Installing a self-signed leaf certificate (created inside the switch)

This procedure describes how to create (wholly inside the switch) and install a self-signed X.509 leaf certificate. And associate it with one of the following switch features: syslog client, HTTPS server, or HSC (hardware switch controller).

Procedure
  1. Create a leaf certificate context with the command crypto pki certificate. This switches to the leaf certificate configuration context.
  2. Define leaf certificate properties with the command subject.
  3. Set the encryption key type for the leaf certificate with the command key-type.
  4. Generate and install the self-signed certificate with the command enroll self-signed .
  5. Exit the leaf certificate context with the command exit.
  6. Associate the leaf certificate with a switch feature (syslog client, HTTPS server, or HSC) with the command crypto pki application.

Example

This example:

  • Creates the leaf certificate context.

  • Defines the leaf certificate characteristics.

  • Creates and installs the self-signed leaf certificate.
  • Associates the leaf certificate with the syslog client (application) on the switch. 
switch(config)# crypto pki cert SS_LC
8400X(config-cert-SS_LC)# subject common-name SSLeaf country US
state CA locality Rocklin org Company org-unit Site
8400X(config-cert-SS_LC)# key-type rsa key-size 3072
8400X(config-cert-SS_LC)# enroll self-signed
You are enrolling a certificate with the following attributes:
Subject: C=US, ST=CA, L=Rocklin, OU=Site, O=Company,
         CN=SSLeaf
Key Type: RSA (3072)

Continue (y/n)? y
Self-signed certificate is created and enrolled successfully.
8400X(config-cert-SS_LC)# exit
switch(config)# crypto pki application syslog-client certificate SS_LC