topic Custom PKI Trust-Profile in Controllers

Custom PKI Trust-Profile

Evelyn Riha — Fri, 01 Mar 2019 12:33:05 GMT

Hi,

Is there a way to change the trust profile name in APIC-EM PKI broker or create a new one?

In the documentation I could only find the following information:

trustProfileName (string😞 Name of trust-profile (must already exist). Default: sdn-network-infra-iwan,

Many thanks,

Evelyn

Re: Custom PKI Trust-Profile

cchitnis — Wed, 02 Nov 2016 17:38:27 GMT

What are you trying to create trust profile for? iWAN or something else?

For iWAN, the APIC-EM iWAN App will create the trust point for you, through PKI broker. You don't have to explicitly create it. It's a part of Cisco validated design (CVD) for iWAN.

For anything else, you can use corresponding REST API (POST) to create one. Here are the APIs for PKI broker, exposed in swagger:

https://<APIC-EM controller IP>/swagger#!/pki-broker

Re: Custom PKI Trust-Profile

Evelyn Riha — Wed, 02 Nov 2016 18:20:43 GMT

We're not using iWAN app but using the REST API with a script for the trustpoint configs.

My script is creating a trustpoint for each device with a API call and until now I've always used the sdn-network-infra-iwan name but it would be nice to have another name for it as we're not using the iWAN. E.g. a trust profile with the name "my-ipsec-ca" for my trustpoints.

I couldn't something to modify this name within APIC - neither in the APIs nor in the GUI.

Re: Custom PKI Trust-Profile

aluktuke — Wed, 02 Nov 2016 21:36:11 GMT

Hi Evelyn,

Currently only the default "sdn-network-infra-iwan" profile is supported for the /trust-point POST API.

Thanks,

Ashutosh