SSL certificate for Meraki Dashboard API

[Yuriy P.]

Hi Community,

Is it possible to configure and use some custom or non-default SSL certificate for Meraki Dashboard API?

What is default certificate revocation policy, can it be changed per organization?

Thanks in advance,

Yuriy

[RomanMD · Accepted solution]

I don't really understand the question but if I'll answer it as I understand then - No!

Meraki API backend is managed by Cisco and Cisco controls the certificate. There are no security reasons why one would want to use a custom certificate!

Can you provide more context around the question?

[Yuriy P.]

Thanks for answer!

In short we have the tool which utilize Meraki API and is configured to perform online revocation check.

For some users it works and for others it fails with error during revocation check. Here is what we have in request header:

• Chain.Status: RevocationStatusUnknown,OfflineRevocation

Maybe it is something on Windows policies configuration side, not sure.

[Philip D'Ath]

For the case that fails see which CA is being used (check the issuer field). The CA certificate will already be installed on your device as a trusted root CA.

Then get CRL field out of the CA certificate from your machine, and then try and request that URL directly to see what happens.

It sounds like the retrieval process is experiencing errors.

[Yuriy P.]

Thank you, I'll dig in that direction then!

[Philip D'Ath]

+1 to @RomanMD . If you were worried about a man-in-the-middle attack or something (maybe a firewall doing SSL inspection), you could check the certificate issuer and CN are who you expect it to be.