Cisco CRS-1 - Carrier Routing System Router Configuration Manual page 219

Implementing Secure Socket Layer on Cisco IOS XR Software
Purpose of Certification Authorities
Certification Authorities (CAs) are responsible for managing certificate requests and issuing certificates
to participating IPSec network devices. These services provide centralized key management for the
participating devices.
CAs simplify the administration of IPSec network devices. You can use a CA with a network containing
multiple IPSec-compliant devices, such as routers.
Digital signatures, enabled by public key cryptography, provide a means of digitally authenticating
devices and individual users. In public key cryptography, such as the RSA encryption system, each user
has a key pair containing both a public and a private key. The keys act as complements, and anything
encrypted with one of the keys can be decrypted with the other. In simple terms, a signature is formed
when data is encrypted with a user's private key. The receiver verifies the signature by decrypting the
message with the sender's public key. The fact that the message could be decrypted using the sender's
public key indicates that the holder of the private key, the sender, must have created the message. This
process relies on the receiver having a copy of the sender's public key and knowing with a high degree
of certainty that it does belong to the sender and not to someone pretending to be the sender.
Digital certificates provide the link. A digital certificate contains information to identify a user or device,
such as the name, serial number, company, department, or IP address. It also contains a copy of the
entity's public key. The certificate is itself signed by a CA, a third party that is explicitly trusted by the
receiver to validate identities and to create digital certificates.
To validate the signature of the CA, the receiver must first know the CA's public key. Normally, this
process is handled out-of-band or through an operation done at installation. For instance, most web
browsers are configured with the public keys of several CAs by default. Internet Key Exchange (IKE),
an essential component of IPSec, can use digital signatures to scalable authenticate peer devices before
setting up security associations (SAs).
Without digital signatures, a user must manually exchange either public keys or secrets between each
pair of devices that use IPSec to protect communication between them. Without certificates, every new
device added to the network requires a configuration change on every other device with which it
communicates securely. With digital certificates, each device is enrolled with a CA. When two devices
want to communicate, they exchange certificates and digitally sign data to authenticate each other. When
a new device is added to the network, a user simply enrolls that device with a CA, and none of the other
devices needs modification. When the new device attempts an IPSec connection, certificates are
automatically exchanged and the device can be authenticated.
How to Implement Secure Socket Layer
To configure SSL so that it can be used by any application, such as HTTP server or object request broker
(ORB) server, perform the task described in the following section.
•
Configuring Secure Socket Layer
This task explains how to configure SSL.
SUMMARY STEPS
1.
OL-20382-01
Configuring Secure Socket Layer, page SC-213
crypto key generate rsa [usage-keys | general-keys] [keypair-label]
Cisco IOS XR System Security Configuration Guide for the Cisco CRS-1 Router
How to Implement Secure Socket Layer
(required)
SC-213