Cisco: PKI SCEP

Server

crypto pki server CiscoCA
 database level complete
 issuer-name CN=MyCiscoCA,OU=VPN,O=lab,C=NL
 grant auto
 hash sha256
 lifetime crl 5
 lifetime ca-certificate 3650
 database url flash:/CiscoCA
!
crypto pki trustpoint CiscoCA
 revocation-check crl
 rsakeypair CiscoCA
!
crypto pki certificate chain CiscoCA
 certificate ca 01
  xxxxxxxx
        quit
!
ip http server

Client

crypto pki trustpoint CiscoCA
 enrollment url http://192.168.2.77:80
 usage ike
 serial-number
 fqdn spoke spoke.frotmail.lan
 subject-name CN=spoke1,OU=VPN,O=Frotmail,C=NL
 revocation-check crl
 auto-enroll
 authorization username subjectname all
 certificate chain flash:ca.crt
 hash sha256
!
crypto pki certificate chain CiscoCA
 certificate 02
  xxxxxxxx
        quit
 certificate ca 01
  xxxxxxxx
        quit

spoke1(config)#crypto pki authenticate CiscoCA
Certificate has the following attributes:
       Fingerprint MD5: 56684161 5F41B059 144AA0CF D2A7BF97
       Fingerprint SHA1: 09DD5795 345BAE1C 80AD7B76 8E3AAF04 911359A0

% Do you accept this certificate? [yes/no]: yes
Trustpoint CA certificate accepted.
spoke1(config)#crypto pki enroll CiscoCA
%
% Start certificate enrollment ..
% Create a challenge password. You will need to verbally provide this
   password to the CA Administrator in order to revoke your certificate.
   For security reasons your password will not be saved in the configuration.
   Please make a note of it.

Password:
*Apr 13 19:52:52.787:  RSA key size needs to be atleast 768 bits for ssh version 2
*Apr 13 19:52:52.787: %SSH-5-ENABLED: SSH 1.5 has been enabled
*Apr 13 19:52:52.787: %CRYPTO-6-AUTOGEN: Generated new 512 bit key pair
Re-enter password:

% The subject name in the certificate will include: CN=spoke1,OU=VPN,O=Frotmail,C=NL
% The subject name in the certificate will include: spoke spoke.frotmail.lan
% Include the router serial number in the subject name? [yes/no]: yes
% The serial number in the certificate will be: FCZ113120JP
% Include an IP address in the subject name? [no]:
Request certificate from CA? [yes/no]: yes
% Certificate request sent to Certificate Authority
% The 'show crypto pki certificate verbose CiscoCA' commandwill show the fingerprint.

*Apr 13 19:53:14.319: CRYPTO_PKI:  Certificate Request Fingerprint MD5: 286C8259 1DF7BD25 22A984F9 4D8C952E
*Apr 13 19:53:14.319: CRYPTO_PKI:  Certificate Request Fingerprint SHA1: A6EBCE0F 40164BD8 D6F9A4E5 325BF320 640E54FA
*Apr 13 19:53:16.327: %PKI-6-CERTRET: Certificate received from Certificate Authority

spoke1#show crypto pki certificates
Certificate
  Status: Available
  Certificate Serial Number (hex): 02
  Certificate Usage: General Purpose
  Issuer:
    cn=MyCiscoCA
    ou=VPN
    o=lab
    c=NL
  Subject:
    Name: spoke spoke.frotmail.lan
    Serial Number: FCZ113120JP
    serialNumber=FCZ113120JP+hostname=spoke spoke.frotmail.lan
    cn=spoke1
    ou=VPN
    o=Frotmail
    c=NL
  Validity Date:
    start date: 18:37:18 UTC Apr 13 2014
    end   date: 18:37:18 UTC Apr 13 2015
  Associated Trustpoints: CiscoCA

CA Certificate
  Status: Available
  Certificate Serial Number (hex): 01
  Certificate Usage: Signature
  Issuer:
    cn=MyCiscoCA
    ou=VPN
    o=lab
    c=NL
  Subject:
    cn=MyCiscoCA
    ou=VPN
    o=lab
    c=NL 
  Validity Date:
    start date: 18:27:35 UTC Apr 13 2014
    end   date: 18:27:35 UTC Apr 10 2024
  Associated Trustpoints: CiscoCA