> # PKI Enrollment Support

> Enrollment is the process of obtaining an identity certificate for the switch that is used for applications such as IPsec/IKE or SSH. It occurs between the switch requesting the certificate and the certificate authority.

> The PKI enrollment process for a switch involves the following steps:

> 1. Generate an RSA private and public key-pair on the switch.
> 2. Generate a certificate request in standard format and forward it to the CA.
> 3. Manual intervention at the CA server by the CA administrator may be required to approve the enrollment request, when it is received by the CA.
> 4. Receive the issued certificate back from the CA, signed with the CA’s private key.
> 5. Write the certificate into a nonvolatile storage area on the switch (bootflash).

> Copyright 2010-2015, Cisco Systems, Inc. All rights reserved.