Cisco Catalyst 2960 Series, Configuration Manual

Page: 1205 / 2288

Example:
Device> enable
Step 2
show ip ssh
Displays the currently configured authentication methods. To confirm the use of certificate-based authentication, ensure
that the x509v3-ssh-rsa algorithm is the configured host key algorithm.
Example:
Device# show ip ssh
SSH Enabled - version 1.99
Authentication methods:publickey,keyboard-interactive,password
Authentication Publickey Algorithms:x509v3-ssh-rsa,ssh-rsa
Hostkey Algorithms:x509v3-ssh-rsa,ssh-rsa
Authentication timeout: 120 secs; Authentication retries: 3
Minimum expected Diffie Hellman key size : 1024 bits
Configuration Examples for X.509v3 Certificates for SSH Authentication
Example: Configuring Digital Certificates for Server Authentication
Switch>
enable
Switch# configure terminal
Switch(config)# ip ssh server algorithm hostkey x509v3-ssh-rsa
Switch(config)# ip ssh server certificate profile
Switch(ssh-server-cert-profile)# server
Switch(ssh-server-cert-profile-server)#
trustpoint sign trust1
Switch(ssh-server-cert-profile-server)# exit
Example: Configuring Digital Certificate for User Authentication
Switch> enable
Switch#
configure terminal
Switch(config)# ip ssh server algorithm authentication publickey
Switch(config)# ip ssh server algorithm publickey x509v3-ssh-rsa
Switch(config)# ip ssh server certificate profile
Switch(ssh-server-cert-profile)# user
Switch(ssh-server-cert-profile-user)#
trustpoint verify trust2
Switch(ssh-server-cert-profile-user)# end
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
1123
Configuration Examples for X.509v3 Certificates for SSH Authentication