Juniper IP SERVICES - CONFIGURATION GUIDE V 11.1.X Configuration Manual page 261

ipsec key generate
ipsec key pubkey-chain rsa
Example
host1(config)#ipsec ike-policy-rule 2
host1(config-ike-policy)#
Use the no version to remove policies. If you do not include a priority number
with the no version, all policies are removed.
See ipsec ike-policy-rule.
Use to generate a 1024-bit or 2048-bit RSA key pair.
Example
host1(config)#ipsec key generate rsa 2048
Please wait.................................................
..........................
IPsec Generate Keys complete
There is no no version. To remove a key pair, use the ipsec key zeroize
command.
See ipsec key generate.
Use to access IPSec Peer Public Key Configuration mode to configure the public
key for a remote peer with which you want to establish IKE SAs.
The ipsec key pubkey-chain rsa command enables you to manually enter the
public key data for the remote peer without having to obtain a digital certificate.
To specify the IP address of the remote peer associated with the public key, use
the address keyword followed by the IP address, in 32-bit dotted decimal format.
To specify the identity of the remote peer associated with the public key, use
the name keyword followed by either:
The fully qualified domain name (FQDN)
The FQDN preceded by an optional user@ specification; this is also referred
to as user FQDN format
The FQDN and user FQDN identifiers are case-sensitive.
To ensure that the public key is associated with the correct remote peer, the
router requires an exact match for the identifier string. For example, a public
key for user FQDN mjones@sales.company_abc.com does not match a public
key for FQDN sales.company_abc.com.
From IPSec Peer Public Key Configuration mode, use the key-string command
to enter the peer public key data. For information about how to use this
command, see "key-string" on page 236 .
Example 1 Enables you to configure the public key for a remote peer with IP
address 192.168.50.10
host1(config)#ipsec key pubkey-chain rsa address 192.168.50.10
Configuring Peer Public Keys Without Digital Certificates
Chapter 8: Configuring Digital Certificates
235