### UPDATE ####
After the reboot, even with the workaround, rollover will generate with 1024 bit. So, only thing that works for sure is generates rsa key before roll over starts.
###############
Ok, I did some digging, and I think I found the workaround for this problem. I did not see any document mentioning it, other than this thread, so I decided to write it for the others.
Stop the server. Then add following config in the truspoint for the ca server.
rsakeypair <use server name> <360-4096>
This trustpoint is usually automatically created when server is initially started.
Don't forget to use server name for the key, otherwise it doesn't seem to work.
Also, try this for couple times because for some strange reasons it doesn't catch the configuration change.
If you can, I really recommend to start all over with making trustpoint first before starting the server and specify the key length. That way, you don't have to generate rsa key to use different key length other than 1024, And it will keep using specified key length.
There is also a another trick that I found, however this trick is one time only so you have to do every time roll over happens. The trick is simple, just generate the key with following command.
crypto key generate rsa modulus <360-4096> label <CA's keyname># exportable
label you're key with "#" at the end. If you happens to have rollover CA in you're router,
type show crypto key mypubkey rsa and you'll know what I'm saying. It seems when rollover kick's in, it generates the same exact key name with #, yes it will skip generates when the key exists, and when the time is right, they override the original key.
If the first workaround did not work for you, you should try the last one even though it's not permanent solution.
