IOS CLI parser possible deprecation of crypto key zeroize

[techfil]

In IOS-XE 17.12 seeing this entry in logs when running the EEM update applet:

%PARSER-5-HIDDEN: Warning!!! ' crypto key zeroize rsa CISCOAUTOCERT' is a hidden command. Use of this command is not recommended/supported and will be removed in future.

Investigate impact and remediation (if necessary).

[DN0000]

Heads up: Running cry key zeroise rsa may also delete the onboard SSH keys (at least in my environment), which can complicate remote access after deployment.

I'm developing a similar tool with a different approach—a Docker container based on Certbot, packaged for IOX—since the guest shell appears to be goosed update wise in any current release.

Disregard - See below

[techfil]

Hello there, and thanks for your comments @DN0000

I'd be curious to understand more about what was removed (specifically, what are the onboard SSH keys). Are you referring to saved SSH public key chains for authentication? What was the problem with remote access in your environment?

The update I'd like to publish (soon ®) will be more lightweight (and compatible with ARM platforms), but besides the way certbot is packaged, I'd like to understand more about how you install the web certificate on the router (if you are ok to share) because those are two separate problems, aren't they.

[DN0000]

Disregard - See below

Jan 26 18:53:00.490: %PARSER-5-HIDDEN: Warning!!! ' crypto key zeroize rsa ' is a hidden command. Use of this command is not recommended/supported and will be removed in future.
Jan 26 18:53:00.573: %CRYPTO_ENGINE-5-KEY_DELETED: A key named TP-self-signed-3598882102 has been removed from key storage
Jan 26 18:53:00.614: %CRYPTO_ENGINE-5-KEY_DELETED: A key named SBC has been removed from key storage
Jan 26 18:53:00.615: %CRYPTO_ENGINE-5-KEY_DELETED: A key named TP-self-signed-3598882102.server has been removed from key storage
Jan 26 18:53:00.620: %SSH-5-DISABLED: SSH 2.0 has been disabled

Running in this router (4331 / 17.12.4) resulted in it dropping the RSA keypair used for SSH, which impacted remote access until it was regenerated:

VG01#crypto key generate rsa modulus 4096 
The name for the keys will be: VG01.domain.co.uk

% The key modulus size is 4096 bits

% Generating crypto RSA keys in background ...

VG01#
VG01#
Jan 26 18:54:27.058: %CRYPTO_ENGINE-5-KEY_ADDITION: A key named VG01.domain.co.uk has been generated or imported by crypto-engine
Jan 26 18:54:27.065: %SSH-5-ENABLED: SSH 2.0 has been enabled
VG01#
Jan 26 18:54:30.483: %CRYPTO_ENGINE-5-KEY_ADDITION: A key named VG01.domain.co.uk.server has been generated or imported by crypto-engine

In terms of installing the cert, I am removing and readding the specific trustpoint associated with the trunks to teams:

!! EEM Script to delete, import, and re-apply your trustpoint
!! Update to your requirements
event manager applet INSTALL-CERT
 event syslog pattern "%IM-5-IOX_INST_NOTICE:.*READY TO DEPLOY CERTIFICATE"
 action 000 cli command "## Credit - https://github.com/techfil/ciscoautocert ##"
 action 020 cli command "enable"
 action 060  syslog msg "Begin certificate install"
 action 070  cli command "config t"
 action 080  cli command "file prompt quiet"
 action 090  cli command "no crypto pki trustpoint SBC" pattern ".*"
 action 100  cli command "yes"
 action 130  cli command "crypto pki import SBC pkcs12 bootflash:/SHARED-IOX/certbot-iox.p12 password cisco" pattern ".*"
 action 140  cli command "yes"
 action 160  cli command "default file prompt"
 action 170  cli command "do delete /force bootflash:/SHARED-IOX/certbot-iox.p12"
 action 190  cli command "sip-ua"
 action 200  cli command "no  crypto signaling default trustpoint SBC"
 action 210  cli command  "crypto signaling default trustpoint SBC"
 action 990  cli command "end"
 action 991  cli command "write"

Unsure if removing and reapplying the sip-ua config is required, and still needs some cleanup (Like testing the file exists before blatting the trustpoint!) I'll look to try and publish my work once I've had another renew cycle, and will drop you a note to see if there is anything useful there!

[techfil]

Thank you for the additional details, appreciated.

I'm wondering if there have been modifications to the EEM script though, because in the log you don't see the specific reference to CISCOAUTOCERT being removed. In normal conditions I've always seen it being the only target for deletion (as it should be). CISCOAUTOCERT key is not used for SSH, so I would never expect to see this happening with the provided script.

[DN0000]

You are 100% correct 😄

I was using variable and it ended up having no argument, causing the misbehavior. Apologies for the confusion!

The approach I ended up using is over at https://github.com/DN0000/certbot-iox

[techfil]

Glad it was resolved and thanks for crediting the script in your repo 🙌🏻
cheers