Monitoring Digital Certificates and Public Keys

Use the following show commands to display information about IKE certificates, IKE configurations, CRLs, public keys, and peer public keys.

show ipsec ca identity

Use to display information about IKE CA identities used by the router for online digital certificate configuration. You can display information for a specific CA or for all CAs configured on the router.
Field descriptions
- CA—Certificate authority that the router uses to generate certificate requests
- enrollment url—URL of the SCEP server where the router sends certificate requests
- issuer id—Name of the CA issuer providing the digital certificates
- retry period—Number of minutes that the router waits after receiving no response from the CA before resending a certificate request
- retry limit—Number of minutes during which the router continues to send a certificate request to the CA
- crl setting—Setting that controls how the router checks the certificate revocation lists
- proxy url—HTTP proxy server used to retrieve the root CA certificate, if any

Example

host1#show ipsec ca identity mysecureca1

CA: mysecureca1 parameters:
enrollment url:http://192.168.10.124/scepurl
issuer id     :BetaSecurityCorp
retry period  :1
retry limit   :60
crl setting   :optional
proxy url     :

See show ipsec ca identity.

show ipsec certificates

show ike certificates

Note: The show ike certificates command has been replaced by the show ipsec certificates command and may be removed completely in a future release.

Use to display the IKE certificates and CRLs on the router. Specify the type of certificate you want to display:
- all—All certificates configured on the router
- crl—Certificate revocation lists
- peer—Peer certificates
- public-certs—Public certificates
- root-cas—Root CA certificates
Use the hex-format keyword to display certificate data, such as serial numbers, in hexadecimal format. Doing so allows easier comparison with CAs, such as Microsoft, that display certificates in hexadecimal format.
Field descriptions
- Ca identity—Certificate authority that the router uses to generate certificate requests
- SubjectName—Distinguished name for the certificate
- IssuerName—Organization that signed and issued the certificate
- SerialNumber—Unique serial number assigned to the certificate by the CA
- SignatureAlgorithm—Algorithm used for the digital signature
- Validity—Beginning and ending period during which the certificate is valid
- PublicKeyInfo—Information about the public key
- Extensions—Fields that provide additional information for the certificate
- Fingerprints—Unique hash of the certificate, which can be used to verify that the certificate is valid

Example 1

host1#show ipsec certificates public-certs

---------- Public Certificates: ----------

Ca Identity:[trustedca1]Certificate =
  SubjectName = <C=us, O=junipernetworks, CN=jim>
  IssuerName = <C=CA, ST=ON, L=Kanata, O=BetaSecurityCorp, OU=VT Group, CN=VT Root CA>
  SerialNumber= 84483276204047383658902
  SignatureAlgorithm = rsa-pkcs1-sha1
  Validity =
    NotBefore = 2003 Oct 21st, 16:14:42 GMT
    NotAfter  = 2004 Oct 21st, 16:24:42 GMT
  PublicKeyInfo =
    PublicKey =
      Algorithm name (SSH) : if-modn{sign{rsa-pkcs1-md5}}
      Modulus n  (1024 bits) :
        13409127965307061503054050053800642488356537668078160605242622661311625
        19876607806686846822070359658649546374128540876213416858514288030584124
        05896520823533525098960335493944208019747261524241389345208872551265097
        58542773588125824612424422877870700028956172284401073039192457619002485
        5366053321117704284702619
      Exponent e (  17 bits) :
        65537
  Extensions =
    Available = authority key identifier, subject key identifier, key usage,
      subject alternative name, authority information access, CRL distribution
      points
    SubjectAlternativeNames =
      Following names detected =
        DNS (domain name server name)
      Viewing specific name types =
        DNS = host1.kanata.junipernetworks.com
    KeyUsage = DigitalSignature
    CRLDistributionPoints =
      % Entry 1
      FullName =
        Following names detected =
          URI (uniform resource indicator)
        Viewing specific name types =
          URI = http://vtsca1/CertEnroll/VTS%20Root%20CA.crl
      % Entry 2
      FullName =
        Following names detected =
          URI (uniform resource indicator)
        Viewing specific name types =
        No names of type IP, DNS, URI, EMAIL, RID, UPN or DN detected.
    AuthorityKeyID =
      KeyID =
        15:0a:17:4d:36:b6:49:96:fa:d5:be:df:51:3e:e4:90:51:a2:c0:95
      AuthorityCertificateIssuer =
        Following names detected =
          DN (directory name)
        Viewing specific name types =
        No names of type IP, DNS, URI, EMAIL, RID, UPN or DN detected.
      AuthorityCertificateSerialNumber = 79592882508437425959858112994892506178
    SubjectKeyID =
      KeyId =
        78:e0:3e:f7:24:65:2d:4b:01:d4:91:f9:66:c7:67:26:06:74:6c:5c
    AuthorityInfoAccess =
      AccessMethod = 1.3.6.1.5.5.7.48.2
      AccessLocation =
        Following names detected =
          URI (uniform resource indicator)
        Viewing specific name types =
        No names of type IP, DNS, URI, EMAIL, RID, UPN or DN detected.
      AccessMethod = 1.3.6.1.5.5.7.48.2
      AccessLocation =
        Following names detected =
          URI (uniform resource indicator)
        Viewing specific name types =
        No names of type IP, DNS, URI, EMAIL, RID, UPN or DN detected.
  Fingerprints =
    MD5 = c4:c9:22:b6:19:07:4e:4f:ee:81:7a:9f:cb:f9:1f:7e
    SHA-1 = 58:ba:fb:0d:68:61:42:2a:52:7e:19:82:77:a4:55:4c:25:8c:c5:60

Example 2

host1# show ipsec certificates root-cas
---------- Root CAs: ----------
Ca Identity:[trustedca1]Certificate =
  SubjectName = <C=CA, ST=ON, L=Kanata, O=Juniper Networks, OU=VTS Group, CN=VTS Root CA>
  IssuerName = <C=CA, ST=ON, L=Kanata, O=BetaSecurityCorp, OU=VT Group, CN=VT Root CA>
  SerialNumber= 79592882508437425959858112994892506178
  SignatureAlgorithm = rsa-pkcs1-sha1
  Certificate seems to be self-signed.
      * Signature verification success.
  Validity =
    NotBefore = 2003 Mar 26th, 15:50:53 GMT
    NotAfter  = 2006 Mar 26th, 15:59:59 GMT
  PublicKeyInfo =
    PublicKey =
      Algorithm name (SSH) : if-modn{sign{rsa-pkcs1-md5}}
      Modulus n  (1024 bits) :
        14424807498766001201060433525671934401816213246866823722650117007030500
        12414152472800629737773845549310833804653975288246486381759003010224672
        53370575541853958272072875412915858260834056069053966369912244336288229
        09443381900005615652631560044304863856421739848326865877661787314144447
        8276502323232108941157077
      Exponent e (  17 bits) :
        65537
  Extensions =
    Available = subject key identifier, key usage, basic constraints(critical),
CRL distribution points, unknown
KeyUsage = DigitalSignature NonRepudiation KeyCertSign CRLSign
BasicConstraints =
cA         = TRUE
[critical]
CRLDistributionPoints =
% Entry 1
FullName =
Following names detected =
URI (uniform resource indicator)
Viewing specific name types =
URI = http://vtsca1/CertEnroll/VTS%20Root%20CA.crl
% Entry 2
FullName =
Following names detected =
URI (uniform resource indicator)
Viewing specific name types =
No names of type IP, DNS, URI, EMAIL, RID, UPN or DN detected.
SubjectKeyID =
KeyId =
15:0a:17:4d:36:b6:49:96:fa:d5:be:df:51:3e:e4:90:51:a2:c0:95
Unknown 1.3.6.1.4.1.311.21.1 =
02:01:00                                           ...
Fingerprints =
MD5 = 8c:56:fb:a6:bd:ab:13:67:e6:13:09:c1:d0:de:1f:24
SHA-1 = 22:3d:84:6d:d4:5f:18:87:ae:2c:15:7d:2a:94:20:ff:c6:12:fb:6f

See show ike certificates.
See show ipsec certificates.

show ipsec identity

show ike identity

Note: The show ike identity command has been replaced by the show ipsec identity command and may be removed completely in a future release.

Use to display the IKE identity configuration.
Field descriptions
- Domain Name—Domain name the router uses in IKE authentication messages and to generate certificate requests
- Common Name—Common name used to generate certificates
- Organization—Name of the organization used in the Subject Name field of certificates
- Country—Country used to generate certificates

Example

host1#show ipsec identity

Ike identity:
        Domain Name :myerx.kanata.junipernetworks.com
        Common Name :jim
        Organization:junipernetworks
        Country     :ca

See show ipsec identity.
See show ike identity.

show ipsec ike-configuration

show ike configuration

Note: The show ike configuration command has been replaced by the show ipsec ike-configuration command and may be removed completely in a future release.

Use to display a summary of the IKE configuration.
Field descriptions
- Ike identity—Information from your IKE identify configuration that the router uses to generate certificate requests
- CRL Check—Setting of the CRL check: optional, required, ignored

Example

host1#show ipsec ike-configuration

Ike configuration:
Ike identity:
        Domain Name :treverxsys2.juniper.net
        Common Name :Sys2 ERX
        Organization:Juniper Networks
        Country     :CA
CRL Check:optional

See show ipsec ike-configuration.
See show ike configuration.

show ipsec key mypubkey rsa

Use to display the 1024-bit or 2048-bit RSA public key configured on the router.
The public key is generated as part of a public/private key pair used to perform RSA authentication during ISAKMP/IKE SA negotiations.
For information about the format of an RSA public key, see Public Key Format .

Example

host1#show ipsec key mypubkey rsa
 30819f30 0d06092a 864886f7 0d010101 05000381 8d003081 89028181 009cfbde
 a16cf72c 49fbd3c1 10d5d9d4 8ba15ec0 9adcb19e 18d488f8 e0370c51 2d10e751
 ddd81be4 dfc78aad 9deb797f b2c51172 18967cfb e18f6efa 69285fef 10337527
 78ca6bbc 907abb9e 44b12713 ab70cb0e a86d9c6c 80c99bd1 e2bf6b70 91222295
 616a88bb cc479e15 be04f3a5 a6160645 844598c3 314b66af 3a8b7602 ed020301
 0001

See show ipsec key mypubkey rsa.

show ipsec key pubkey-chain rsa

Use to display a 1024-bit or 2048-bit ISAKMP/IKE public key that a remote peer uses for RSA authentication.
To display a brief summary of the remote peers for which public keys are configured on the router, use the summary keyword.
To display the public key for a remote peer with a specific IP address, use the address keyword followed by the IP address, in 32-bit dotted decimal format.
To display the public key for a remote peer with a specific identity, use the name keyword followed by either:
- The fully qualified domain name (FQDN)
- The FQDN preceded by an optional user@ specification; this is also referred to as user FQDN format
The FQDN and user FQDN identifiers are case-sensitive and must exactly match the identifier specified in the ipsec key pubkey-chain rsa command. For example, a public key for user FQDN mjones@sales.company_abc.com does not match a public key for FQDN sales.company_abc.com.
For information about the format of an RSA public key, see Public Key Format .
Field descriptions
- Remote Peer—IP address, FQDN, or user FQDN identifier of the remote peer for which the peer public key can be used
- Key Type—Type of remote peer identifier: ip address (if IP address is specified) or identity (if FQDN or user FQDN is specified)

Example 1—Displays a summary of the remote peers for which peer public keys are configured

host1#show ipsec key pubkey-chain rsa summary
         Remote Peer               Key Type
-----------------------------     ----------
192.168.32.3                      ip address
grp003.cust535.isp.net            identity
tsmith@grp003.cust535.isp.net     identity

Example 2—Displays the peer public key for a remote peer with the specified IP address

host1#show ipsec key pubkey-chain rsa address 192.168.32.3

 30819f30 0d06092a 864886f7 0d010101 05000381 8d003081 89028181 0082065f
 841aa03a fadfda9f bf8be05c d2fe3596 abc3e265 0b86b99a df9b4907 29c7a737
 8bf08491 5c96e72d 28471a12 f0735ff4 04d76ad1 3a80f10c 23dcadda b68ce8ec
 5fdfbe58 a52008db 9a11f867 d38d0483 e4abd53c 89a4dc3c 985ea450 f17748c4
 3f04def0 a3cf5d89 b62dfeae 5990641b 370bb113 73105ba7 585a41fc 3b020301
 0001

Example 3—Displays the peer public key for a remote peer with the specified FQDN identifier

host1#show ipsec key pubkey-chain rsa name grp003.cust535.isp.net

30820122 300d0609 2a864886 f70d0101 01050003 82010f00 3082010a 02820101
 00c03cc6 0bad55ea b4f8a01f 5cf69de5 f03185e2 1338b5cb fa8418c3 6cbe1a77
 bfefba5b 7a8f0ac2 6e2b223b 11e3c316 a30f7fb0 7bd2ab8a a614bb3d 2fce97bf
 d6376467 0d5d1a16 d630c173 3ed93434 e690f355 00128ffb c36e72fa 46eae49a
 5704eabe 0e34776c 7d243b8b fcb03c75 965c12f4 d68c6e63 33e0207c a985ffff
 2422fb53 23d49dbb f7fd3140 a7f245ee bf629690 9356a29c b149451a 691a2531
 9787ce37 2601bdf9 1434b174 4fd21cf2 48e10f58 9ac89df1 56e360b1 66fb0b3f
 27ad6396 7a491d74 3b8379ea be502979 8f0270b2 6063a474 fadc5f18 f0ca6f7a
 ddea66c7 cf637598 9cdb5087 0480af29 b9c174ab 1b1d033f 67641a8c 5918ddce
 1f020301 0001

Example 4—Displays the peer public key for a remote peer with the specified user FQDN identifier

host1#show ipsec key pubkey-chain rsa name tsmith@grp003.cust535.isp.net

30819f30 0d06092a 864886f7 0d010101 05000381 8d003081 89028181 00bcc106
 8694a505 0b92433e 4c27441e 3ad8955d 5628e2ea 5ee34b0c 6f82c4fd 8d5b7b51
 f1a3c94f c4373f9b 70395011 79b4c2fb 639a075b 3d66185f 9cc6cdd1 6df51f74
 cb69c8bb dbb44433 a1faac45 10f52be8 d7f2c8cd ad5172a6 e7f14b1c bba4037b
 29b475c6 ad7305ed 7c460779 351560c6 344ccd1a 35935ea3 da5de228 bd020301
 0001

See show ipsec key pubkey-chain rsa.