Cisco Catalyst SD-WAN - Manager - Enterprise CA with SCEP

[Learning101]

Hi,

I would like to automate certificate deployment for our sdwan enviroment.

There is an opition Enterprise CA with SCEP, but is this for cedge onboarding or is it only for TLS/SSL Decryption ?

Best regards

[Torbjørn]

This option is for WAN-Edge/cedge onboarding. It might be a good fit for your usecase if you can't use SUDI certificate for onboarding. 

[Learning101]

Thank you for your answer, but what are the steps.

I have my Enterprise CA with SCEP configured and it works just fine on IOS if I do enrolment.

When device connects to vbond and vmange, does vmange periodically check if there are any new device without certificate and sends it to CA ? Where are additional settings like auto-enroll , retry count, retry period and so on, there are only root cert, challenge pass and url settings. There is almost no documentation regarding this procedure. (or maybe I cannot find it...)

Best regards

[Learning101]

Hi,

for anyone who is wondering if it's possible to do automation with scep to retrieve certificates from CA, i got a definite answer that this is currently unsupported feature.

The solution for issuing and renewal of Certificates is use of APIs, we were able write python scripts to automate this procedure to certain degree.

Best regards