Cisco Catalyst 4500 Series, Руководство по настройке программного обеспечения

Страница: 1413 / 2086

50-3
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
Chapter 50 X.509v3 Certificates for SSH Authentication
How to Configure X.509v3 Certificates for SSH Authentication
OCSP Response Stapling
The Online Certificate Status Protocol (OCSP) enables applications to determine the (revocation) state
of an identified certificate. This protocol specifies the data that needs to be exchanged between an
application checking the status of a certificate and the server providing that status. An OCSP client issues
a status request to an OCSP responder and suspends acceptance of the certificate until a response is
received. An OCSP response at a minimum consists of a responseStatus field that indicates the
processing status of the a request.
For the public key algorithms, the key format consists of a sequence of one or more X.509v3 certificates
followed by a sequence of zero or more OCSP responses.
The X.509v3 Certificate for SSH Authentication feature uses OCSP Response Stapling. By using OCSP
response stapling, a device obtains the revocation information of its own certificate by contacting the
OCSP server and then stapling the result along with its certificates and sending the information to the
peer rather than having the peer contact the OCSP responder.
How to Configure X.509v3 Certificates for SSH Authentication
• Configuring Digital Certificates for Server Authentication, page 50-3
•
Configuring Digital Certificates for User Authentication, page 50-4
Configuring Digital Certificates for Server Authentication
Command or Action Purpose
Step 1
Switch> enable
Enables privileged EXEC mode.
•
Enter your password if prompted.
Step 2
Switch# configure terminal
Enters global configuration mode.
Step 3
Switch(config)# ip ssh server algorithm
hostkey { x509v3-ssh-rsa [ ssh-rsa ] |
ssh-rsa [ x509v3-ssh-rsa ]}
Defines the order of host key algorithms. Only the configured
algorithm is negotiated with the Secure Shell (SSH) client.
Note
The IOS SSH server must have at least one
configured host key algorithm.
•
x509v3-ssh-rsa —certificate-based authentication
• ssh-rsa —public key-based authentication
Step 4
Switch(config)# ip ssh server
certificate profile
Configures server and user certificate profiles and enters SSH
certificate profile configuration mode.
Step 5
Switch(ssh-server-cert-profile)# server
Configures server certificate profile and enters SSH server
certificate profile server configuration mode.
•
The server profile is used to send out the certificate of the server
to the SSH client during server authentication.