PKI - IOS CA Router backup

[snarayanaraju]

Hello All - Cisco IOS Router configure as Certificate Authority (CA) Server. There are 800 Branches configure in IPSEC tunnel to Datacenter Router using PKI Certificates.

In the event of CA Router crashes or go offline 

1) Will it impact the existing IPSEC Tunnel?

2) What should we plan for a back up in the IOS CA Router to bring the CA in another Hardware?

regards,sairam

[Giuseppe Larosa · Accepted solution]

Hello Sairam,

give a read to the following document

https://community.cisco.com/t5/security-documents/ios-ca-basic-deployment-certificate-enrollment-and-signing/ta-p/3120844

About your questions:

the IPSec tunnels will not be affected until there isn't the need to consult the failed / offline CA.So for sure you cannot deploy new sites and what happens when the current IPSec SA expire may depend on configuration.

2) I don't know if it is even possible to backup a CA, because RSA keys are involved and we have commands to generate RSA keys I don't know if there are commands to import them.

It is a good question.

Hope to help

Giuseppe

[snarayanaraju]

Thank you, Giuseppe - Glad to see a reply from you for my post. It helps a lot

I will read the URL you provided and will get back if any question I will have. Thanks again 

regards,Sairam