Cisco Catalyst 4500 Series, Software Configuration Manual

Page: 1267 / 2086

48-13
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 48 Configuring MACsec Encryption
Understanding MKA MACsec with EAP-TLS
Generating RSA Key Pairs
To generate RSA key pairs, perform this task:
Configuring Enrollment using SCEP
Simple Certificate Enrollment Protocol (SCEP) is a Cisco-developed enrollment protocol that uses
HTTP to communicate with the certificate authority (CA) or registration authority (RA). SCEP is the
most commonly used method for sending and receiving requests and certificates.
Command Purpose
Step 1
configure terminal
Enters global configuration mode.
Step 2
crypto key generate rsa label label
name general-keys modulus size
Generates a RSA key pair for signing and encryption.
You can also assign a label to each key pair using the label keyword. The
label is referenced by the trustpoint that uses the key pair. If you do not
assign a label, the key pair is automatically labeled <Default-RSA-Key>.
If you do not use additional keywords this command generates one
general purpose RSA key pair. If the modulus is not specified, the default
key modulus of 1024 is used. You can specify other modulus sizes with
the modulus keyword.
Step 3
end
Returns to privileged EXEC mode.
Step 4
show crypto key mypubkey rsa
(Optional) Displays the RSA public keys of your device.
This step allows you to verify that the RSA key pair has been successfully
generated.
Step 5
copy running-config startup-config (Optional) Saves your entries in the configuration file.
Command Purpose
Step 1
configure terminal
Enters global configuration mode.
Step 2
crypto pki trustpoint server name
Declares the trustpoint and a given name and enters ca-trustpoint
configuration mode.
Step 3
enrollment url url name pem
Specifies the URL of the CA on which your device should send certificate
requests.
An IPv6 address can be added in the URL enclosed in brackets. For
example: http:// [2001:DB8:1:1::1]:80.
The pem keyword adds privacy-enhanced mail (PEM) boundaries to the
certificate request.
Step 4
rsa keypair label
Specifies which key pair to associate with the certificate.
Step 5
serial-number none
The none keyword specifies that a serial number will not be included in
the certificate request.
Step 6
ip-address none
The none keyword specifies that no IP address should be included in the
certificate request.
Step 7
revocation-check crl
Specifies CRL as the method to ensure that the certificate of a peer has not
been revoked.