The crypto key generate dsa Global Configuration mode command generates a DSA key pair for SSH Public-Key authentication.

Syntax

crypto key generate dsa

Default Configuration

The application creates a default key automatically.

Command Mode

Global Configuration mode

User Guidelines

The size of the created DSA key is 1024 bits

DSA keys are generated in pairs - one public DSA key and one private DSA key.

If the device already has DSA keys default or user defined, a warning is displayed with a prompt to replace the existing keys with new keys.

Erasing the startup configuration or returning to factory defaults automatically deletes the default keys and they are recreated during device initialization.

This command is not saved in the Running configuration file. However, the keys generated by this command are saved to the Running Configuration file.

Example

The following example generates a DSA key pair.

switchxxxxxx(config)# crypto key generate dsa
The SSH service is generating a private DSA key.
This may take a few minutes, depending on the key size.
..........

The crypto key generate rsa Global Configuration mode command generates RSA key pairs for SSH Public-Key Authentication.

Syntax

crypto key generate rsa

Default Configuration

The application creates a default key automatically.

Command Mode

Global Configuration mode

User Guidelines

The size of the created RSA key is 2048 bits

RSA keys are generated in pairs - one public RSA key and one private RSA key.

If the device already has RSA keys default or user defined, a warning is displayed with a prompt to replace the existing keys with new keys.

Erasing the startup configuration or returning to factory defaults automatically deletes the default keys and they are recreated during device initialization.

This command is not saved in the Running configuration file. However, the keys generated by this command are saved to the Running Configuration file.

Example

The following example generates RSA key pairs where a RSA key already exists.

switchxxxxxx(config)# crypto key generate rsa
Replace Existing RSA Key [y/n]? N
switchxxxxxx(config)#  

The crypto key import Global Configuration mode command imports the DSA/RSA key pair.

Use the no form of the command to remove the user key and generate a new default in its place.

Syntax

crypto key import {dsa| rsa}

encrypted crypto key import {dsa| rsa}

no crypto key {dsa| rsa}

Default Configuration

DSA and RSA key pairs do not exist.

Command Mode

Global Configuration mode

User Guidelines

The imported key must follow the format defined in RFC 4716

DSA key size for import is between 512 bits and 1024 bits

RSA key size for import is between 1024 bits and 2048 bits

DSA/RSA keys are imported in pairs - one public DSA/RSA key and one private DSA/RSA key.

If the device already has DSA/RSA key keys, a warning is displayed with a prompt to replace the existing keys with new keys.

This command is saved in the Running Configuration file.

When using the encrypted key-word, the private key is imported in its encrypted form.

Example

switchxxxxxx(config)# encrypted crypto key import rsa
---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----
switchxxxxxx(config)# encrypted crypto key import rsa
---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----
Comment: RSA Private Key
84et9C2XUfcRlpemuGINAygnLwfkKJcDM6m2OReALHScqqLhi0wMSSYNlT1IWFZP1kEVHH
Fpt1aECZi7HfGLcp1pMZwjn1+HaXBtQjPDiEtbpScXqrg6ml1/OEnwpFK2TrmUy0Iifwk8
E/mMfX3i/2rRZLkEBea5jrA6Q62gl5naRw1ZkOges+GNeibtvZYSk1jzr56LUr6fT7Xu5i
KMcU2b2NsuSD5yW8R/x0CW2elqDDz/biA2gSgd6FfnW2HV48bTC55eCKrsId2MmjbExUdz
+RQRhzjcGMBYp6HzkD66z8HmShOU+hKd7M1K9U4Sr+Pr1vyWUJlEkOgz9O6aZoIGp4tgm4
VDy/K/G/sI5nVL0+bR8LFUXUO/U5hohBcyRUFO2fHYKZrhTiPT5Rw+PHt6/+EXKG9E+TRs
lUADMltCRvs+lsB33IBdvoRDdl98YaA2htZay1TkbMqCUBdfl0+74UOqa/b+bp67wCYKe9
yen418MaYKtcHJBQmF7sUQZQGP34VPmOMyZzon68S/ZoT77cy0ihRZx9wcI1yYhJnDiYxP
dgXHYhW6kCTcTj6LrUSQuxCJ9su89ZIWNn5OwdgonLSpvfnabv2GHmmelaveL7JJ/7UcfO
61q5D4PJ67Vk2xL7PqyHXN931rseTzPuJplkSLCFZ5uqTMbWWyQEKmHDlOx35vlGou5tky
9LgIwG4d+9edctZZaggeq5cgjnsZWJgUoB4Bn4hIreyOdHDiFUPPRxkoyhGOGnJuvxC9T9
K6BF1wBTdDQS+Gu47/0/gRoD/50q4sGkzqHsRJJ53WOT0Q1bHMTMLPpwn2nXzvfGxWL/bu
QhZZSqRonG6MX1cP7KT7i4TPq2w2k3TGtNBnVYHx6OoNcaTHmg1N2s5OgRsyXD9tF++6nY
RfMN8CsV+9jQKQP7ZaGc8Ju+d72jvSwppSr032HY+IpzZ4ujkK+/X5oawZL5NnkaEQTQKX
RSL55S4O5NPOjS/pC9hg7GaVjoY2mQ7HDpSUBeTIDTlvOwC2kskA9C6aF/Axj2dXLweQd5
lxk7m0/mMNaiJsNk6y33LcuKjIxpNNjK9n9KzRPkGNMFObprfenWKteDftjQ==
---- END SSH2 PRIVATE KEY ----
---- BEGIN SSH2 PUBLIC KEY ----
Comment: RSA Public Key
AAAAB3NzaC1yc2EAAAABIwAAAIEAvRHsKry6NKMKymb+yWEp9042vupLvYVq3ngt1sB9JH
OcdK/2nw7lCQguy1mLsX8/bKMXYSk/3aBEvaoJQ82+r/nRf0y3HTy4Wp9zV0SiVC8jLD+7
7t0aHejzfUhr0FRhWWcLnvYwr+nmrYDpS6FADMC2hVA85KZRye9ifxT7otE=
---- END SSH2 PUBLIC KEY ----

The show crypto key Privileged EXEC mode command displays the device’s SSH private and public keys for both default and user-defined keys.

Syntax

show crypto key [mypubkey] [dsa| rsa]

Parameters

• mypubkey—Displays only the public key.

• rsa—Displays the RSA key.

• dsa—Displays the DSA key.

Command Mode

Privileged EXEC mode

User Guidelines

See Keys and Certificates for information on how to display and copy this key pair.

Example

The following example displays the SSH public DSA keys on the device.

switchxxxxxx# show crypto key mypubkey dsa
---- BEGIN SSH2 PUBLIC KEY ----
Comment: RSA Public Key
AAAAB3NzaC1yc2EAAAABIwAAAIEAzN31fu56KSEOZdrGVPIJHpAs8G8NDIkB
dqZ2q0QPiKCnLPw0Xsk9tTVKaHZQ5jJbXn81QZpolaPLJIIH3B1cc96D7IFf
VkbPbMRbz24dpuWmPVVLUlQy5nCKdDCui5KKVD6zj3gpuhLhMJor7AjAAu5e
BrIi2IuwMVJuak5M098=
---- END SSH2 PUBLIC KEY ----
Public Key Fingerprint: 6f:93:ca:01:89:6a:de:6e:ee:c5:18:82:b2:10:bc:1e

The crypto certificate generate Global Configuration mode command generates a self-signed certificate for HTTPS.

Syntax

crypto certificate number generate [key-generate [length]] [cn common- name] [ou organization-unit] [or organization] [loc location] [st state] [cu country] [duration days]

Parameters

• number—Specifies the certificate number. (Range: 1–2)

• key-generate rsa length—Regenerates SSL RSA key and specifies the key length.(Supported lengths: 2048 (bits) or 3092 (bits))

  The following elements can be associated with the key. When the key is displayed, they are also displayed.

  cn common- name—Specifies the fully qualified device URL or IP address. (Length: 1–64 characters). If unspecified, defaults to the lowest IP address of the device (when the certificate is generated).

  ou organization-unit—Specifies the organization-unit or department name. (Length: 1–64 characters)

  or organization—Specifies the organization name. (Length: 1–64 characters)

  loc location—Specifies the location or city name. (Length: 1–64 characters)

  st state—Specifies the state or province name. (Length: 1–64 characters)

  cu country—Specifies the country name. (Length: 2 characters)

  duration days—Specifies the number of days a certification is valid. (Range: 30–1095)

Default Configuration

If the key-generate parameter is not used the certificate is generated using the existing key.

The default SSL’s RSA key length is 2048.

The default SSL’s EC key length is 256.

If cn common- name is not specified, it defaults to the device’s lowest static IPv6 address (when the certificate is generated), or to the device’s lowest static IPv4 address if there is no static IPv6 address, or to 0.0.0.0 if there is no static IP address.

If duration days is not specified, it defaults to 730 days.

Command Mode

Global Configuration mode

User Guidelines

If the specific certificate key does not exist, you must use the parameter key-generate.

If both certificates 1 and 2 have been generated, use the ip https certificate command to activate one of them.

See Keys and Certificates for information on how to display and copy this key pair.

Erasing the startup configuration or returning to factory defaults automatically deletes the default keys and they are recreated during device initialization.

Example

The following example generates a self-signed certificate for HTTPS whose key length is 2048 bytes.

switchxxxxxx(config)# crypto certificate 1 generate key-generate 2048

The crypto certificate request Privileged EXEC mode command generates and displays a certificate request for HTTPS.

Syntax

crypto certificate number request [cn common- name] [ou organization-unit] [or organization] [loc location] [st state] [cu country]

Parameters

• number—Specifies the certificate number. (Range: 1–2)

• The following elements can be associated with the key. When the key is displayed, they are also displayed.

  cn common- name—Specifies the fully qualified device URL or IP address. (Length: 1–64 characters). If unspecified, defaults to the lowest IP address of the device (when the certificate is generated).

  ou organization-unit—Specifies the organization-unit or department name. (Length: 1–64 characters)

  or organization—Specifies the organization name. (Length: 1–64 characters)

  loc location—Specifies the location or city name. (Length: 1–64 characters)

  st state—Specifies the state or province name. (Length: 1–64 characters)

  cu country—Specifies the country name. (Length: 2 characters)

Default Configuration

If cn common-name is not specified, it defaults to the device’s lowest static IPv6 address (when the certificate is generated), or to the device’s lowest static IPv4 address if there is no static IPv6 address, or to 0.0.0.0 if there is no static IP address.

Command Mode

Privileged EXEC mode

User Guidelines

Use this command to export a certificate request to a Certification Authority. The certificate request is generated in Base64-encoded X.509 format.

Before generating a certificate request, first generate a self-signed certificate using the crypto cerificate generate command to generate the keys. The certificate fields must be re-entered.

After receiving the certificate from the Certification Authority, use the crypto cerificate import command to import the certificate into the device. This certificate replaces the self-signed certificate.

Example

The following example displays the certificate request for HTTPS.

switchxxxxxx# crypto certificate 1 request
-----BEGIN CERTIFICATE REQUEST-----
MIwTCCASoCAQAwYjELMAkGA1UEBhMCUFAxCzAJBgNVBAgTAkNDMQswCQYDVQQH
EwRDEMMAoGA1UEChMDZGxkMQwwCgYDVQQLEwNkbGQxCzAJBgNVBAMTAmxkMRAw
DgKoZIhvcNAQkBFgFsMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC8ecwQ
HdML0831i0fh/F0MV/Kib6Sz5p+3nUUenbfHp/igVPmFM+1nbqTDekb2ymCu6K
aKvEbVLF9F2LmM7VPjDBb9bb4jnxkvwW/wzDLvW2rsy5NPmH1QVl+8Ubx3GyCm
/oW93BSOFwxwEsP58kf+sPYPy+/8wwmoNtDwIDAQABoB8wHQYJKoZIhvcNAQkH
MRDjEyMwgICCAgICAICAgIMA0GCSqGSIb3DQEBBAUAA4GBAGb8UgIx7rB05m+2
m5ZZPhIwl8ARSPXwhVdJexFjbnmvcacqjPG8pIiRV6LkxryGF2bVU3jKEipcZa
g+uNpyTkDt3ZVU72pjz/fa8TF0n3
-----END CERTIFICATE REQUEST-----

The crypto certificate import Global Configuration mode command imports a certificate signed by a Certification Authority for HTTPS. In addition, the relevant key-pair can also be imported.

Use the no form of the command to delete the user-defined keys and certificate.

Syntax

crypto certificate number import

encrypted crypto certificate number import

no crypto certificate number

Parameters

• number—Specifies the certificate number. (Range: 1–2).

Command Mode

Global Configuration mode

User Guidelines

Certificate needs to be imported from PEM encoding/file extension

To end the session (return to the command line to enter the next command), enter a blank line.

The imported certificate must be based on a certificate request created by the crypto cerificate request command.

If only the certificate is imported, and the public key found in the certificate does not match the device's SSL key, the command fails. If both the public key and the certificate are imported, and the public key found in the certificate does not match the imported key, the command fails.

This command is saved in the Running configuration file.

When using the encrypted form of the command, only the private key must be in encrypted format.

The show crypto certificate Privileged EXEC mode command displays the device SSL certificates and key-pair for both default and user defined keys.

Syntax

show crypto certificate [mycertificate] [number]

Parameters

• number—Specifies the certificate number. (Range: 1,2)

• mycertificate—Specifies that only the certificate will be displayed

Default Configuration

displays both keys.

Command Mode

Privileged EXEC mode

Examples

The following example displays SSL certificate # 1 present on the device and the key-pair.

switchxxxxxx# show crypto certificate 1
Certificate 1:
Certificate Source: Default
-----BEGIN CERTIFICATE-----
dHmUgUm9vdCBDZXJ0aWZpZXIwXDANBgkqhkiG9w0BAQEFAANLADBIAkEAp4HS
nnH/xQSGA2ffkRBwU2XIxb7n8VPsTm1xyJ1t11a1GaqchfMqqe0kmfhcoHSWr
yf1FpD0MWOTgDAwIDAQABo4IBojCCAZ4wEwYJKwYBBAGCNxQCBAYeBABDAEEw
CwR0PBAQDAgFGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFAf4MT9BRD47
ZvKBAEL9Ggp+6MIIBNgYDVR0fBIIBLTCCASkwgdKggc+ggcyGgclsZGFwOi8v
L0VByb3h5JTIwU29mdHdhcmUlMjBSb290JTIwQ2VydGlmaWVyLENOPXNlcnZl
-----END CERTIFICATE-----

----BEGIN RSA PRIVATE KEY-----
ACnrqImEGlXkwxBuZUlAO9nHq9IGJsnkf7/MauGPVqxt5vfDf77uQ5CPf49JWQhu07cVXh
2OwrBhJgB69vLUlJujM9p1IXFpMk8qR3NS7JzlInYAWjHKKbEZBMsKSA6+t/UzVxevKK6H
TGB7vMxi+hv1bL9zygvmQ6+/6QfqA51c4nP/8a6NjO/ZOAgvNAMKNr2Wa+tGUOoAgL0b/C
11EoqzpCq5mT7+VOFhPSO4dUU+NwLv1YCb1Fb7MFoAa0N+y+2NwoGp0pxOvDA9ENYl7qsZ
MWmCfXu52/IxC7fD8FWxEBtks4V81Xqa7K6ET657xS7m8yTJFLZJyVawGXKnIUs6uTzhhW
dKWWc0e/vwMgPtLlWyxWynnaP0fAJ+PawOAdsK75bo79NBim3HcNVXhWNzqfg2s3AYCRBx
WuGoazpxHZ0s4+7swmNZtS0xI4ek43d7RaoedGKljhPqLHuzXHUon7Zx15CUtP3sbHl+XI
B3u4EEcEngYMewy5obn1vnFSot+d5JHuRwzEaRAIKfbHa34alVJaN+2AMCb0hpI3IkreYo
A8Lk6UMOuIQaMnhYf+RyPXhPOQs01PpIPHKBGTi6pj39XMviyRXvSpn5+eIYPhve5jYaEn
UeOnVZRhNCVnruJAYXSLhjApf5iIQr1JiJb/mVt8+zpqcCU9HCWQqsMrNFOFrSpcbHu5V4
ZX4jmd9tTJ2mhekoQf1dwUZbfYkRYsK70ps8u7BtgpRfSRUr7g0LfzhzMuswoDSnB65pkC
ql7yZnBeRS0zrUDgHLLRfzwjwmxjmwObxYfRGMLp4=
-----END RSA PRIVATE KEY-----
-----BEGIN RSA PUBLIC KEY-----
MIGHAoGBAMVuFgfJYLbUzmbm6UoLD3ewHYd1ZMXY4A3KLF2SXUd1TIXq84aME8DIitSfB2
Cqy4QB5InhgAobBKC96VRsUe2rzoNG4QDkj2L9ukQOvoFBYNmbzHc7a+7043wfVmH+QOXf
TbnRDhIMVrZJGbzl1c9IzGky1l21Xmicy0/nwsXDAgEj

-----END RSA PUBLIC KEY-----
Issued by: www.verisign.com
Valid from: 8/9/2003 to 8/9/2004
Subject: CN= router.gm.com, 0= General Motors, C= US
Finger print: DC789788 DC88A988 127897BC BB789788

The show crypto certificate chain Privileged EXEC mode command displays the device SSL certificates and key-pair for both default and user defined keys.

Syntax

show crypto certificate chain [number]

Parameters

• number (optional)—Specifies the certificate number. (Range: 1,2)

Default Configuration

Displays both keys.

Command Mode

Privileged EXEC mode

Examples

The following example displays certificate 1 chain:

switchxxxxxx# show crypto certificate chain 1

Certificate Chain - server certificate 1 (Active)

=========================================

Sever Certificate

Status: valid

Serial Number:

00:16:c9:af:00:2c:7b:06:11:5b:39:3e:de:c4:04:d4:63:11:22:11

Issuer: cn=Intermediate 2 CA, ou=issDept, o=MyInterCA, st=NA, c=US

Subject: cn= momo.company.com, ou=Depd, o=myCompany, st=NA, c=US

Validity:

Not Before: Nov 14 21:06:28 2023 EST

Not After: Nov 09 21:06:28 2043 SET

Intermediate CA Certificate – Inter2

Status: valid

Serial Number: 55:16:c9:af:00:2c:7b:06:11:5b:39:3e:de:c4:04:d4:63:11:22:55

Issuer: cn= My Root CA, ou=RootIss, o=MyRootCA, st=NA, c=US

Subject: cn= Intermediate 2 CA, ou=issDept, o=MyInterCA, st=NA, c=US

Validity:

Not Before: Nov 14 21:06:28 2023 EST

Not After: Nov 09 21:06:28 2043 EST