topic pushing a template with a .pem text prompt in Cisco Catalyst Center

pushing a template with a .pem text prompt

josephbdelossantos — Thu, 12 Dec 2024 22:48:00 GMT

Hi, I need to push a new cert so several devices, how do I make DNA automatically answer a yes prompt when prompted after the pem text?

!
no crypto pki trustpoint DNAC-CA
!

crypto pki trustpoint DNAC-CA
enrollment mode ra
enrollment terminal
usage ssl-client
revocation-check none
!
exit
!
crypto pki authenticate DNAC-CA
!
-----BEGIN CERTIFICATE-----
MIIGbjCCBFagAwIBAgIQFyvfESxJQZtFFjuiwCH0DjANBgkqhkiG9w0BAQsFADAu
MSwwKgYDVQQDEyNDT0EgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBSMTAe
Fw0yNDA2MTIxODU4NTNaFw0zNTA2MTIxOTA4NTJaMC4xLDAqBgNVBAMTI0NPQSBS
b290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IFIxMIICIjANBgkqhkiG9w0BAQEF
AAOCAg8AMIICCgKCAgEAvB+N+mbY8TjJrIM1Lfg9VIT9EeQ7VLH09oWQsnqqUi+S
39/UibmeQLGl2GZMJQAWCb3J2tK3nMnnzQU3uZa7YkOH1x1jtSD+Lrt+GUBlNKXbqY6f1UQ8YWVct1XIf
G43+deBCLy6xwNA6HR32SjjVXbREBnpxFBlaVPrdujL1fJ/dgGQh0W/bpUYbbtKE
b5zNbfC62PGqaaYFMHPiCUxJyY3gp3hHgnmvlVny6BjU+XAF6V+ygCmzKRmeLtx8
O53YvE8aEuoKDfTE5W5qT5D7DYgOlJkGR8oZMeleFcs7XD3G6oh7P96foBlXssOR
bT/Zk3P2L0uKvBi1uWH7EeW4NjX5Tp7EWzO6HP7wahc2AdEBFMsG9THp6C0i1stn
0/+kHYnZDzM14PN8qX26S+zRWGPGIMAadjMnZdxpDehCexA9q2UCo9m5a4vwJlEC
AwEAAaOCAYYwggGCMAsGA1UdDwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud
DgQWBBTCn9WEYesu9JhWWKTLBPD2VZY1pDAQBgkrBgEEAYI3FQEEAwIBADCCAS8G
A1
-----END CERTIFICATE-----

Re: pushing a template with a .pem text prompt

Torbjørn — Fri, 13 Dec 2024 07:31:28 GMT

You need to use the #INTERACTIVE special keyword:

#INTERACTIVE
commands<IQ>interactive question<R> response
#ENDS_INTERACTIVE

"commands" here is the command you are trying to execute, after the <IQ> you put the text prompted and after <R> you add what you need to enter to get past the prompt.

See the "Interactive commands" portion of this documentation: https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/2-3-5/user_guide/b_cisco_dna_center_ug_2_3_5/b_cisco_dna_center_ug_2_3_5_chapter_01000.html#special_keywords

Re: pushing a template with a .pem text prompt

Dan Rowe — Mon, 16 Dec 2024 15:07:06 GMT

Out of curiosity, why are you using a template to push the DNAC-CA certificate rather than letting CatC handle that natively through intent?

Re: pushing a template with a .pem text prompt

josephbdelossantos — Mon, 16 Dec 2024 16:28:37 GMT

Bec device controllability is disabled

Re: pushing a template with a .pem text prompt

josephbdelossantos — Mon, 16 Dec 2024 21:49:57 GMT

Its failing for me

Message: Unable to push the invalid CLI to the device 172.x.x.x using protocol ssh2. Invalid CLI -  Current output : crypto pki authenticate DNAC-CA

Enter the base 64 encoded CA certificate.
End with a blank line or the word "quit" on a line by itself


Current expects : Extran.{0,30}([^)]+)#s*z (Config Prompt)
extranet-1#s*z (Prompt)
[y/n] (Interactive)
ACCEPT? (yes/[no]): (Interactive)
[confirm] (Interactive)

here is my template (cert is snipped)
#INTERACTIVE
no crypto pki trustpoint DNAC-CA<IQ>Removing an enrolled<R>yes
#ENDS_INTERACTIVE
!
crypto pki trustpoint DNAC-CA 
enrollment mode ra
enrollment terminal
usage ssl-client
revocation-check none
!
crypto pki authenticate DNAC-CA
-----BEGIN CERTIFICATE-----
MIIGbj1TO+XeJT30CIoRn2F0xAUk9mqNRfUFH55bl0
rG5DfQZMv8qU+X9EueAHD3Ynv7sENA+C5YU9gkbRKvdYu4emk3xrgPqhu94i5qHe
JI9viXh/53dTvZwfTf7m+2Dlci+TOFOuh0rHC7IDysZbB/fPSRCRkeIUMthfBal0
1fzaWsX6ITFzjuYZN811zlbO
-----END CERTIFICATE-----
quit
#INTERACTIVE
<IQ>Do you accept this certificate?<R>yes
#ENDS_INTERACTIVE

Please help thank you

Re: pushing a template with a .pem text prompt

Torbjørn — Mon, 16 Dec 2024 22:02:34 GMT

Can you post the output you are getting?

Didn't think of it the first time I replied, but you will also need to wrap the certificate configuration with the <MLTCMD> and </MLTCMD> tags like so:

<MLTCMD>crypto pki authenticate DNAC-CA -----BEGIN CERTIFICATE----- MIIGbj1TO+XeJT30CIoRn2F0xAUk9mqNRfUFH55bl0 rG5DfQZMv8qU+X9EueAHD3Ynv7sENA+C5YU9gkbRKvdYu4emk3xrgPqhu94i5qHe JI9viXh/53dTvZwfTf7m+2Dlci+TOFOuh0rHC7IDysZbB/fPSRCRkeIUMthfBal0 1fzaWsX6ITFzjuYZN811zlbO -----END CERTIFICATE----- quit</MLTCMD>

Without this the Cat-C expects the prompt to reappear after each line of configuration.

Re: pushing a template with a .pem text prompt

josephbdelossantos — Tue, 17 Dec 2024 00:27:27 GMT

still having the issue after adding /MLTCMD

NCTP10214: Provisioning failed for the template PKI.

Message: Unable to push the invalid CLI to the device 172.31.1.14 using protocol ssh2. Invalid CLI -  Current output : crypto pki authenticate DNAC-CA

Enter the base 64 encoded CA certificate.
End with a blank line or the word "quit" on a line by itself

-----BEGIN CERTIFICATE-----
MIIGbjCCBFagAwIBAgIQFyvfESxJQZtFFjuiwCH0DjANBgkqhkiG9w0BAQsFADAu
MSwwKgYDVQQDEyNDT0EgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBSMTAe
Fw0yNDA2MTIx3VtxlPr8CEQNzPAqNbqkPRp4bbrJSIZs2zeEcHuo31JErBGyIciUCvXl/+rFPPGV
EHbtjSGbwZSYQgGofAHKwXCYGkyg7LtSZsDzDHxaY8q3RxFEwQOg2G2YqHGYSTPK
oazDKXgAzpJobxK19+PgIulV83HrsDdkvvT/t6tX65ot7gZfoN1TEIdAkDM+EF9F
IBjQuwRCNNUUbdHmNHQrB/PiAHk57333JQ2HapZI6DMdFPRK9/UibmeQLGl2GZMJ
QAWCb3J2tK3nMnnzQU3uZa7YkOH1x1jtSD+Lrt+GUBlNKXbqY6f1UQ8YWVct1XIf
G43+deBCLy6xwNA6HR32SjjVXbREBnpxFBlaVPrdujL1fJ/dgGQh0W/bpUYbbtKE
b5zNbfC62PGqaaYFMHPiCUxJyY3gp3hHgnmvlVny6BjU+XAF6V+ygCmzKRmeLtx8
O53YvE8aEuoKDfTE5W5qT5D7DYgOlJkGR8oZMeleFcs7XD3G6oh7P96foBlXssOR
bT/Zk3P2L0uKvBi1uWH7EeW4NjX5Tp7EWzO6HP7wahc2AdEBFMsG9THp6C0i1stn
0/+kHYnZDzM14PN8qX26S+zRWGPGIMAadjMnZdxpDehCexA9q2UCo9m5a4vwJlEC
AwEAAaOCAYYwggGCMAsGA1UdDwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud
DgQWBBTCn9WEYesu9JhWWKTLBPD2VZY1pDAQBgkrBgEEAYI3FQEEAwIBADCCAS8G
A1UdIASCASYwggEiMAYGBFUdIAAwggEWBggqAwSLL0NZBTCCAQgwgdAGCCsGAQUF
BwICMIHDHoHAAFQAaABlACAAYwBlAHIAdABpAGYAaQBjAGEAdABlAHMAIAB0AGgA
YQB0ACAAYQByAGUAIABpAHMAcwB1AGUAZAAgAGIAeQAgAHQAaABpAHMAIABDAGUA
cgB0AGkAZgBpAGMAYQB0AGUAIABBAHUAdABoAG8AcgBpAHQAeQAgAGEAcgBlACAA
ZgBvAHIAIABpAG4AdABlAHIAbgBhAGwAIABDAE8AQQAgAHUAcwBhAGcAZQAgAG8A
bgBsAHkALgAgMDMGCCsGAQUFBwIBFidodHRwOi8vcGtpLmFuYWhlaW0uaW50cmFu
ZXQvY2FpbmZvLmh0bWwwDQYJKoZIhvcNAQELBQADggIBAEadXpB7q0uhsOHidaEe
45F0USrFndFoTkcIv1slxdIuu591A58VSQt0hll7QL2lPNnGLK++8lZS/7xX8m28
nV5brDEgnDiuhL2zlQXgDYzD3ECV6S8MMOCysh+LN17n0q2O7AFGnuxunhYgyR6Q
HoLCp6O7MqJ7QolY9fAsC1Yh21Qc1yE0vVXhlU1fXRf8EMDQU77OFXu3bwE2qXQx
g9HW6kyi0MDenBgLBq5MrH7OGU4ebLSURP3RrVtz9Buld3jR0V1+nYjzSGGgWjUX
SM5myQ/w1QGd7mmE5OODcVkve6SQCMWMUV1o7euoGzoJ8ygXjGj+RV4cqQVos6hd
nw8ZyS+OPQ0PdL93Pl9p/Gy4mw8lHen9rnsZj/ciy6KFB5T25eT+g6C7QFzyXMVF
t4BfIUepexTfCWYskh8sm7Qj4WLH8QVmQkQv4Kzci+8v3BtJX+Xqq1J332QxshHp
vsBQCNxr7Z1tLD2WY7Jk0TtTY7cT1TO+XeJT30CIoRn2F0xAUk9mqNRfUFH55bl0
rG5DfQZMv8qU+X9EueAHD3Ynv7sENA+C5YU9gkbRKvdYu4emk3xrgPqhu94i5qHe
JI9viXh/53dTvZwfTf7m+2Dlci+TOFOuh0rHC7IDysZbB/fPSRCRkeIUMthfBal0
1fzaWsX6ITFzjuYZN811zlbO
-----END CERTIFICATE-----
quit
Certificate has the following attributes:
       Fingerprint MD5: xxxxxxxxxxxxxxxxxxxxxxxxxxxx
      Fingerprint SHA1: XXXXXXXXXXXXXXXXXXXXXXXXXXXX

% Do you accept this certificate? [yes/no]: 
Current expects : Extran.{0,30}([^)]+)#s*z (Config Prompt)
Extranet-SW1#s*z (Prompt)
[y/n] (Interactive)
ACCEPT? (yes/[no]): (Interactive)
[confirm] (Interactive)

Re: pushing a template with a .pem text prompt

Christian4lores — Thu, 22 May 2025 05:45:10 GMT

This is at least non giving any errors with Jinja on DNAC, however the certificate is not inputting. Let me know if you have any more success!

#INTERACTIVE
!
<MTLCMD>crypto pki authenticate DNAC-CA<IQ>[yes/no]<R>yes
-----BEGIN CERTIFICATE-----
MIIGbjCCBFagAwIBAgIQFyvfESxJQZtFFjuiwCH0DjANBgkqhkiG9w0BAQsFADAu
MSwwKgYDVQQDEyNDT0EgUm9vdCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eSBSMTAe
Fw0yNDA2MTIxODU4NTNaFw0zNTA2MTIxOTA4NTJaMC4xLDAqBgNVBAMTI0NPQSBS
b290IENlcnRpZmljYXRpb24gQXV0aG9yaXR5IFIxMIICIjANBgkqhkiG9w0BAQEF
AAOCAg8AMIICCgKCAgEAvB+N+mbY8TjJrIM1Lfg9VIT9EeQ7VLH09oWQsnqqUi+S
39/UibmeQLGl2GZMJQAWCb3J2tK3nMnnzQU3uZa7YkOH1x1jtSD+Lrt+GUBlNKXbqY6f1UQ8YWVct1XIf
G43+deBCLy6xwNA6HR32SjjVXbREBnpxFBlaVPrdujL1fJ/dgGQh0W/bpUYbbtKE
b5zNbfC62PGqaaYFMHPiCUxJyY3gp3hHgnmvlVny6BjU+XAF6V+ygCmzKRmeLtx8
O53YvE8aEuoKDfTE5W5qT5D7DYgOlJkGR8oZMeleFcs7XD3G6oh7P96foBlXssOR
bT/Zk3P2L0uKvBi1uWH7EeW4NjX5Tp7EWzO6HP7wahc2AdEBFMsG9THp6C0i1stn
0/+kHYnZDzM14PN8qX26S+zRWGPGIMAadjMnZdxpDehCexA9q2UCo9m5a4vwJlEC
AwEAAaOCAYYwggGCMAsGA1UdDwQEAwIBhjAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud
DgQWBBTCn9WEYesu9JhWWKTLBPD2VZY1pDAQBgkrBgEEAYI3FQEEAwIBADCCAS8G
A1
-----END CERTIFICATE-----
quit<\MLTCMD>
!
#ENDS_INTERACTIVE

Re: pushing a template with a .pem text prompt

andrew-rob182 — Tue, 02 Dec 2025 23:55:15 GMT

I was running into this same issue and managed to solve it by adding the fingerprint to the trustpoint which then negates the need for any interact commands when you enter "quit" at the end of the certificate.

crypto pki trustpoint CERT fingerprint XXXXXX enrollment terminal revocation-check none ! <MLTCMD>crypto pki authenticate CERT -----BEGIN CERTIFICATE----- -----END CERTIFICATE----- quit</MLTCMD> !