topic Re: PKCS #12 Import failed in Controllers

PKCS #12 Import failed

vishal-patil — Fri, 01 Mar 2019 12:33:59 GMT

Hi,

I am trying to deploy iWAN through APIC-EM iWAN app. While deploying hub site, I am getting following error -

Nov 29 21:51:37.156: CRYPTO_PKI: status = 0x747(E_EOS : end of i/o stream): Imported PKCS12 file failure

*Nov 29 21:51:37.156: %PKI-6-PKCS12IMPORT_FAIL: PKCS #12 Import Failed.

Please advise

Thanks,

Vish

Re: PKCS #12 Import failed

aradford — Tue, 29 Nov 2016 20:52:52 GMT

some one else had a similar issue in this thread.

https://communities.cisco.com/thread/72808

Re: PKCS #12 Import failed

cchitnis — Tue, 29 Nov 2016 21:07:45 GMT

What is the device details here? What platform? What release of APIC-EM is in use? Which iWAN workflow is this - the hub provisioning or branch provisioning? Details like these would help us understand and troubleshoot better.

Having said that, please refer to the link Adam has given to figure out if there's any routing that's causing this in your set-up.

Additionally, there's a known issue on device side where if the certificate is more than 4K bytes of size, then PKCS import will fail. So please check the size of your cert.

Re: PKCS #12 Import failed

vishal-patil — Tue, 29 Nov 2016 21:10:40 GMT

Thank you. did debug crypto messages/transaction. Looks like the devices are contacting APIC-EM by its external IP somehow while importing certificate.

*Nov 29 22:09:06.707: CRYPTO_PKI: Copying pkcs12 from http://xx.xx.xx.xx/api/v1/trust-point/pkcs12/7bf507b5-4566-4b55-a440-d0cfcbc7a298/3c4nlc88u5tq266glql3bfq36p

xx- should be internal IP

Hopefully I will be able to fix this

Thanks,

Vish

Re: PKCS #12 Import failed

vishal-patil — Tue, 29 Nov 2016 21:12:06 GMT

Hi,

Thanks for the info (especially certificate size. will take a note of that)

Thanks,

Visha

Re: PKCS #12 Import failed

Igor Manassypov — Fri, 23 Dec 2016 13:24:43 GMT

Hi Visha,

Regarding public/private address for PKI cert import - does that mean with EM 1.3 we can not use iWAN app provisioning over INET (in which case we have no choice but to NAT the controller)? In my case, it is a dual-router LTE branch

Thanks,

Igor

Re: PKCS #12 Import failed

cchitnis — Fri, 23 Dec 2016 19:30:28 GMT

Limitation on cert size is specific to subCA deployment. If you don't have subCA deployment, you are fine.

Re: PKCS #12 Import failed

cchitnis — Fri, 23 Dec 2016 19:31:33 GMT

[Edited 01/23/2017: Pre release 1.4, NAT'ed controller support for iWAN is for greenfield sites only. In release 1.4, we are extending that support to brownfield sites as well]

AFAIK, we do support NAT'ed controller. As long as there's a connectivity from your branch to the controller, the PKCS12 import should be fine.

Re: PKCS #12 Import failed

cchitnis — Tue, 24 Jan 2017 01:25:59 GMT

APIC-EM behind NAT (NAT'ed controller) support for brownfield branch sites to be released in 1.4 release.

Re: PKCS #12 Import failed

Alex Pfeil — Thu, 31 Aug 2017 14:00:01 GMT

Is there any update on this?