This discussion has been locked. The information referenced herein may be inaccurate due to age, software updates, or external references.
You can no longer post new replies to this discussion. If you have a similar question you can start a new discussion in this forum.

Automate config push for Crypto Pki trustpoint

Looking for suggestions/help on how i can push the following commands to all my routers automatically where script automatically grabs the router hostname "fqdn HOSTNAME.mydomain.com" and pushed the following commands and also authenticate and enroll to the new CA.

crypto pki trustpoint testca

enrollment url http://testcacert.com:80

serial-number none

fqdn HOSTNAME.mydomain.com

revocation-check crl

rsakeypair Hostname  2048 2048

crypto ikev2 profile IKeINET2PROFILE

match fvrf INET2

match identity remote address 0.0.0.0

authentication remote rsa-sig

authentication local rsa-sig

pki trustpoint testca

crypto pki authenticate testca

!! wait for 15 sec

!! Type Yes and hit Enter

crypto pki enroll testca

! Hit Enter three times

Hit Enter

Hit Enter

Hit Enter

! type Yes and hit Enter

Yes

exit

wr mem

  • I was searching for a way to automate certificate trust points and came across this post. And believe I have found the solution to this.

    There is a command that can be used within the "crypto pki trustpoint" configuration mode called fingerpint. Just add the finegerprint to the command script and push out to your switches and routers as a command txt script with NCM. Worked perfectly for me. Hope this helps!

    The certificate fingerprint can be found under certificate details.

    Note: will be listed as thumbprint under details.

    !

    !

    crypto pki trustpoint My-Root-CA

    enrollment url tftp://x.x.x.x/BLAHRootCA.crt

    fingerprint 8C12SHRC EA1EA6ED 27FNC986 46DRBFKM  12DHFJHR<----this allows you to authenticate a CA non interactively.

    !

    !

    crypto pki authenticate My-Root-CA

    referernce:Cisco IOS Security Command Reference: Commands D to L - F through H [Support] - Cisco