cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
694
Views
0
Helpful
2
Replies
Highlighted
Beginner

Adding an internal Proxy CA certificate to Prime

Hi

 

I need to configure an internal Proxy to allow direct access to Cisco to download Prime updates and appliance software Images.

 

To do this I need to import the CA Certificate that is used to sign the certificate presented by our internal Proxy.

 

How do I import the CA Certificate and to which store should the CA Cert be added?

 

Thanks in advance.

2 REPLIES 2
Highlighted
VIP Advocate

 

 Ref : https://www.cisco.com/c/en/us/td/docs/net_mgmt/prime/infrastructure/3-4/admin/guide/bk_CiscoPrimeInfastructure_3_4_AdminGuide/bk_CiscoPrimeInfastructure_3_4_AdminGuide_chapter_011.html#task_1171135

 I don't think Prime supports this functionality ; checkout the the menu-options in the link referenced and verify what is possible.

 M.

Highlighted

Hi

I have configured the Proxy on Prime and the 'Test Connectivity' is successful.

Capture.PNG

 

But when I try the 'download' option under Administration > Software Updates and enter my CCO credentials I get the following error

image.png

 

My firewall/proxy support has captured the issue and has told me it is a certificate issue - the Proxy certificate is not trusted by Prime. So we believe that it is because the Proxy's signing root CA cert is not installed in the correct Prime certificate store.

There are 4 possible stores:

<hostname>/admin# ncs certvalidation trusted-ca listcacerts truststore ?
   devicemgmt Trust store used for validating cert from managed devices
   pubnet     Trust store used for validating cert from public internet
   system     Trust store used for validating cert from other peer systems
   user       Trust store used for validating cert for user login

 

I am assuming that the CA cert should go in either system or pubnet but either requires a reboot.
Should I just import to both?

 

Content for Community-Ad