SSH Server Public Key Too Small vulnerable on Cisco WLC

[vinothRajendran]

For this vulnerable need to increase the Key size from 1024 to 2048.
On WLC how to check the existing RSA key SIZE? Please share the command here to fix the issue.

[Flavio Miranda]

Hi

config network ssh host-key use-device-certificate-key

https://www.cisco.com/c/en/us/td/docs/wireless/controller/8-2/config-guide/b_cg82/b_cg82_chapter_011.html 

[Scott Fella]

When you say you have a Cisco WLC, what is the model you have.  I'm also assuming you are using 1024bit since you got flagged by security audit?  You can always just generate a new certificate using 2048.  I would think that you can export that cert and look at the key size.

[balaji.bandi]

Depends on WLC ( cat 9800 with IOS XE or Airos ?)

you  can see that in config or show crypto commands.

syntax to change ( it take longer than normal time when you generating 2048) - make sure be partient. (suggest to use console prefer)

crypto key generate rsa [ general-keys | usage-keys | signature | encryption ] [ label key-label ] [exportable] [ modulus modulus-size ] [ storage devicename : ] [redundancy] [ on devicename : ]

[vinothRajendran]

Model: AIR-CT5508-K9
IOS running:8.5.182.0
Questions: Before updating to 2048, i need to check the RSA key size frist.
If I run the show crypto command its not work on WLC.

[quicker_cdets_api]

The content of this message was removed 

[vinothRajendran]

(Cisco Controller) >show crypto key mypubkey rsa

Incorrect usage. Use the '?' or <TAB> key to list commands.

(Cisco Controller) >

[Scott Fella]

On your browser go to your controller and then look at the certificate.  That is the easiest way to check what you are using unless you are looking for a different certificate.  Each browser has a different way to look at the site certificate that is being presented.

[Mohammed Hamzeh]

If the key size is currently set to 1024, you will need to generate a new key with a larger size.\n\nTo generate a new RSA key with a size of 2048, use the following command:

`config crypto key generate rsa`

You will be prompted to specify the size of the new key. Enter \"2048\" and follow the on-screen instructions to complete the process.After generating the new RSA key, you should also update any SSH or SSL configurations on the WLC to use the new key.