Key policies for Wireless device

[shahinmadambi585]

When I enable SSH/SSL in WLC 9800, Where is the private key stored?

[Mark Elsen]

  - In the running-config.

 M.

[Ambuj M · Accepted solution]

you can run the command

show crypto pki certificates storage

most likely it would be nvram

then execute

dir nvram: you will see .cer and .p7b certificate files

keep in mind that when generating the key pair, if you did not use the keyword exportable you wont be able to export it.

crypto key generate rsa exportable

usually I would not recommend exporting the private key, but I am sure you have use case for it.

hope this helps

[shahinmadambi585]

So FIPS-140 module doesn't save the crypto keys?
It's only for the key generation?

[Ambuj M]

Answer to both question is No.

FIPS (Federal Information Processing Standard) as the name suggests is security compliance standard for U.S. and Canadian government.

for e.g without FIPS Enabled you can use ssh client using sha1 to access 9800 but with FIPS enabled you can’t because it detects it as a non compliance security standard, many more standards like this/ list of appliance/ list of firmware make up FIPS.

you can read more about it here 

https://www.cisco.com/c/en/us/solutions/industries/government/global-government-certifications/fips-140.html

I hope this helps

[shahinmadambi585]

from the screenshot, I can see that the private keys are all stored in the devices. Can help to confirm there is no way to retrieve the private keys out of the device?
if there are ways to retrieve it out of the device, can it be used to spoof the device?

[Rich R]

This was answered on this duplicate post:

https://community.cisco.com/t5/wireless/key-policies-for-wireless-device/td-p/4604199