PIX 7.21 receive digital certificate from Router

出处:bu.cublog.cn

================================================== =====================
R6 is a CA server
================================================== =====================
Router(config)#host r6
r6(config)#ip http server

r6(config)#clock timezone EST -5
r6(config)#cloc
*Jul 4 17:42:36.551: %SYS-6-CLOCKUPDATE: System clock has been updated from 17:42:36 UTC Tue Jul 4 2006 to 12:42:36 EST Tue Jul 4 2006, configured from console by cons
r6(config)#clock summer-time EST recurring
r6(config)#
*Jul 4 17:42:58.271: %SYS-6-CLOCKUPDATE: System clock has been updated from 12:42:58 EST Tue Jul 4 2006 to 13:42:58 EST Tue Jul 4 2006, configured from console by console.
r6(config)#do clock set 13:56:00 Jul 4 2006
r6(config)#
*Jul 4 17:56:00.000: %SYS-6-CLOCKUPDATE: System clock has been updated from 13:43:31 EST Tue Jul 4 2006 to 13:56:00 EST Tue Jul 4 2006, configured from console by console.
r6(config)#ip domain-name test.com
r6(config)#crypto key gen
r6(config)#crypto key generate rsa ?
general-keys Generate a general purpose RSA key pair for signing and
encryption
usage-keys Generate separate RSA key pairs for signing and encryption
<cr>

r6(config)#crypto key generate rsa general
r6(config)#crypto key generate rsa general-keys ?
exportable Allow the key to be exported
label Provide a label
modulus Provide number of modulus bits on the command line
<cr>

r6(config)#crypto key generate rsa general-keys label ?
WORD RSA keypair label

r6(config)#$generate rsa general-keys label test modulus 1024 exportable
The name for the keys will be: test

% The key modulus size is 1024 bits
% Generating 1024 bit RSA keys, keys will be exportable...[OK]

Jul 4 17:58:06.403: %SSH-5-ENABLED: SSH 1.99 has been enabled
r6(config)#do sh crypto key mypubkey rsa
% Key pair was generated at: 13:58:06 EST Jul 4 2006
Key name: test
Usage: General Purpose Key
Key is exportable.
Key Data:
30819F30 0D06092A 864886F7 0D010101 05000381 8D003081 89028181 00ACB297
38A6E9EB 8D46A7F4 4D769AF0 13C12099 A936B1E8 E6766349 49952984 66B138F2
EEB8B942 C3C3B54C B4AE381C 38B36EA2 93E7D7FA A1DF21CC F6C33F12 D997B439
84565274 7EEE9A3E 7D39428D 6C40D08F 4D8AC6FF ABC99D17 C0D79A91 4E744B8B
117ECB1D A58C3796 287C4358 24CB9C5F C76186E0 7311F46E 7B0D09C3 EF020301 0001
% Key pair was generated at: 13:58:09 EST Jul 4 2006
Key name: test.server
Usage: Encryption Key
Key is not exportable.
Key Data:
307C300D 06092A86 4886F70D 01010105 00036B00 30680261 00AB5685 02B6560F
5917F04B 069C953D 0FB1928D D32AFC02 A23F1F87 3CA18D85 CF1D1511 9C4AEC8E
5D89787C C5E00693 60CCDC7F 6FE11065 E1956652 4838DA98 C65971AD 96E1A71E
245C0A06 18D28D2F FCB2635A D8315453 00757361 D9A7F883 AD020301 0001
r6(config)# crypto pki ?
authenticate Get the CA certificate
certificate Actions on certificates
crl Actions on certificate revocation lists
enroll Request a certificate from a CA
export Export certificate or PKCS12 file
import Import certificate or PKCS12 file
profile Define a certificate profile
server Enable IOS Certificate server
token Configure cryptographic token
trustpoint Define a CA trustpoint

r6(config)# crypto pki server ?
WORD Certificate Server Name

r6(config)# crypto pki server test
r6(cs-server)#?
CA Server configuration commands:
cdp-url CRL Distribution Point to be included in the issued certs
database Certificate Server database config parameters
default Set a command to its defaults
exit Exit from Certificate Server entry mode
grant Certificate granting options
issuer-name Issuer name
lifetime Lifetime parameters
mode Mode
no Negate a command or set its defaults
shutdown Shutdown the Certificate Server

r6(cs-server)#no shutdown
%Some server settings cannot be changed after CA certificate generation.
% Please enter a passphrase to protect the private key
% or type Return to exit
Password:

Re-enter password:
% Exporting Certificate Server signing certificate and keys...

r6(cs-server)#exit
r6(config)#int e0/0
r6(config-if)#ip add 172.29.6.101 255.255.255.0
r6(config-if)#no sh
r6(config-if)#
Jul 4 18:00:03.531: %LINK-3-UPDOWN: Interface Ethernet0/0, changed state to up
Jul 4 18:00:04.531: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet0/0, changed state to up
================================================== ============
PIX will get the digital certificate from CA (R6)
================================================== ============
pixfirewall# conf t

pixfirewall(config)# hostname pix
pix(config)# domain-name test.com
pix(config)# clock timezone EST -5
pix(config)# clock summer-time EST recurring
pix(config)# clock set 13:46:00 4 jul 2006
pix(config)# int e0
pix(config-if)# nameif outside
INFO: Security level for "outside" set to 0 by default.
pix(config-if)# ip addr 172.29.6.1 255.255.255.0
pix(config-if)# no sh
pix(config-if)# exit
pix(config)# failover active
pix(config)# crypto key generate rsa ?

configure mode commands/options:
general-keys Generate a general purpose RSA key pair for signing and
encryption
label Provide a label
modulus Provide number of modulus bits on the command line
noconfirm Specify this keyword to suppress all interactive prompting.
usage-keys Generate seperate RSA key pairs for signing and encryption
<cr>
pix(config)# crypto key generate rsa
INFO: The name for the keys will be: <Default-RSA-Key>
Keypair generation process begin. Please wait...
pix(config)# sh crypto key mypubkey rsa
Key pair was generated at: 13:48:13 EST Jul 4 2006
Key name: <Default-RSA-Key>
Usage: General Purpose Key
Modulus Size (bits): 1024
Key Data:

30819f30 0d06092a 864886f7 0d010101 05000381 8d003081 89028181 00b9eb0b
1b9b24c2 3d05206e 25f7444c 9d8c4de8 8f80b8e2 472bd273 c072c46b 4ac413a8
1a336d94 4d10453d 44bbdb46 3e3e88ae fb784741 a01e1fe1 674cd522 146c44aa
b933bdef b8d5660b 31f2fa3d 21195e60 404ed91c 8d66dae6 1f6811d3 a76bb3d1
35bb17c0 f4989f47 98ab01e1 34218e1d 63a1e834 f772119e 3660fe83 2d020301 0001
pix(config)# crypto ca trustpoint ca-srv
pix(config-ca-trustpoint)# enrollment url http://172.29.6.101
pix(config-ca-trustpoint)# exit

pix(config)# crypto ca authenticate ca-srv

INFO: Certificate has the following attributes:
Fingerprint: c5caade4 637a290e 9154d160 79b23e6f
Do you accept this certificate? [yes/no]: yes
Trustpoint CA certificate accepted.
pix(config)# crypto ca enroll ca-srv
%
% Start certificate enrollment ..
% Create a challenge password. You will need to verbally provide this
password to the CA Administrator in order to revoke your certificate.
For security reasons your password will not be saved in the configuration.
Please make a note of it.
Password: 1234567
Re-enter password: 1234567


% The fully-qualified domain name in the certificate will be: pix.test.com

% Include the device serial number in the subject name? [yes/no]: yes

% The serial number in the certificate will be: 480430233

Request certificate from CA? [yes/no]: yes
% Certificate request sent to Certificate Authority

================================================== ================
Manual grant from CA (R6)
================================================== ================
r6#crypto pki server test info ?
crl Certificate Revocation List
requests Enrollment Requests

r6#crypto pki server test info request
Enrollment Request Database:

Subordinate CA certificate requests:
ReqID State Fingerprint SubjectName
--------------------------------------------------------------

RA certificate requests:
ReqID State Fingerprint SubjectName
--------------------------------------------------------------

Router certificates requests:
ReqID State Fingerprint SubjectName
--------------------------------------------------------------
1 pending 195D8A88FD417D6325CEA83F02E29589 serialNumber=480430233+hostname=pix.test.com

r6#crypto pki server test grant 1
================================================== ================
pix(config)# The certificate has been granted by CA!

pix(config)# sh cry ca cert
Certificate
Status: Available
Certificate Serial Number: 03
Certificate Usage: General Purpose
Public Key Type: RSA (1024 bits)
Issuer Name:
cn=test
Subject Name:
serialNumber=480430233+hostname=pix.test.com
Validity Date:
start date: 14:11:59 EST Jul 4 2006
end date: 14:11:59 EST Jul 4 2007
Associated Trustpoints: ca-srv

CA Certificate
Status: Available
Certificate Serial Number: 01
Certificate Usage: Signature
Public Key Type: RSA (1024 bits)
Issuer Name:
cn=test
Subject Name:
cn=test
Validity Date:
start date: 13:59:29 EST Jul 4 2006
end date: 13:59:29 EST Jul 3 2009
Associated Trustpoints: ca-srv