-address ethernet0

serial-number none

auto-enroll 90 regenerate

password password1

rsakeypair trustme1 2048

exit

crypto pki authenticate trustme1

copy system:running-config nvram:startup-config

Configuring Cut-and-Paste Certificate Enrollment Example

The following example shows how to configure certificate enrollment using the manual cut-and-paste enrollment method:

Router(config)#

crypto pki trustpoint TP

Router(ca-trustpoint)#

enrollment terminal

Router(ca-trustpoint)#

crypto pki authenticate TP

Enter the base 64 encoded CA certificate.

End with a blank line or the word "quit" on a line by itself

-----BEGIN CERTIFICATE-----

MIICNDCCAd6gAwIBAgIQOsCmXpVHwodKryRoqULV7jANBgkqhkiG9w0BAQUFADA5

MQswCQYDVQQGEwJVUzEWMBQGA1UEChMNQ2lzY28gU3lzdGVtczESMBAGA1UEAxMJ

bXNjYS1yb290MB4XDTAyMDIxNDAwNDYwMVoXDTA3MDIxNDAwNTQ0OFowOTELMAkG

A1UEBhMCVVMxFjAUBgNVBAoTDUNpc2NvIFN5c3RlbXMxEjAQBgNVBAMTCW1zY2Et

cm9vdDBcMA0GCSqGSIb3DQEBAQUAA0sAMEgCQQCix8nIGFg+wvy3BjFbVi25wYoG

K2N0HWWHpqxFuFhqyBnIC0OshIn9CtrdN3JvUNHr0NIKocEwNKUGYmPwWGTfAgMB

AAGjgcEwgb4wCwYDVR0PBAQDAgHGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYE

FKIacsl6dKAfuNDVQymlSp7esf8jMG0GA1UdHwRmMGQwL6AtoCuGKWh0dHA6Ly9t

c2NhLXJvb3QvQ2VydEVucm9sbC9tc2NhLXJvb3QuY3JsMDGgL6AthitmaWxlOi8v

XFxtc2NhLXJvb3RcQ2VydEVucm9sbFxtc2NhLXJvb3QuY3JsMBAGCSsGAQQBgjcV

AQQDAgEAMA0GCSqGSIb3DQEBBQUAA0EAeuZkZMX9qkoLHfETYTpVWjZPQbBmwNRA

oJDSdYdtL3BcI/uLL5q7EmODyGfLyMGxuhQYx5r/40aSQgLCqBq+yg==

-----END CERTIFICATE-----

Certificate has the following attributes:

Fingerprint: D6C12961 CD78808A 4E02193C 0790082A

% Do you accept this certificate? [yes/no]:

y

Trustpoint CA certificate accepted.

% Certificate successfully imported

Router(config)#

crypto pki enroll TP

% Start certificate enrollment..

% The subject name in the certificate will be:

Router.example.com

% Include the router serial number in the subject name? [yes/no]:

n

% Include an IP address in the subject name? [no]:

n

Display Certificate Request to terminal? [yes/no]:

y

Signature key certificate request -

Certificate Request follows:

MIIBhTCB7wIBADAlMSMwIQYJKoZIhvcNAQkCFhRTYW5kQmFnZ2VyLmNpc2NvLmNv

bTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAxdhXFDiWAn/hIZs9zfOtssKA

daoWYu0ms9Fe/Pew01dh14vXdxgacstOs2Pr5wk6jLOPxpvxOJPWyQM6ipLmyVxv

ojhyLTrVohrh6Dnqcvk+G/5ohss9o9RxvONwx042pQchFnx9EkMuZC7evwRxJEqR

mBHXBZ8GmP3jYQsjS8MCAwEAAaAhMB8GCSqGSIb3DQEJDjESMBAwDgYDVR0PAQH/

BAQDAgeAMA0GCSqGSIb3DQEBBAUAA4GBAMT6WtyFw95POY7UtF+YIYHiVRUf4SCq

hRIAGrljUePLo9iTqyPU1Pnt8JnIZ5P5BHU3MfgP8sqodaWub6mubkzaohJ1qD06

O87fnLCNid5Tov5jKogFHIki2EGGZxBosUw9lJlenQdNdDPbJc5LIWdfDvciA6jO

Nl8rOtKnt8Q+

!

!

!

Redisplay enrollment request? [yes/no]:

Encryption key certificate request -

Certificate Request follows:

MIIBhTCB7wIBADAlMSMwIQYJKoZIhvcNAQkCFhRTYW5kQmFnZ2VyLmNpc2NvLmNv

bTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAwG60QojpDbzbKnyj8FyTiOcv

THkDP7XD4vLT1XaJ409z0gSIoGnIcdFtXhVlBWtpq3/O9zYFXr1tH+BMCRQi3Lts

0IpxYa3D9iFPqev7SPXpsAIsY8a6FMq7TiwLObqiQjLKL4cbuV0Frjl0Yuv5A/Z+

kqMOm7c+pWNWFdLe9lsCAwEAAaAhMB8GCSqGSIb3DQEJDjESMBAwDgYDVR0PAQH/

BAQDAgUgMA0GCSqGSIb3DQEBBAUAA4GBACF7feURj/fJMojPBlR6fa9BrlMJx+2F

H91YM/CIiz2n4mHTeWTWKhLoT8wUfa9NGOk7yi+nF/F7035twLfq6n2bSCTW4aem

8jLMMaeFxwkrV/ceQKrucmNC1uVx+fBy9rhnKx8j60XE25tnp1U08r6om/pBQABU

eNPFhozcaQ/2

!

!

!

Redisplay enrollment request? [yes/no]:

n

Router(config)#

crypto pki import TP certificate

Enter the base 64 encoded certificate.

End with a blank line or the word "quit" on a line by itself

MIIDajCCAxSgAwIBAgIKFN7C6QAAAAAMRzANBgkqhkiG9w0BAQUFADA5MQswCQYD

VQQGEwJVUzEWMBQGA1UEChMNQ2lzY28gU3lzdGVtczESMBAGA1UEAxMJbXNjYS1y

b290MB4XDTAyMDYwODAxMTY0MloXDTAzMDYwODAxMjY0MlowJTEjMCEGCSqGSIb3

DQEJAhMUU2FuZEJhZ2dlci5jaXNjby5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0A

MIGJAoGBAMXYVxQ4lgJ/4SGbPc3zrbLCgHWqFmLtJrPRXvz3sNNXYdeL13cYGnLL

TrNj6+cJOoyzj8ab8TiT1skDOoqS5slcb6I4ci061aIa4eg56nL5Phv+aIbLPaPU

cbzjcMdONqUHIRZ8fRJDLmQu3r8EcSRKkZgR1wWfBpj942ELI0vDAgMBAAGjggHM

MIIByDALBgNVHQ8EBAMCB4AwHQYDVR0OBBYEFL8Quz8dyz4EGIeKx9A8UMNHLE4s

MHAGA1UdIwRpMGeAFKIacsl6dKAfuNDVQymlSp7esf8joT2kOzA5MQswCQYDVQQG

EwJVUzEWMBQGA1UEChMNQ2lzY28gU3lzdGVtczESMBAGA1UEAxMJbXNjYS1yb290

ghA6wKZelUfCh0qvJGipQtXuMCIGA1UdEQEB/wQYMBaCFFNhbmRCYWdnZXIuY2lz

Y28uY29tMG0GA1UdHwRmMGQwL6AtoCuGKWh0dHA6Ly9tc2NhLXJvb3QvQ2VydEVu

cm9sbC9tc2NhLXJvb3QuY3JsMDGgL6AthitmaWxlOi8vXFxtc2NhLXJvb3RcQ2Vy

dEVucm9sbFxtc2NhLXJvb3QuY3JsMIGUBggrBgEFBQcBAQSBhzCBhDA/BggrBgEF

BQcwAoYzaHR0cDovL21zY2Etcm9vdC9DZXJ0RW5yb2xsL21zY2Etcm9vdF9tc2Nh

LXJvb3QuY3J0MEEGCCsGAQUFBzAChjVmaWxlOi8vXFxtc2NhLXJvb3RcQ2VydEVu

cm9sbFxtc2NhLXJvb3RfbXNjYS1yb290LmNydDANBgkqhkiG9w0BAQUFAANBAJo2

r6sHPGBdTQX2EDoJpR/A2UHXxRYqVSHkFKZw0z31r5JzUM0oPNUETV7mnZlYNVRZ

CSEX/G8boi3WOjz9wZo=

% Router Certificate successfully imported

Router(config)#

crypto pki import TP cert

Enter the base 64 encoded certificate.

End with a blank line or the word "quit" on a line by itself

MIIDajCCAxSgAwIBAgIKFN7OBQAAAAAMSDANBgkqhkiG9w0BAQUFADA5MQswCQYD

VQQGEwJVUzEWMBQGA1UEChMNQ2lzY28gU3lzdGVtczESMBAGA1UEAxMJbXNjYS1y

b290MB4XDTAyMDYwODAxMTY0NVoXDTAzMDYwODAxMjY0NVowJTEjMCEGCSqGSIb3

DQEJAhMUU2FuZEJhZ2dlci5jaXNjby5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0A

MIGJAoGBAMButEKI6Q282yp8o/Bck4jnL0x5Az+1w+Ly09V2ieNPc9IEiKBpyHHR

bV4VZQVraat/zvc2BV69bR/gTAkUIty7bNCKcWGtw/YhT6nr+0j16bACLGPGuhTK

u04sCzm6okIyyi+HG7ldBa45dGLr+QP2fpKjDpu3PqVjVhXS3vZbAgMBAAGjggHM

MIIByDALBgNVHQ8EBAMCBSAwHQYDVR0OBBYEFPDO29oRdlEUSgBMg6jZR+YFRWlj

MHAGA1UdIwRpMGeAFKIacsl6dKAfuNDVQymlSp7esf8joT2kOzA5MQswCQYDVQQG

EwJVUzEWMBQGA1UEChMNQ2lzY28gU3lzdGVtczESMBAGA1UEAxMJbXNjYS1yb290

ghA6wKZelUfCh0qvJGipQtXuMCIGA1UdEQEB/wQYMBaCFFNhbmRCYWdnZXIuY2lz

Y28uY29tMG0GA1UdHwRmMGQwL6AtoCuGKWh0dHA6Ly9tc2NhLXJvb3QvQ2VydEVu

cm9sbC9tc2NhLXJvb3QuY3JsMDGgL6AthitmaWxlOi8vXFxtc2NhLXJvb3RcQ2Vy

dEVucm9sbFxtc2NhLXJvb3QuY3JsMIGUBggrBgEFBQcBAQSBhzCBhDA/BggrBgEF

BQcwAoYzaHR0cDovL21zY2Etcm9vdC9DZXJ0RW5yb2xsL21zY2Etcm9vdF9tc2Nh

LXJvb3QuY3J0MEEGCCsGAQUFBzAChjVmaWxlOi8vXFxtc2NhLXJvb3RcQ2VydEVu

cm9sbFxtc2NhLXJvb3RfbXNjYS1yb290LmNydDANBgkqhkiG9w0BAQUFAANBAHaU

hyCwLirUghNxCmLzXRG7C3W1j0kSX7a4fX9OxKR/Z2SoMjdMNPPyApuh8SoT2zBP

ZKjZU2WjcZG/nZF4W5k=

% Router Certificate successfully imported

You can verify that the certificate was successfully imported by issuing the show crypto pki certificates command:

Router#show crypto pki certificates

Certificate

Status: Available

Certificate Serial Number: 14DECE05000000000C48

Certificate Usage: Encryption

Issuer:

CN = TPCA-root

O = Company

C = US

Subject:

Name: Router.example.com

OID.1.2.840.113549.1.9.2 = Router.example.com

CRL Distribution Point:

http://tpca-root/CertEnroll/tpca-root.crl

Validity Date:

start date: 18:16:45 PDT Jun 7 2002

end date: 18:26:45 PDT Jun 7 2003

renew date: 16:00:00 PST Dec 31 1969

Associated Trustpoints: TP

Certificate

Status: Available

Certificate Serial Number: 14DEC2E9000000000C47

Certificate Usage: Signature

Issuer:

CN = tpca-root

O = company

C = US

Subject:

Name: Router.example.com

OID.1.2.840.113549.1.9.2 = Router.example.com

CRL Distribution Point:

http://tpca-root/CertEnroll/tpca-root.crl

Validity Date:

start date: 18:16:42 PDT Jun 7 2002

end date: 18:26:42 PDT Jun 7 2003

renew date: 16:00:00 PST Dec 31 1969

Associated Trustpoints: TP

CA Certificate

Status: Available

Certificate Serial Number: 3AC0A65E9547C2874AAF2468A942D5EE

Certificate Usage: Signature

Issuer:

CN = tpca-root

O = Company

C = US

Subject:

CN = tpca-root

O = company

C = US

CRL Distribution Point:

http://tpca-root/CertEnroll/tpca-root.crl

Validity Date:

start date: 16:46:01 PST Feb 13 2002

end date: 16:54:48 PST Feb 13 2007

Associated Trustpoints: TP

Configuring Manual Certificate Enrollment with Key Regeneration Example

The following example shows how to regenerate new keys with a manual certificate enrollment from the CA named “trustme2”:

crypto pki trustpoint trustme2

enrollment url http://trustme2.example.com/

subject-name OU=Spiral Dept., O=example.com

ip-address ethernet0

serial-number none

regenerate

password password1

rsakeypair trustme2 2048

exit

crypto pki authenticate trustme2

crypto pki enroll trustme2

Creating and Verifying a Persistent Self-Signed Certificate Example

The following example shows how to declare and enroll a trustpoint named “local” and generate a self-signed certificate with an IP address:

crypto pki trustpoint local

enrollment selfsigned

end

configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

crypto pki enroll local

Nov 29 20:51:13.067: %SSH-5-ENABLED: SSH 1.99 has been enabled

Nov 29 20:51:13.267: %CRYPTO-6-AUTOGEN: Generated new 512 bit key pair

% Include the router serial number in the subject name? [yes/no]: yes

% Include an IP address in the subject name? [no]: yes

Enter Interface name or IP Address[]: ethernet 0

Generate Self Signed Router Certificate? [yes/no]: yes

Router Self Signed Certificate successfully created

NoteA router can have only one self-signed certificate. If you attempt to enroll a trustpoint configured for a self-signed certificate and one already exists, you receive a notification and are asked if you want to replace it. If so, a new self-signed certificate is generated to replace the existing one.Enabling the HTTPS Server Example

The following example shows how to enable the HTTPS server and generate a default trustpoint because one was not previously configured:

configure terminal

Enter configuration commands, one per line. End with CNTL/Z.

ip http secure-server

% Generating 1024 bit RSA keys ...[OK]

*Dec 21 19:14:15.421:%PKI-4-NOAUTOSAVE:Configuration was modified. Issue "write memory" to save new certificate

Router(config)#

NoteYou need to save the configuration to NVRAM if you want to keep the self-signed certificate and have the HTTPS server enabled following router reloads.

The following message also appears:

*Dec 21 19:14:10.441:%SSH-5-ENABLED:SSH 1.99 has been enabled

NoteCreation of the key pair used with the self-signed certificate causes the Secure Shell (SSH) server to start. This behavior cannot be suppressed. You may want to modify your Access Control Lists (ACLs) to permit or deny SSH access to the router. You can use the ip ssh rsa keypair-name unexisting-key-pair-name command to disable the SSH server.

Verifying the Self-Signed Certificate Configuration Example

The following example displays information about the self-signed certificate that you just created:

Router# show crypto pki certificates

Router Self-Signed Certificate

Status: Available

Certificate Serial Number: 01

Certificate Usage: General Purpose

Issuer:

cn=IOS-Self-Signed-Certificate-3326000105

Subject:

Name: IOS-Self-Signed-Certificate-3326000105

cn=IOS-Self-Signed-Certificate-3326000105

Validity Date:

start date: 19:14:14 GMT Dec 21 2004

end date: 00:00:00 GMT Jan 1 2020

Associated Trustpoints: TP-self-signed-3326000105

NoteThe number 3326000105 is the router’s serial number and varies depending on the router’s actual serial number.

The following example displays information about the key pair corresponding to the self-signed certificate:

Router# show crypto key mypubkey rsa

% Key pair was generated at: 19:14:10 GMT Dec 21 2004

Key name: TP-self-signed-3326000105

Usage: General Purpose Key

Key is not exportable.

Key Data:

30819F30 0D06092A 864886F7 0D010101 05000381 8D003081 89028181 00B88F70

6BC78B6D 67D6CFF3 135C1D91 8F360292 CA44A032 5AC1A8FD 095E4865 F8C95A2B

BFD1C2B7 E64A3804 9BBD7326 207BD456 19BAB78B D075E78E 00D2560C B09289AE

6DECB8B0 6672FB3A 5CDAEE92 9D4C4F71 F3BCB269 214F6293 4BA8FABF 9486BCFC

2B941BCA 550999A7 2EFE12A5 6B7B669A 2D88AB77 39B38E0E AA23CB8C B7020301 0001

% Key pair was generated at: 19:14:13 GMT Dec 21 2004

Key name: TP-self-signed-3326000105.server

Usage: Encryption Key

Key is not exportable.

Key Data:

307C300D 06092A86 4886F70D 01010105 00036B00 30680261 00C5680E 89777B42

463E5783 FE96EA9E F446DC7B 70499AF3 EA266651 56EE29F4 5B003D93 2FC9F81D

8A46E12F 3FBAC2F3 046ED9DD C5F27C20 1BBA6B9B 08F16E45 C34D6337 F863D605

34E30F0E B4921BC5 DAC9EBBA 50C54AA0 BF551BDD 88453F50 61020301 0001

NoteThe second key pair with the name TP-self-signed-3326000105.server is the SSH key pair and is generated when any key pair is created on the router and SSH starts up.

The following example displays information about the trustpoint named “local”:

Router# show crypto pki trustpoints

Trustpoint local:

Subject Name:

serialNumber=C63EBBE9+ipaddress=10.3.0.18+hostname=test.example.com

Serial Number: 01

Persistent self-signed certificate trust point

Configuring Direct HTTP Enrollment Example

The following example show how to configure an enrollment profile for direct HTTP enrollment with a CA server:

crypto pki trustpoint Entrust

enrollment profile E

serial

crypto pki profile enrollment E

authentication url http://entrust:81

authentication command GET /certs/cacert.der

enrollment url http://entrust:81/cda-cgi/clientcgi.exe

enrollment command POST reference_number=$P2&authcode=$P1

&retrievedAs=rawDER&action=getServerCert&pkcs10Request=$REQ

parameter 1 value aaaa-bbbb-cccc

parameter 2 value 5001