SSH with X509v3 certificates

[JUANNN]

Hello,

I am doing a little lab using SSHv2 with X509v3 certificate client authentication. I have a simple setup:

* Windows PC with 2 SSH clients:

- Putty with PuttyCAC for smartcard support

- PragmaFortress SSH Client with smartcard support

*C1121X-8PLTEPW running Cisco IOS XE Software, Version 17.12.05a

I have a smart card that contains the ID certificate that I wish to use for authentication. Following the document:

- Configuring SSH with x509 authentication on IOS devices - Cisco

and also the PragmaSystems Guide for integration with Cisco devices using smartcard authentication.

But I cannot get it to work. I have been many days trying to figure out what I am doing wrong without success. Here are my configs on the router:

and I successfully installed the ROOT-CA certificate and the SUB-CA certificate on it as well (i was assuming that the sub-CA CA certificate was necessary, please correct me if this is wrong):

ROOT-CA

SUB-CA

From my understanding (and please correct me if wrong) these certificates are used to validate the signature of the ID certificate that is contained on my smartcard, since the issuing CA of my smartcard certificate is CA65 (the subCA):

Then, I use PragmaFortressClient or PuttyCAC to use my smartcard for authentication over SSH:

and I get the following:

I do not see anywhere the router receiving the certificate from the PragmaClient, or verifying it against the CA trustpoints. The thing is that the SSH client seems to be reading my smartcard because it uses as the username the Common Name field of the ID Certificate of the smartcard:

Any help is truly appreciated, thanks. I have been many days and hours stuck with this.

Juan

[JUANNN · Accepted solution]

Hello everyone,

I just figured out! 

I had 2 things wrong:

- I had Pageant running at the same time I was trying to use PragmaFortressClient. This was caussing the issue that the SSH client from Pragma could not send the ID certificate of my smartcard, I am assuming because Pageant was the one using it? 

- The second issue was that I had to specify the command: authorization username subjectname commonname under the SUB-CA trustpoint. The missing of this command was causing the issue of not being able for the router to generate a username from the certificate received. According to Cisco documentation:

so since I was using aaa new-model, then this is required!! Note that no local usernames are required to be configured. Everything is retrieved from the ID certificate of the smartcard.

Finally, for anyone's interest, I can confirm that only the SUB-CA trustpoint is needed under the verification of the SSH Server (the ROOT-CA certificate is NOT needed to be installed in the router because the SUB-CA is already authenticated!!). And the chain-validation command is not needed neither way (I used to use this command for routers enrolling to SUB-CAs for IPsec VPN authentication with certificates, but here since there is no enrollment from the router part, there is no point in having it). The final configuration looks like:

As long as we authenticate the SUB-CA via the terminal (or dynamically if the case), SSH authentication with certificates works good!

I hope this helps anyone trying to implement this, regards

Juan

[Arne Bier · Accepted solution]

This is a great bit of a lab work and I am certain someone will find this useful. I was wondering about the use of the Sub-CA versus the Root CA. What happens when the sub-CA expires? Then you have to renew all the trustpoints on all your devices. Would it not have been better to install the longer-lived (usually) Root CA to make the solution future proof?

[JUANNN]

Hello @Arne Bier , 

Thanks for you interest and answer. You definitely stated the best solution, thanks so much. Now I removed the SUBCA trustpoints, I specified to verify the Root Ca one on the ip ssh certificate profile… and it works for any smartcard of our organization, without having to add SubCa certificates for groups of users. 

Thanks,

Juan