RSA and Certificate Commands

This chapter contains the following sections:

• crypto key generate dsa, on page 2

• crypto key generate rsa, on page 3

• crypto key import, on page 4

• show crypto key, on page 6

• crypto certificate generate, on page 7

• crypto certificate request, on page 9

• crypto certificate import, on page 11

• show crypto certificate, on page 15

• show crypto certificate chain, on page 17

RSA and Certificate Commands

crypto key generate dsa

The crypto key generate dsa Global Configuration mode command generates a DSA key pair for SSH

Public-Key authentication.

Syntax

crypto key generate dsa

Default Configuration

The application creates a default key automatically.

Command Mode

Global Configuration mode

User Guidelines

The size of the created DSA key is 1024 bits

DSA keys are generated in pairs - one public DSA key and one private DSA key.

If the device already has DSA keys default or user defined, a warning is displayed with a prompt to replace

the existing keys with new keys.

Erasing the startup configuration or returning to factory defaults automatically deletes the default keys and

they are recreated during device initialization.

This command is not saved in the Running configuration file. However, the keys generated by this command

are saved to the Running Configuration file.

Example

The following example generates a DSA key pair.

switchxxxxxx(config)# crypto key generate dsa

The SSH service is generating a private DSA key.

This may take a few minutes, depending on the key size.

..........

RSA and Certificate Commands

crypto key generate dsa

crypto key generate rsa

The crypto key generate rsa Global Configuration mode command generates RSA key pairs for SSH

Public-Key Authentication.

Syntax

crypto key generate rsa

Default Configuration

The application creates a default key automatically.

Command Mode

Global Configuration mode

User Guidelines

The size of the created RSA key is 2048 bits

RSA keys are generated in pairs - one public RSA key and one private RSA key.

If the device already has RSA keys default or user defined, a warning is displayed with a prompt to replace

the existing keys with new keys.

Erasing the startup configuration or returning to factory defaults automatically deletes the default keys and

they are recreated during device initialization.

This command is not saved in the Running configuration file. However, the keys generated by this command

are saved to the Running Configuration file.

Example

The following example generates RSA key pairs where a RSA key already exists.

switchxxxxxx(config)# crypto key generate rsa

Replace Existing RSA Key [y/n]? N

switchxxxxxx(config)#

RSA and Certificate Commands

crypto key generate rsa

crypto key import

The crypto key import Global Configuration mode command imports the DSA/RSA key pair.

Use the no form of the command to remove the user key and generate a new default in its place.

Syntax

crypto key import {dsa| rsa}

encrypted crypto key import {dsa| rsa}

no crypto key {dsa| rsa}

Default Configuration

DSA and RSA key pairs do not exist.

Command Mode

Global Configuration mode

User Guidelines

The imported key must follow the format defined in RFC 4716

DSA key size for import is between 512 bits and 1024 bits

RSA key size for import is between 1024 bits and 2048 bits

DSA/RSA keys are imported in pairs - one public DSA/RSA key and one private DSA/RSA key.

If the device already has DSA/RSA key keys, a warning is displayed with a prompt to replace the existing

keys with new keys.

This command is saved in the Running Configuration file.

When using the encrypted key-word, the private key is imported in its encrypted form.

Example

switchxxxxxx(config)# encrypted crypto key import rsa

---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----

switchxxxxxx(config)# encrypted crypto key import rsa

---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----

Comment: RSA Private Key

84et9C2XUfcRlpemuGINAygnLwfkKJcDM6m2OReALHScqqLhi0wMSSYNlT1IWFZP1kEVHH

Fpt1aECZi7HfGLcp1pMZwjn1+HaXBtQjPDiEtbpScXqrg6ml1/OEnwpFK2TrmUy0Iifwk8

E/mMfX3i/2rRZLkEBea5jrA6Q62gl5naRw1ZkOges+GNeibtvZYSk1jzr56LUr6fT7Xu5i

KMcU2b2NsuSD5yW8R/x0CW2elqDDz/biA2gSgd6FfnW2HV48bTC55eCKrsId2MmjbExUdz

+RQRhzjcGMBYp6HzkD66z8HmShOU+hKd7M1K9U4Sr+Pr1vyWUJlEkOgz9O6aZoIGp4tgm4

VDy/K/G/sI5nVL0+bR8LFUXUO/U5hohBcyRUFO2fHYKZrhTiPT5Rw+PHt6/+EXKG9E+TRs

lUADMltCRvs+lsB33IBdvoRDdl98YaA2htZay1TkbMqCUBdfl0+74UOqa/b+bp67wCYKe9

yen418MaYKtcHJBQmF7sUQZQGP34VPmOMyZzon68S/ZoT77cy0ihRZx9wcI1yYhJnDiYxP

dgXHYhW6kCTcTj6LrUSQuxCJ9su89ZIWNn5OwdgonLSpvfnabv2GHmmelaveL7JJ/7UcfO

61q5D4PJ67Vk2xL7PqyHXN931rseTzPuJplkSLCFZ5uqTMbWWyQEKmHDlOx35vlGou5tky

9LgIwG4d+9edctZZaggeq5cgjnsZWJgUoB4Bn4hIreyOdHDiFUPPRxkoyhGOGnJuvxC9T9

K6BF1wBTdDQS+Gu47/0/gRoD/50q4sGkzqHsRJJ53WOT0Q1bHMTMLPpwn2nXzvfGxWL/bu

QhZZSqRonG6MX1cP7KT7i4TPq2w2k3TGtNBnVYHx6OoNcaTHmg1N2s5OgRsyXD9tF++6nY

RSA and Certificate Commands

crypto key import

RfMN8CsV+9jQKQP7ZaGc8Ju+d72jvSwppSr032HY+IpzZ4ujkK+/X5oawZL5NnkaEQTQKX

RSL55S4O5NPOjS/pC9hg7GaVjoY2mQ7HDpSUBeTIDTlvOwC2kskA9C6aF/Axj2dXLweQd5

lxk7m0/mMNaiJsNk6y33LcuKjIxpNNjK9n9KzRPkGNMFObprfenWKteDftjQ==

---- END SSH2 PRIVATE KEY ----

---- BEGIN SSH2 PUBLIC KEY ----

Comment: RSA Public Key

AAAAB3NzaC1yc2EAAAABIwAAAIEAvRHsKry6NKMKymb+yWEp9042vupLvYVq3ngt1sB9JH

OcdK/2nw7lCQguy1mLsX8/bKMXYSk/3aBEvaoJQ82+r/nRf0y3HTy4Wp9zV0SiVC8jLD+7

7t0aHejzfUhr0FRhWWcLnvYwr+nmrYDpS6FADMC2hVA85KZRye9ifxT7otE=

---- END SSH2 PUBLIC KEY ----

RSA and Certificate Commands

crypto key import

show crypto key

The show crypto key Privileged EXEC mode command displays the device’s SSH private and public keys

for both default and user-defined keys.

Syntax

show crypto key [mypubkey] [dsa| rsa]

Parameters

• mypubkey—Displays only the public key.

• rsa—Displays the RSA key.

• dsa—Displays the DSA key.

Command Mode

Privileged EXEC mode

User Guidelines

See Keys and Certificates for information on how to display and copy this key pair.

Example

The following example displays the SSH public DSA keys on the device.

switchxxxxxx# show crypto key mypubkey dsa

---- BEGIN SSH2 PUBLIC KEY ----

Comment: RSA Public Key

AAAAB3NzaC1yc2EAAAABIwAAAIEAzN31fu56KSEOZdrGVPIJHpAs8G8NDIkB

dqZ2q0QPiKCnLPw0Xsk9tTVKaHZQ5jJbXn81QZpolaPLJIIH3B1cc96D7IFf

VkbPbMRbz24dpuWmPVVLUlQy5nCKdDCui5KKVD6zj3gpuhLhMJor7AjAAu5e

BrIi2IuwMVJuak5M098=

---- END SSH2 PUBLIC KEY ----

Public Key Fingerprint: 6f:93:ca:01:89:6a:de:6e:ee:c5:18:82:b2:10:bc:1e

RSA and Certificate Commands

show crypto key

crypto certificate generate

The crypto certificate generate Global Configuration mode command generates a self-signed certificate for

HTTPS.

Syntax

crypto certificate number generate [key-generate [length]] [cn common- name] [ou organization-unit] [or

organization] [loc location] [st state] [cu country] [duration days]

Parameters

• number—Specifies the certificate number. (Range: 1–2)

• key-generate rsa length—Regenerates SSL RSA key and specifies the key length.(Supported lengths:

2048 (bits) or 3092 (bits))

The following elements can be associated with the key. When the key is displayed, they are also displayed.

cn common- name—Specifies the fully qualified device URL or IP address. (Length: 1–64 characters).

If unspecified, defaults to the lowest IP address of the device (when the certificate is generated).

ou organization-unit—Specifies the organization-unit or department name. (Length: 1–64 characters)

or organization—Specifies the organization name. (Length: 1–64 characters)

loc location—Specifies the location or city name. (Length: 1–64 characters)

st state—Specifies the state or province name. (Length: 1–64 characters)

cu country—Specifies the country name. (Length: 2 characters)

duration days—Specifies the number of days a certification is valid. (Range: 30–1095)

Default Configuration

If the key-generate parameter is not used the certificate is generated using the existing key.

The default SSL’s RSA key length is 2048.

The default SSL’s EC key length is 256.

If cn common- name is not specified, it defaults to the device’s lowest static IPv6 address (when the certificate

is generated), or to the device’s lowest static IPv4 address if there is no static IPv6 address, or to 0.0.0.0 if

there is no static IP address.

If duration days is not specified, it defaults to 730 days.

Command Mode

Global Configuration mode

User Guidelines

If the specific certificate key does not exist, you must use the parameter key-generate.

If both certificates 1 and 2 have been generated, use the ip https certificate command to activate one of them.

RSA and Certificate Commands

crypto certificate generate

See Keys and Certificates for information on how to display and copy this key pair.

Erasing the startup configuration or returning to factory defaults automatically deletes the default keys and

they are recreated during device initialization.

Example

The following example generates a self-signed certificate for HTTPS whose key length is 2048 bytes.

switchxxxxxx(config)# crypto certificate 1 generate key-generate 2048

RSA and Certificate Commands

crypto certificate generate

crypto certificate request

The crypto certificate request Privileged EXEC mode command generates and displays a certificate request

for HTTPS.

Syntax

crypto certificate number request [cn common- name] [ou organization-unit] [or organization] [loc location]

[st state] [cu country]

Parameters

• number—Specifies the certificate number. (Range: 1–2)

• The following elements can be associated with the key. When the key is displayed, they are also displayed.

cn common- name—Specifies the fully qualified device URL or IP address. (Length: 1–64 characters).

If unspecified, defaults to the lowest IP address of the device (when the certificate is generated).

ou organization-unit—Specifies the organization-unit or department name. (Length: 1–64 characters)

or organization—Specifies the organization name. (Length: 1–64 characters)

loc location—Specifies the location or city name. (Length: 1–64 characters)

st state—Specifies the state or province name. (Length: 1–64 characters)

cu country—Specifies the country name. (Length: 2 characters)

Default Configuration

If cn common-name is not specified, it defaults to the device’s lowest static IPv6 address (when the certificate

is generated), or to the device’s lowest static IPv4 address if there is no static IPv6 address, or to 0.0.0.0 if

there is no static IP address.

Command Mode

Privileged EXEC mode

User Guidelines

Use this command to export a certificate request to a Certification Authority. The certificate request is generated

in Base64-encoded X.509 format.

Before generating a certificate request, first generate a self-signed certificate using the crypto cerificate

generate command to generate the keys. The certificate fields must be re-entered.

After receiving the certificate from the Certification Authority, use the crypto cerificate import command

to import the certificate into the device. This certificate replaces the self-signed certificate.

Example

The following example displays the certificate request for HTTPS.

switchxxxxxx# crypto certificate 1 request

-----BEGIN CERTIFICATE REQUEST-----

RSA and Certificate Commands

crypto certificate request

MIwTCCASoCAQAwYjELMAkGA1UEBhMCUFAxCzAJBgNVBAgTAkNDMQswCQYDVQQH

EwRDEMMAoGA1UEChMDZGxkMQwwCgYDVQQLEwNkbGQxCzAJBgNVBAMTAmxkMRAw

DgKoZIhvcNAQkBFgFsMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC8ecwQ

HdML0831i0fh/F0MV/Kib6Sz5p+3nUUenbfHp/igVPmFM+1nbqTDekb2ymCu6K

aKvEbVLF9F2LmM7VPjDBb9bb4jnxkvwW/wzDLvW2rsy5NPmH1QVl+8Ubx3GyCm

/oW93BSOFwxwEsP58kf+sPYPy+/8wwmoNtDwIDAQABoB8wHQYJKoZIhvcNAQkH

MRDjEyMwgICCAgICAICAgIMA0GCSqGSIb3DQEBBAUAA4GBAGb8UgIx7rB05m+2

m5ZZPhIwl8ARSPXwhVdJexFjbnmvcacqjPG8pIiRV6LkxryGF2bVU3jKEipcZa

g+uNpyTkDt3ZVU72pjz/fa8TF0n3

-----END CERTIFICATE REQUEST-----

RSA and Certificate Commands

crypto certificate request

crypto certificate import

The crypto certificate import Global Configuration mode command imports a certificate signed by a

Certification Authority for HTTPS. In addition, the relevant key-pair can also be imported.

Use the no form of the command to delete the user-defined keys and certificate.

Syntax

crypto certificate number import

encrypted crypto certificate number import

no crypto certificate number

Parameters

• number—Specifies the certificate number. (Range: 1–2).

Command Mode

Global Configuration mode

User Guidelines

Certificate needs to be imported from PEM encoding/file extension

To end the session (return to the command line to enter the next command), enter a blank line.

The imported certificate must be based on a certificate request created by the crypto cerificate request

command.

If only the certificate is imported, and the public key found in the certificate does not match the device's SSL

key, the command fails. If both the public key and the certificate are imported, and the public key found in

the certificate does not match the imported key, the command fails.

This command is saved in the Running configuration file.

When using the encrypted form of the command, only the private key must be in encrypted format.

Example 1 - The following example imports a certificate signed by the Certification Authority for

HTTPS.

switchxxxxxx(config)# crypto certificate 1 import

Please paste the input now, add a period (.) on a separate line after the input,and press

Enter.

-----BEGIN CERTIFICATE-----

MIIBkzCB/QIBADBUMQswCQYDVQQGEwIgIDEKMAgGA1UECBMBIDEKMAgGA1UEBxMB

IDEVMBMGA1UEAxMMMTAuNS4yMzQuMjA5MQowCAYDVQQKEwEgMQowCAYDVQQLEwEg

MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDK+beogIcke73sBSL7tC2DMZrY

OOg9XM1AxfOiqLlQJHd4xP+BHGZWwfkjKjUDBpZn52LxdDu1KrpB/h0+TZP0Fv38

7mIDqtnoF1NLsWxkVKRM5LPka0L/ha1pYxp7EWAt5iDBzSw5sO4lv0bSN7oaGjFA

6t4SW2rrnDy8JbwjWQIDAQABoAAwDQYJKoZIhvcNAQEEBQADgYEAuqYQiNJst6hI

XFDxe7I8Od3Uyt3Dmf7KE/AmUV0Pif2yUluy/RuxRwKhDp/lGrK12tzLQz+s5Ox7

Klft/IcjzbBYXLvih45ASWG3TRv2WVKyWs89rPPXu5hKxggEeTvWqpuS+gXrIqjW

WVZd0n1fXhMacoflgnnEmweIzmrqXBs=

-----END CERTIFICATE-----

RSA and Certificate Commands

crypto certificate import

Certificate imported successfully.

Issued by : C= , ST= , L= , CN=0.0.0.0, O= , OU=

Valid From: Jan 24 18:41:24 2011 GMT

Valid to: Jan 24 18:41:24 2012 GMT

Subject: C=US , ST= , L= , CN=router.gm.com, O= General Motors, OU=

SHA1 Finger print: DC789788 DC88A988 127897BC BB789788

Example 2:The following example imports a certificate signed by the Certification Authority for

HTTPS, and the RSA key-pair.

switchxxxxxx(config)# crypto certificate 1 import

Please paste the input now, add a period (.) on a separate line after the input,and press

Enter.

-----BEGIN RSA PRIVATE KEY-----

ACnrqImEGlXkwxBuZUlAO9nHq9IGJsnkf7/MauGPVqxt5vfDf77uQ5CPf49JWQhu07cVXh

2OwrBhJgB69vLUlJujM9p1IXFpMk8qR3NS7JzlInYAWjHKKbEZBMsKSA6+t/UzVxevKK6H

TGB7vMxi+hv1bL9zygvmQ6+/6QfqA51c4nP/8a6NjO/ZOAgvNAMKNr2Wa+tGUOoAgL0b/C

11EoqzpCq5mT7+VOFhPSO4dUU+NwLv1YCb1Fb7MFoAa0N+y+2NwoGp0pxOvDA9ENYl7qsZ

MWmCfXu52/IxC7fD8FWxEBtks4V81Xqa7K6ET657xS7m8yTJFLZJyVawGXKnIUs6uTzhhW

dKWWc0e/vwMgPtLlWyxWynnaP0fAJ+PawOAdsK75bo79NBim3HcNVXhWNzqfg2s3AYCRBx

WuGoazpxHZ0s4+7swmNZtS0xI4ek43d7RaoedGKljhPqLHuzXHUon7Zx15CUtP3sbHl+XI

B3u4EEcEngYMewy5obn1vnFSot+d5JHuRwzEaRAIKfbHa34alVJaN+2AMCb0hpI3IkreYo

A8Lk6UMOuIQaMnhYf+RyPXhPOQs01PpIPHKBGTi6pj39XMviyRXvSpn5+eIYPhve5jYaEn

UeOnVZRhNCVnruJAYXSLhjApf5iIQr1JiJb/mVt8+zpqcCU9HCWQqsMrNFOFrSpcbHu5V4

ZX4jmd9tTJ2mhekoQf1dwUZbfYkRYsK70ps8u7BtgpRfSRUr7g0LfzhzMuswoDSnB65pkC

ql7yZnBeRS0zrUDgHLLRfzwjwmxjmwObxYfRGMLp4=

-----END RSA PRIVATE KEY-----

-----BEGIN RSA PUBLIC KEY-----

MIGHAoGBAMVuFgfJYLbUzmbm6UoLD3ewHYd1ZMXY4A3KLF2SXUd1TIXq84aME8DIitSfB2

Cqy4QB5InhgAobBKC96VRsUe2rzoNG4QDkj2L9ukQOvoFBYNmbzHc7a+7043wfVmH+QOXf

TbnRDhIMVrZJGbzl1c9IzGky1l21Xmicy0/nwsXDAgEj

-----END RSA PUBLIC KEY-----