User certificates

X.509v3 Certificates for SSH Authentication The X.509v3 Certificates for SSH Authentication feature uses the X.509v3 digital certificates in server and user authentication at the secure shell (SSH) server side. This module describes how to configure server and user certificate profiles for a digital certificate. Prerequisites for X.509v3 Certificates for SSH Authentication The X.509v3 Certificates for SSH Authentication feature introduces the ip ssh server algorithm authentication command to replace the ip ssh server authenticate user command. If you use the ip ssh server authenticate user command, the following deprecation message is displayed. Warning: SSH command accepted but this CLI will be deprecated soon. Please move to new CLI “ip ssh server algorithm authentication”. Please configure “default ip ssh server authenticate user” to make the CLI ineffective. Use the default ip ssh server authenticate user command to remove the ip ssh server authenticate user command from effect. The IOS secure shell (SSH) server then starts using the ip ssh server algorithm authentication command. Restrictions for X.509v3 Certificates for SSH Authentication The X.509v3 Certificates for SSH Authentication feature implementation is applicable only on the Cisco IOS XE secure shell (SSH) server side. The SSH server supports only the x509v3-ssh-rsa algorithm-based certificate for server and user authentication. Information About X.509v3 Certificates for SSH Authentication The following section provides information about digital certificates, and server and user authentication. Digital Certificates The validity of the authentication depends upon the strength of the linkage between the public signing key and the identity of the signer. Digital certificates in the X.509v3 format (RFC5280) are used to provide identity management. A chain of signatures by a trusted root certification authority and its intermediate certificate authorities binds a given public signing key to a given digital identity. Public key infrastructure (PKI) trustpoint helps manage the digital certificates. The association between the certificate and the trustpoint helps track the certificate. The trustpoint contains information about the certificate authority (CA), different identity parameters, and the digital certificate. Multiple trustpoints can be created to associate with different certificates. Server and User Authentication using X.509v3 For server authentication, the Cisco IOS XE secure shell

Network Companion Guide: Deploying Server Certificates, which is available in the Windows Server 2012 Technical Library. For more information, see Additional Resources1.On CA1, which is the computer running the AD CS server role, configure copies of the Workstation Authentication and User certificate templates and add them to the CA. The CA issues certificates based on these certificate templates, so you must configure the templates for the computer and user certificates, and then add them to the CA, before the CA can issue them.On DC1, which is the computer running both the Active Directory Domain Services server role and the DNS server role, configure computer and user certificate autoenrollment in Group Policy. When you configure the autoenrollment of computer certificates, user certificates, or both, all domain member computers, domain users, or both will automatically receive a certificate when Group Policy on the user's computer is refreshed. If you add more computers or users later, they will automatically receive a certificate.NoteIf you removed the Domain Users or Domain Computers groups from the certificate template ACL and replaced these groups with custom groups that you created in Active Directory Users and Computers, certificates will be enrolled only to the members of your custom groups.Refresh Group Policy on domain member computers. When Group Policy is refreshed:If you have deployed computer certificates, the domain member computer enrolls a computer certificate that is based on the template that you configured in the previous step.If you have deployed user certificates, the domain user enrolls a user certificate

The FQDN key pair is used. Step 7 exit Example: Device(ca-trustpoint)# exit Exits ca-trustpoint configuration mode and returns to global configuration mode. Step 8 crypto pki authenticate name Example: Device(config)# crypto pki authenticate trust1 Retrieves the CA certificate and authenticates it. Check the certificate fingerprint if prompted. Note This command is optional if the CA certificate is already loaded into the configuration. Step 9 crypto pki enroll name Example: Device(config)# crypto pki enroll trust1 Certificate request is sent to the certificate server and the server issues the ID or device certificate. You are prompted for enrollment information, such as whether to include the device FQDN and IP address in the certificate request. Step 10 show crypto pki certificates Example: Device(config)# show crypto pki certificates verbose trust1 (Optional) Displays information about your certificates, including any rollover certificates. What to do next For more information on how to install the certificate using other enrollment options, see Deploying RSA Keys Within a PKI. Verifying Configuration for Server and User Authentication Using Digital Certificates To verify configuration for server and user Authentication using digital certificates, perform this procedure: Procedure Command or Action Purpose Step 1 enable Example: Device> enable Enables privileged EXEC mode. Enter your password, if prompted. Step 2 show ip ssh Example: Device# show ip sshSSH Enabled - version 1.99Authentication methods:publickey,keyboard-interactive,passwordAuthentication Publickey Algorithms:x509v3-ssh-rsa,ssh-rsaHostkey Algorithms:x509v3-ssh-rsa,ssh-rsaAuthentication timeout: 120 secs; Authentication retries: 3Minimum expected Diffie Hellman key size : 1024 bits Displays the currently configured authentication methods. To confirm the use of certificate-based authentication, ensure that the x509v3-ssh-rsa algorithm is the configured host key algorithm. Configuration Examples for X.509v3 Certificates for SSH Authentication The following section provides examples for user and server authentication using digital certificates. Example: Configuring the SSH Server to Use Digital Certificates for Server Authentication This example shows how to configure the SSH Server to use digital certificates for server authentication. Device> enableDevice# configure terminalDevice(config)# ip ssh server algorithm hostkey x509v3-ssh-rsa Device(config)# ip ssh server certificate profileDevice(ssh-server-cert-profile)# serverDevice(ssh-server-cert-profile-server)# trustpoint sign trust1Device(ssh-server-cert-profile-server)# end Example: Configuring the SSH Server to Verify Digital Certificates for User Authentication This example shows how to configure the SSH