In this video, we get to walk through the process
of training a router to become a certificate authority.
Now, why would that be helpful?
Well, if you're building a lab environment,
and you don't want to have to wheel in or get access
to a certificate authority, whether on-prem
or on the cloud, you can train a router
to be a certificate authority.
You can then have it authenticate with itself,
so it trusts the root certificate, its own.
And then you can have it enroll, so it gets its own identity
certificate.
So I'm going to walk you through that full process right now. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So I'm going to walk you through that full process right now.
OK, so the router we're going to configure here
is router 1, and let's go to the CLI and get to work.
All right, so here we go.
To create RSA key pairs, we definitely
need to have a domain name set up.
So let's go into configuration mode,
and we'll use the IP domain name of ogit.online, that'll work.
And then we need to generate a RSA key pair.
And so the syntax to do that is right here.
crypto key generate rsa general-keys modulus 2048,
and now it says boom, I'm done. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and now it says boom, I'm done.
SSH is now available on this box, because I have a key pair.
And if we want to issue certificates,
we can do so via HTTP, but we have
to have the HTTP server enabled to do that.
So we'll do ip http server.
That's now enabled.
Let's next create a CA server.
So crypto pki server, I'm just going to name it
CA so we know what it is.
That puts us into crypto pki server configuration
mode for the server.
I'm going to add some details regarding this certificate
authority.
So I'm going to add this detail about the issuer name,
just so I recognize it.
Basically, the common name is ca.ogit.online, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Basically, the common name is ca.ogit.online,
so if we see that, we'll think, oh yeah, this is the CA server.
Next, because I don't want to have to go in and manually
approve every certificate request
I get, I'm going to use this command right here, grant auto.
That basically tells your router,
hey, you get a request, boom, you
sign that certificate for that identity,
and you just hand it back out.
No need to get a manual approval.
And then we're going to tell it to go ahead and go
to work with this command right here, no shutdown.
So it's asking us to supply a password
to protect the private key. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to protect the private key.
I'll put a password in.
I will try to retype it the same.
So generate the keys, this is for the CA service.
And it now says that the certificate server is now
enabled.
Fantastic.
So now we have a CA server defined.
It's willing to hand out digital certificates.
But what we now need to do is, we
need to go back to the router and say,
OK, now you know that CA service you have running?
You need to go ahead and trust that root certificate
from that CA server.
And once you trust it, we need to get your own identity
certificate signed by that CA.
Let me walk you through those steps right now. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Let me walk you through those steps right now.
So to define, or to tell this router
that it has a CA server that it trusts and how to get there,
syntax is crypto pki trustpoint, and then a name.
I'm just going to use LOCAL-CA, in upper case, that's
only relevant to this local router's perspective.
So then we need to specify, OK, how
do you reach this CA server?
Now, if we were speaking to it verbally,
we could just say, hey, it's you!
But what we'll do is, we'll specify the enrollment
URL of http://1.1.1.1:80, which is basically TCP port
80 at that address, and that IP address WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
80 at that address, and that IP address
is owned by this router.
We're going to do show ip interface
brief, just to verify that.
And sure enough, that says Loopback0.
So if he needs to reach out to that CA server,
he can do it through this URL.
And previously, we enabled HTTP services, so that's good to go.
The other thing that I want to do
is, I want to avoid any type of revocation checks,
because I don't want it to get in the way.
So revocation-check space none.
That basically means we're not going
to care about getting a CRL or checking a CRL, certificate
revocation list. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
revocation list.
That's a good thing, because I didn't create one.
We could also create a CRL on this CA server
and put it in the flash, but I don't have one.
I'm just going to tell my, from a client perspective,
I'm going to say don't bother looking for one.
And then we can exit out of trustpoint configuration mode.
So now that we've trained this router
on how to reach the CA, its own CA,
we're now going to go ahead and tell it
to authenticate with that CA.
Basically, the authenticate command says,
hey, grab that certificate from that root CA,
and trust it as a trusted CA certificate.
That's what we're going to do right now. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
That's what we're going to do right now.
So to do that, we are going to use the command crypto pki
authenticate, and then the name of our CA right here.
So when we press Enter, it's going
to reach out to itself, to its own CA service,
and ask for the root certificate.
Now, it's also going to prompt us, do we want to accept it?
And if we do, we say yes, press Enter, and boom.
We now have the certificate of that trusted CA
that we can now use.
So if we had three or four different routers,
you could have one router be your certificate authority, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
you could have one router be your certificate authority,
and all the other routers could use this process
to check in with it.
I'm just saving real estate by having the same router be
its own CA server, and then authenticating with itself.
Now, one question might be, well,
how do we verify those certs?
And we could do a show crypto pki cert, right here,
this command.
And this is showing us the CA certificate
that we trust, right there.
So the issuer is ca.ogit.online, the subject is ca.ogit.online.
So now, if this router ever received a digital certificate
that was signed by this CA, it would trust it, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that was signed by this CA, it would trust it,
because it is a trusted CA.
Now, the next step is we want to get
an identity certificate for router 1
itself signed by the CA.
We'll do that with the enroll command.
And the syntax for that is right here. crypto pki enroll.
So the first command was to authenticate,
and then this is enroll, and we'll press Enter.
So it's asking us for a password,
in case we ever need to talk to the CA server
and have the certificate revoked.
So let's go ahead and do a password of this, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's go ahead and do a password of this,
and I will confirm that.
Great.
And it's asking me, hey, in this certificate I'm
about to give you, says the CA, do you
want to include the router's serial number?
And I say, yeah, why not?
And then do you want to include an IP address in the subject
name?
And hey, why not?
And then it's asking me what IP address?
Let's do 15.1.1.1, because that is my IP address
on the outside interface.
And finally, now you have those details specified.
Do you want to request the certificate from the CA?
I will say yes, and survey says it's granted. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I will say yes, and survey says it's granted.
And that's because we tell the CA server to automatically
grant certificates.
We can also verify it with this command, show crypto pki cert.
So here we have our identity certificate.
It was issued by ca.ogit.online.
And the subject is us, R1.ogit.online.
There's the IP address and the serial number,
because we said we want it included.
And then below that, we have the root certificate
that we got earlier when we did the authentication of the CA
server.
So what have we done in this video? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So what have we done in this video?
We've enabled CA services on a router.
We authenticated, we enrolled in preparation
for using RSA signatures as part of the authentication
for remote access VPNs, which we'll
continue that discussion in the next video.
I'll see you there in just a moment.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.