Users Guide

19:f3:42:2a:d2:c4:3b:de:c4:4d:ad:f0:72:c5:b4:25:51:e5:
3c:76:8b:97:3c:db:fe:3f:7f:41:d2:d9:aa:7f:98:90:6b:cf:
27:53:0e:66:83:8e:cc:81:ef:6a:e5:cd:c2:f1:e2:ea:84:4f:
73:bb:90:5a:b3:19:a3:50:6a:c7:b3:99:e4:09:fd:56:99:83:
3a:15:93:b0:4a:49:28:78:69:85:de:fc:06:cc:b9:a5:5b:d9:
4a:b0:46:90:ce:94:3a:9c:f3:04:e4:d7:98:36:29:a8:8b:fe:
72:26:b0:fd:39:5e:14:f5:00:6d:0e:4f:ec:d4:a5:ca:4f:e1:
d9:4f:5a:37:21:e3:a2:fb:80:db:cd:68:0b:a0:fa:58:0d:5e:
40:e1:e4:1c
Supported
Releases
10.5.0 or later
ip ssh server x509v3-authentication security-profile
Enables RFC 6187 X.509v3 authentication in a SSH server.
Syntax
ip ssh server x509v3-authentication security-profile profile-name
[password-less]
Parameters profile-name — Enter the name of the security profile; a maximum of 32 characters.
password-less - Use X.509v3 authentication for password-less authentication.
Default Not configured
Command mode CONFIGURATION
Security and
Access
sysadmin and secadmin
Usage
information
The security profile specifies the PKI certificate the SSH server uses. It also determines whether to apply
OCSP revocation checks, CRL revocation checks, peer name checks, and key usage checks during client
certificate validation.
If you configure the password-less option, then SSH password-less login is supported by matching the
client X.509v3 certificate against the configured certificate. By default, password-less login is disabled
and the user is prompted for a password after the client certificate validates.
When you set the password-less option with X.509v3 authentication, the system authenticates only
locally. Configuring remote authentication using RADIUS or TACAC+ has no effect when X.509v3
authentication when using the password-less option.
X.509v3 authentication requires an SSH client that supports RFC 6187 X.509v3 SSH authentication.
The no version of this command disables the X.509v3 authentication.
Example
OS10(config)# ip ssh server x509v3-authentication security-profile
profile-1
Supported
releases
10.5.2.0 or later
ocsp-check [ocsp-url]
Enables OCSP revocation checks when validating certificates.
Syntax
ocsp-check [ocsp-url]
Parameters ocsp-url — The URL of an OCSP responder used to check revocation. If specified, the URL is used to
check if a certificate is revoked, instead of the OCSP URL in the certificate.
Default Not configured
Command mode SEC-PROFILE
Security and
Access
sysadmin and secadmin
Security 1389