Home > Cisco > Security > Cisco Router PKI
Public Key Infrastructure (PKI) provides the foundation for secure authentication, encryption, and trust management in enterprise networks. Cisco routers use PKI extensively for technologies such as IPsec VPNs, SSL VPNs, DMVPN, FlexVPN, HTTPS management access, and 802.1X authentication.
Rather than relying on shared secrets, PKI uses digital certificates signed by a trusted Certificate Authority (CA). This allows routers to verify identities cryptographically and establish secure communications without manually distributing passwords across the network.
PKI is a framework consisting of:
In a Cisco environment, routers generate RSA key pairs locally. The public key is submitted to a CA through a Certificate Signing Request (CSR). The CA validates the identity and issues a signed certificate. Other devices can then trust the certificate if they trust the issuing CA.
Certificate Authority 10.10.10.10 | ---------------- | | Client-R1 Client-R2 192.168.1.1 192.168.2.1
The CA router acts as the trusted Certificate Authority. Both client routers enroll and receive certificates from the CA.
Before configuring PKI on Cisco IOS routers, configure a hostname and domain name. Cisco uses this information when generating RSA key pairs and creating certificate identity information. Also set the clock to current time.
hostname CA-Router ip domain-name example.com hostname Client-R1 ip domain-name example.com clock set 14:30:00 June 19 2026
After the hostname and domain name are configured, generate the RSA key pair required for certificate operations.
crypto key generate rsa general-keys modulus 4096
The following configuration creates a self-signed Certificate Authority on a Cisco router.
hostname CA-Router crypto key generate rsa general-keys modulus 4096 crypto pki server ENTERPRISE-CA issuer-name CN=Enterprise-Root-CA,O=ExampleCorp,C=US grant auto database level complete database url nvram: no shutdown
Verification:
show crypto pki server show crypto pki certificates
The CA is now capable of signing certificate requests from Cisco devices.
Create RSA keys on the client router.
hostname Client-R1 crypto key generate rsa general-keys modulus 2048
crypto pki trustpoint ENTERPRISE-CA enrollment url http://10.10.10.10 revocation-check none rsakeypair Client-R1 subject-name CN=Client-R1,O=ExampleCorp,C=US
crypto pki authenticate ENTERPRISE-CA
The router displays the CA fingerprint. Verify the fingerprint before accepting.
crypto pki enroll ENTERPRISE-CA
The router generates a Certificate Signing Request (CSR), sends it to the CA, and receives a signed certificate.
show crypto pki certificates show crypto pki trustpoints show crypto key mypubkey rsa
Expected output should show:
One of the most common uses of PKI is certificate-based IPsec authentication.
crypto isakmp policy 10 encryption aes 256 hash sha256 authentication rsa-sig group 14 crypto isakmp identity dn crypto ipsec transform-set VPN-SET esp-aes 256 esp-sha-hmac crypto map VPN-MAP 10 ipsec-isakmp set peer 192.168.2.1 set transform-set VPN-SET match address 100 interface GigabitEthernet0/0 crypto map VPN-MAP
crypto isakmp policy 10 encryption aes 256 hash sha256 authentication rsa-sig group 14 crypto isakmp identity dn crypto ipsec transform-set VPN-SET esp-aes 256 esp-sha-hmac crypto map VPN-MAP 10 ipsec-isakmp set peer 192.168.1.1 set transform-set VPN-SET match address 100 interface GigabitEthernet0/0 crypto map VPN-MAP
Instead of pre-shared keys, both routers authenticate using their CA-issued certificates.
debug crypto pki transactions debug crypto pki messages
Verify IP connectivity to the CA and ensure HTTP enrollment is reachable.
show crypto pki certificates
Check certificate validity dates and renew if necessary.
debug crypto isakmp debug crypto ipsec
Ensure both routers trust the same CA and possess valid identity certificates.
PKI provides scalable and secure identity management for Cisco networks. By replacing pre-shared keys with digital certificates, organizations gain stronger authentication, centralized trust management, and simplified VPN deployments. Cisco routers can function as both Certificate Authorities and certificate clients, making PKI an essential technology for secure enterprise networking, DMVPN, FlexVPN, HTTPS management, and certificate-based IPsec VPN implementations.