Error in DNAC-Template CLI + Velocity

[michael-bentley]

Hello Community, 
i am pretty new to this. i try to update the certificate of an Trustpoint via CLI-Template ( Velocity ) for an C9300l-Switch
Everything i try gives me an error.
Here is what im trying to do:

#MODE_ENABLE
##!INTERACTIVE

crypto pki authenticate trustpointname
-----BEGIN CERTIFICATE-----
content of PEM-File
-----END CERTIFICATE-----
quit

##!ENDS_INTERACTIVE
#END_MODE_ENABLE

Errormessage:

Message: Unable to push the invalid CLI to the device 172.X.X.X using protocol ssh2. Invalid CLI - Current output : crypto pki authenticate Trustpointname

Enter the base 64 encoded CA certificate.
End with a blank line or the word "quit" on a line by itself

I dont underrstand, what the Issue is, can someone please help? 
With kind regards

[Flavio Miranda]

@michael-bentley 

 If this DNAC is 2.3.5.3 check the Bug CSCwh39165

https://bst.cisco.com/quickview/bug/CSCwh39165

Description (partial)

Symptom: Applying a template to a device managed by Cisco DNA Center may fail citing the error, "Message: Unable to push the invalid CLI to the device x.x.x.x using protocol ssh2. Invalid CLI - 'interface $item'. Command Output : interface $item interface $item

[michael-bentley]

Hello Flavio, 

i am running Catalyst Center 2.3.7.6 . 

I think there is something wrong with my commands... i just cant figure out,, what it is

[Flavio Miranda]

The Bug has no fixed release, which means, your version can be affected. The message is quite similar to the Bug.

But, have you tried put the quit of the far end?

#MODE_ENABLE
##!INTERACTIVE

crypto pki authenticate trustpointname
-----BEGIN CERTIFICATE-----
content of PEM-File
-----END CERTIFICATE-----
quit

##!ENDS_INTERACTIVE
#END_MODE_ENABLE

[michael-bentley]

ah ok.
Yes, i already tried to put the quit to the far end

[Preston Chilcote · Accepted solution]

Since the certificate is more than one line of text, you'll need to use the <MLTCMD> tag.

This thread talks about what that would look like for both Prime and Cat Center

https://community.cisco.com/t5/network-management/cisco-prime-infrastructure-cli-templates-for-crypto-key/td-p/3781651

[michael-bentley]

Thank you Preston.

i used the following syntax

<MLTCMD>

crypto pki authenticate $TRUSTPOINTNAME

------BEGIN CERTIFICATE---------

~key information deleted for brevity~

------END CERTIFICATE--------

quit
yes
</MLTCMD>
found in the Thread you mentioned.