Understanding Certificate Enrollment - Cisco Catalyst 4500 Series Software Configuration Manual

Understanding MKA MACsec with EAP-TLS
•

Understanding Certificate Enrollment

Certificate enrollment is the process of obtaining a certificate from a Certificate Authority (CA). Each
end host that wants to participate in the Cisco IOS public key infrastructure (PKI) must obtain a
certificate. Certificate enrollment occurs between the end host requesting the certificate and the CA. The
figure below and the following steps describe the certificate enrollment process.
If you configure the end host to automatically request certificates from the CA, you should have an
Note
additional authorization mechanism.
Catalyst 4500 Series Switch, Cisco IOS Software Configuration Guide - Cisco IOS XE 3.9.xE and IOS 15.2(5)Ex
48-12
MKA supports encryption using AES-GCM-128 encryption only and does not support Security
Group Tagging.
Step 1 Step 2
Certificate
request
End Host
RSA key pair
The end host generates an RSA key pair.
1.
The end host generates a certificate request and forwards it to the CA.
2.
The CA receives the certificate enrollment request, and, depending on your network
3.
configuration, one of the following options occurs:
Manual intervention is required to approve the request.
–
The end host is configured to automatically request a certificate from the CA. Thus, operator
–
intervention is no longer required at the time the enrollment request is sent to the CA server.
After the request is approved, the CA signs the request with its private key and returns the
4.
completed certificate to the end host.
The end host writes the certificate to a storage area such as NVRAM.
5.
Chapter 48
Step 3 Step 4
CA receives CA signs request
request with private key
Configuring MACsec Encryption
Step 5
Certificate
Storage
end host writes
certificate to
storage