Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table at the end of this module.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

• The X.509v3 Certificates for SSH Authentication feature introduces the ip ssh server algorithm authentication command to replace the ip ssh server authenticate user command. If you use the ip ssh server authenticate user command, the following deprecation message is displayed.

  Warning: SSH command accepted but this CLI will be deprecated soon. Please move to new CLI “ip ssh server algorithm authentication”. Please configure “default ip ssh server authenticate user” to make CLI ineffective.

  • Use the default ip ssh server authenticate user command to remove the ip ssh server authenticate user command from effect. The IOS secure shell (SSH) server then starts using the ip ssh server algorithm authentication command.

• The X.509v3 Certificates for SSH Authentication feature implementation is applicable only on the IOS secure shell (SSH) server side.

• IOS SSH server supports only the x509v3-ssh-rsa algorithm based certificate for server and user authentication on the IOS SSH server side.

The validity of the authentication depends upon the strength of the linkage between the public signing key and the identity of the signer. Digital certificates in the X.509v3 format (RFC5280) are used to provide identity management. A chain of signatures by a trusted root certification authority and its intermediate certificate authorities binds a given public signing key to a given digital identity.

Public key infrastructure (PKI) trustpoint helps manage the digital certificates. The association between the certificate and the trustpoint helps track the certificate. The trustpoint contains information about the certificate authority (CA), different identity parameters, and the digital certificate. Multiple trustpoints can be created to associate with different certificates.

For server authentication, the IOS secure shell (SSH) server sends its own certificate to the SSH client for verification. This server certificate is associated with the trustpoint configured in the server certificate profile (ssh-server-cert-profile-server configuration mode).

For user authentication, the SSH client sends the user's certificate to the IOS SSH server for verification. The SSH server validates the incoming user certificate using public key infrastructure (PKI) trustpoints configured in the server certificate profile (ssh-server-cert-profile-user configuration mode).

By default, certificate-based authentication is enabled for server and user at the IOS SSH server end.

1.    enable


2.    configure terminal


3.    ip ssh server algorithm hostkey {x509v3-ssh-rsa [ssh-rsa] | ssh-rsa [x509v3-ssh-rsa]}


4.    ip ssh server certificate profile


5.    server


6.    trustpoint sign PKI-trustpoint-name


7.    ocsp-response include


8.    end

Device> enable

Device# configure terminal

Device(config)# ip ssh server algorithm hostkey x509v3-ssh-rsa

Device(config)# ip ssh server certificate profile

Device(ssh-server-cert-profile)# server

Device(ssh-server-cert-profile-server)# trustpoint sign trust1

Device(ssh-server-cert-profile-server)# ocsp-response include

Device(ssh-server-cert-profile-server)# end

1.    enable


2.    configure terminal


3.    ip ssh server algorithm authentication {publickey | keyboard | password}


4.    ip ssh server algorithm publickey {x509v3-ssh-rsa [ssh-rsa] | ssh-rsa [x509v3-ssh-rsa]}


5.    ip ssh server certificate profile


6.    user


7.    trustpoint verify PKI-trustpoint-name


8.    ocsp-response required


9.    end

Device> enable

Device# configure terminal

Device(config)# ip ssh server algorithm authentication publickey

Device(config)# ip ssh server algorithm publickey x509v3-ssh-rsa

Device(config)# ip ssh server certificate profile

Device(ssh-server-cert-profile)# user

Device(ssh-server-cert-profile-user)# trustpoint verify trust2

Device(ssh-server-cert-profile-user)# ocsp-response required

Device(ssh-server-cert-profile-user)# end

1.    enable


2.    show ip ssh

Device> enable

Device# show ip ssh

SSH Enabled - version 1.99
Authentication methods:publickey,keyboard-interactive,password
Authentication Publickey Algorithms:x509v3-ssh-rsa,ssh-rsa
Hostkey Algorithms:x509v3-ssh-rsa,ssh-rsa
Authentication timeout: 120 secs; Authentication retries: 3
Minimum expected Diffie Hellman key size : 1024 bits