3 ms·
I think what Cisco is trying to solve is to give users the possibility to connect to the device over a secure connection in case a user has no access to a signe
by thdrdt 7y ago
I think what Cisco is trying to solve is to give users the possibility to connect to the device over a secure connection in case a user has no access to a signed certificate by an authority.
So the user must still connect the self-signed certificate when connecting to the device (over ssh for example).
So in this case the user generates the certificate and also accepts it.
By the way, most ssh clients will tell you if a certificate changed. So the moment your self-signed certificate is compromised you will know.
- oarsinsync 7y ago> most ssh clients will tell you if a certificate changed Most implementations of ssh in the wild don't use CA (or self) signed certificates. I dont know if Cisco even supports the use of ssh with certificates.
- GhettoMaestro 7y agoCisco SSH has supported public key auth for as far as I can recall.
- oarsinsync 7y agoSSH keys and certificates are different authentication mechanisms (I learnt this from https://news.ycombinator.com/item?id=20955465 https://news.ycombinator.com/item?id=20955465)
- jlgaddis 7y ago> I dont know if Cisco even supports the use of ssh with certificates. They do -- in addition to public key auth, as GhettoMaestro mentioned.
- C1sc0cat 7y agoI would assume you can login via the CON (console) or the AUX port as a last resort.