Removing RSA Key Pairs

You might want to remove an RSA key pair for one of the following reasons:

■ During manual PKI operations and maintenance, old RSA keys can be removed and replaced with new keys.

■ An existing CA is replaced and the new CA requires newly generated keys; for example, the required key size might have changed in an organization so you would have to delete the old 1024-bit keys and generate new 2048-bit keys.

To remove all RSA keys or the specified RSA key pair that has been generated by your router, use the following command:

router(config)# crypto key zeroize rsa [key-pair-label]

Syntax Description key-pair-label

(Optional) Specifies the name of the key pair that the router will delete

Note If the key-pair-label argument is not specified, all RSA keys that have been generated by your router will be deleted.

This command deletes all RSA keys that were previously generated by your router unless you include the key-pair-label argument, which will delete only the specified RSA key pair. If you issue this command, you must also perform two additional tasks for each trustpoint that is associated with the key pair that was deleted:

■ Ask the CA administrator to revoke your router certificates at the CA; you must supply the challenge password that you created when you originally obtained the router certificates using the crypto ca enroll command.

■ Manually remove the router certificates from the configuration by removing the configured trustpoint (using the no crypto ca trustpoint name command.)

Note This command cannot be undone (after you save your configuration). After RSA keys have been deleted, you cannot use certificates or the CA or participate in certificate exchanges with other IPsec peers unless you reconfigure CA interoperability by regenerating RSA keys, getting the CA certificate, and requesting your own certificate again.

4-142 Securing Networks with Cisco Routers and Switches (SNRS) v2.0

Continue reading here: Generating RSA Keys

Was this article helpful?

+1 0