I'm currently a trainee, and I am assigned to do a task where I have to find out whether it is possible if a switch can get its certificate by contacting the TACACS-Server.

To explain what I'm trying to say, I will describe my situation.

My company is currently accessing all switches on remote locations via Telnet (which is of course insecure). It is planned to switch to SSH. But because the switches are not in secured locations, my company doesn't want to keep the certificates for SSH on the switch itself, but on the TACACS server, and when logging into the switch, the switch gets the certificate from the server to authenticate. We're currently using TACACS for default authentication.

Is it possible that the switch can get the certificate from the TACACs server?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Commented Aug 14, 2017 at 1:51

1 Answer 1


The short answer is no, because the SSH authentication happens before the login authentication (where the TACACS server is contacted).

Even if it were possible to download the certificate, you would then have the problem of verifying that the device that downloaded it is in fact the right switch.

I suspect having the certificate on the switch is relatively low risk. It would be very, very difficult (but not impossible) to steal the private key to impersonate the switch.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.