Crypto

Crypto configuration manages the public key infrastructure (PKI) on NX-OS. Key pairs (crypto key generate) create the RSA or ECC keys a device uses for its identity certificates, and certificate authority trustpoints (crypto ca trustpoint) bind a key pair to a CA, define the enrollment method and control how peer certificates are checked for revocation. Trustpoints are referenced by features that use certificates, such as NX-API, syslog over TLS and RADIUS over TLS/DTLS. CA authentication and certificate import are operational steps that remain outside the data model.

Key pairs cannot be changed after they have been generated. To change the type, modulus or exportable setting of a key pair, remove it and add it again.

Diagram

Classes

nxos

Name	Type	Constraint	Mandatory	Default Value
devices	List	devices	No
device_groups	List	device_groups	No
global	Class	global	No
templates	List	templates	No

devices (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

device_groups (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

global (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

templates (nxos)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

configuration (nxos.devices)

Name	Type	Constraint	Mandatory	Default Value
crypto	Class	crypto	No

crypto (nxos.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
keys	List	keys	No
ca_trustpoints	List	ca_trustpoints	No

keys (nxos.devices.configuration.crypto)

Name	Type	Constraint	Mandatory	Default Value
label	String		Yes
type	Choice	rsa, ecc	No
exportable	Boolean	true, false	No
modulus	Choice	224, 384, 512, 521, 768, 1024, 1536, 2048, 3072, 4096	No

ca_trustpoints (nxos.devices.configuration.crypto)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
enrollment_terminal	Boolean	true, false	No
rsakeypair	String		No
ecckeypair	String		No
cabundle	String		No
revocation_check	List	Choice[crl, ocsp, none]	No
ocsp_url	String		No

Examples

Example 1: ECC key pair and trustpoint for terminal enrollment

nxos:
  devices:
    - name: LEAF1
      configuration:
        crypto:
          keys:
            - label: LEAF1-KEY
              type: ecc
              modulus: 384
              exportable: true
          ca_trustpoints:
            - name: CORP-CA
              enrollment_terminal: true
              ecckeypair: LEAF1-KEY
              revocation_check:
                - crl
                - none

Example 2: RSA key pair and trustpoint with a CA bundle and OCSP revocation checking

nxos:
  devices:
    - name: SPINE1
      configuration:
        crypto:
          keys:
            - label: SPINE1-RSA
              type: rsa
              modulus: 2048
          ca_trustpoints:
            - name: ISSUING-CA
              enrollment_terminal: true
              rsakeypair: SPINE1-RSA
              cabundle: CORP-CA-BUNDLE
              ocsp_url: http://ocsp.example.com:80
              revocation_check:
                - ocsp
                - crl
                - none