| 6.5 |  | Digital Certificates |
| 6.5.4 |  | Enroll a device with a CA |

| The typical process for enrolling in a CA is as follows: Step 1 Configure the router for CA support. Step 2 Generate a public and private key-pair on the router. Step 3 The router authenticates the CA server:

- Send the certificate request to the CA/RA.
- Generate a CA/RA certificate.
- Download a CA/RA certificate to a router.
- Authenticate a CA/RA certificate via the CA/RA fingerprint.

Step 4 The router sends a certificate request to the CA.

Step 5 The CA generates and signs an identity certificate.

Step 6 The CA sends the certificates to the router and posts the certificates in its public repository.

Step 7 The router verifies the identify certificate and posts the certificate.

Most of these steps have been automated by Cisco and the SCEP protocol that is supported by many CA server vendors. Each vendor determines how long certificates are valid. Contact the relevant vendor to determine how long the certificates will be valid in each particular case.