Info : FN - 72290 - Cisco IOS XR: QuoVadis Root CA 2 Decommission

marce1000 · ‎03-23-2022

- FYI : https://www.cisco.com/c/en/us/support/docs/field-notices/722/fn72290.html

M.

-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? '
When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '

RoadRunner4k · ‎03-24-2022

I am trying to follow step three in this FN Workaround. Option 3. File-Based Download

Have downloaded the ios.p7b file to the harddisk of my NCS but i cant seem to import it. Does it have to be done from /tmp?

RP/0/RP0/CPU0:NCS_A01#crypto ca trustpool import url harddisk:ios.p7b
Thu Mar 24 08:50:28.496 CET

Cannot download certificates from CA server -
incorrect URL HTTP/TFTP/LOCAL specified

marce1000 · ‎03-24-2022

- Note that 'url' needs to be expanded to the exact source location of the certificate being either http or tftp based url

M.

-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? '
When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '

RoadRunner4k · ‎03-28-2022

I have tried to import it from the harddisk. As i dont have the option to use tftp.

crypto ca trustpool import url harddisk:/ios.p7b

Cannot download certificates from CA server -
incorrect URL HTTP/TFTP/LOCAL specified

marce1000 · ‎03-29-2022

- On what platform(model) are you trying this ?

M.

-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? '
When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '

RoadRunner4k · ‎03-29-2022

NCS-55A1-24Q6H-SS on IOS XR 7.3.2

marce1000 · ‎03-29-2022

- Could you try with : crypto ca trustpool import url /ios.p7b or else try crypto ca trustpool import url hardisk://ios.p7b

M.

-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? '
When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '

RoadRunner4k · ‎03-29-2022

That also fails

RP/0/RP0/CPU0:NCS_A#dir harddisk:
Tue Mar 29 14:03:03.316 CEST

Directory of harddisk:
16 -rwx------. 1 117245 Mar 24 11:53 ios.p7b

RP/0/RP0/CPU0:NCS_A# crypto ca trustpool import url /ios.p7b
Tue Mar 29 14:03:56.196 CEST

Cannot download certificates from CA server -
incorrect URL HTTP/TFTP/LOCAL specified
RP/0/RP0/CPU0:NCS_A#crypto ca trustpool import url harddisk://ios.p7b
Tue Mar 29 14:04:31.282 CEST

Cannot download certificates from CA server -
incorrect URL HTTP/TFTP/LOCAL specified

%SECURITY-PKI-6-ERR_1_PARAM : Failed to import ca certificate.

marce1000 · ‎03-29-2022

- Perhaps : crypto ca trustpool import url file://ios.p7b or try crypto ca trustpool import url file://hardisk/ios.p7b , if that does not work , try by substituting 'file' with 'local'

M.

-- Each morning when I wake up and look into the mirror I always say ' Why am I so brilliant ? '
When the mirror will then always repond to me with ' The only thing that exceeds your brilliance is your beauty! '

RoadRunner4k · ‎03-29-2022

This worked thanks for the help marce1000

RP/0/RP0/CPU0:NCS_A#crypto ca trustpool import url /tmp/ios.p7b
Tue Mar 29 14:35:54.776 CEST