Software Authentication Manager Commands on Cisco IOS XR Software
sam add certificate
sam add certificate
To add a new certificate to the certificate table, use the sam add certificate command in EXEC mode.
sam add certificate filepath location {trust untrust}
Syntax Description |
| filepath | Absolute path to the source location of the certificate. |
|
| location | Storage site of the certificate. Use one of the following: root, mem, disk0, disk1, |
|
|
| or other flash device on router. |
|
|
|
|
|
| trust | Adds the certificate to the certificate table without validation by the Software |
|
|
| Authentication Manager (SAM). To add a root certificate, you must use the trust |
|
|
| keyword. Adding a root certificate with the untrust keyword is not allowed. |
|
|
|
|
|
| untrust | Adds the certificate to the certificate table after the SAM has validated it. Adding |
|
|
| a root certificate with the untrust keyword is not allowed. To add a root |
|
|
| certificate, you must use the trust keyword. |
|
|
| |
|
|
|
|
Defaults |
| No default behavior or values | |
Command Modes
Command History
EXEC
Release | Modification |
Release 2.0 | This command was introduced on the Cisco |
|
|
Release 3.0 | No modification. |
|
|
Release 3.2 | This command was supported on the Cisco XR 12000 Series Router. |
|
|
Usage Guidelines To use this command, you must be in a user group associated with a task group that includes the proper task IDs. For detailed information about user groups and task IDs, see the Configuring AAA Services on Cisco IOS XR Software module of the Cisco IOS XR System Security Configuration Guide.
For security reasons, the sam add certificate command can be issued only from the console or auxiliary port of the networking device; the command cannot be issued from a Telnet connection to any other interface on the networking device.
The certificate must be copied to the network device before it can be added to the certificate table. If the certificate is already present in the certificate table, the SAM rejects the attempt to add it.
When adding root certificates, follow these guidelines:
•Only the certificate authority (CA) root certificate can be added to the root location.
•To add a root certificate, you must use the trust keyword. Adding the root certificate with the untrust keyword is not allowed.
Use of the trust keyword assumes that you received the new certificate from a source that you trust, and therefore have enough confidence in its authenticity to bypass validation by the SAM. One example of acquiring a certificate from a trusted source is downloading it from a CA server (such as Cisco.com) that
Cisco IOS XR System Security Command Reference
