Cisco IOS CA server

fsebera · ‎10-18-2010

I want to make my Cisco IOS router perform as a CA PKI server.

These are the CLI commands [I think] I need to enable the IOS CA server.

Is this correct?

After I make the IOS CA server, I will make this router a pki client as-well but have not included these commands here as I am just trying to get one step at a time understood and completed.

Thanks AGAIN.

Frank

R1 G0/0 192.168.1.1 /24 <-----------> R2 G0/0 192.168.1.2 /24

ip http server

clock timezone est -5

clock summer-time edt recurring

net peer 192.168.1.1

ntp master 4

ip domain name TEST.LAB

!

crypto key generate rsa general-keys label IOS-CA-SVR modulus 1024 exportable

crypto key export rsa IOS-CA-SVR pem url flash: Protectm3

crypto pki server IOS-CA-SVR

database level complete

database url flash:

issuer-name CN=IOS-CA-SVR OU=TEST-LAB

no shutdown

Ivan Kovacevic · ‎10-19-2010

Your config seems to be fine, except the typo in "net peer 192.168.1.1" - it should be "ntp peer...". Apart from this you can add "grant auto" under the CA config if you don't want to manually grant every cert. Also make sure "ip http server" is enabled before you attempt to start IOS CA.