In SSL, the server key is used only to transmit a random 256-bit key (that one does not have mathematical structure, it is just a bunch of bits); roughly speaking, the client generates a random 256-bit key, encrypts it with the server's RSA public key (the one which is in the server's certificate and is a '2048-bit key'), and sends the result to the server. The server uses its private RSA key to reverse the operation, and thus obtain the 256-bit key chosen by the client.

KB ID 0001322

Cisco Crypto Key Gen Rsa

Problem

I’ve lost count of the number of times this has happened to me! Most of my colleagues prefer to use the ASDM for remote management, but if (like me) you work at command line, then sometimes people <ahem> forget to generate the RSA keypair when deploying a firewall. Then even if SSH access and AAA is setup correctly, you still can’t get in via SSH. Instead you see the following;

RoyalTS and RoyalTSX: ssh_exchange_identification: Connection closed by remote host.

PuTTY: PuTTY Fatal Error: Server unexpectedly closed network connection.

SecureCRT: Connection closed.

OSX/Linux: ssh_exchange_identification: Connection closed by remote host.

Now at command line you can fix this with a ‘Crypto Key Generate RSA Modulus 2048‘ command, but you can’t get to command line only ASDM.

Solution

To generate RSA keys, it’s the same as a router or switch: crypto key generate rsa modulus 2048 To manage certificates in ASDM: ASDM Configuration Device Management Certificate Management To configure CLI banners: ASDM Configuration Device Management Management Access Command Line (CLI) Banner … ASDM, HTTPS, Telnet, SSH, SNMP also under Management Access AAA is covered next. End with CNTL/Z. Router1(config)#crypto key generate rsa The name for the keys will be: Router1.oreilly.com Choose the size of the key modulus in the range of 360 to 2048 for your General Purpose Keys. Choosing a key modulus greater than 512 may take a few minutes. How many bits in the modulus 512: 1024 Generating RSA keys. In the first section of this tool, you can generate public or private keys. To do so, select the RSA key size among 515, 1024, 2048 and 4096 bit click on the button. This will generate the keys for you. For encryption and decryption, enter the plain text and supply the key. The cryptograhic strength is primarily linked to the length of the modulus.n. In 2012, a sufficient length is deemed to be 2048 bits. For more information,see the most recent ECRYPT report. Both RSA ciphertext and RSA signature are as big as the modulus.n. (256bytes if.n. is 2048 bit long).

On older versions of the ASDM you could generate the keypair in the Identification Certificates section (well you still can but only if you are also generating a certificate request file). So, as we are command line warriors, lets use the ASDM’s command line!