Cisco SD WAN : Web Server Certificate

[RS19]

In my environment, Cisco SD-WAN Web server certficate is expiring. 

What is the impact if is expires ? What will happen if I dont renew it.

[balaji.bandi]

If you using same PKI - generate new cert and install on vManage.

https://www.cisco.com/c/en/us/support/docs/wan/dpt/220426-sd-wan-controllers-certificate-renewal-v.html

[RS19]

Sorry Still unclear.

At present when I access the vManage, the certificate error is shown and then I can access it if I accept it and proceeed further.

So after the certificate expires will I be able to continue as same or will i be not able to access the vManage.

[RS19]

Any help ?

[Kanan Huseynli]

Below is the guide about web-server certificate:

https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/217426-understand-the-web-certificate-for-vmana.html

The process is simple as in normal web sites. You generate certificate signing request for web server and provide file to CA owner. CA signs certificate and provides to you final actual certificate (Note: CA root certificate should in trusted be root CA list).

If you don't have relation to any CA, you my just generate self-signed CA

https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/215103-how-to-generate-self-signed-web-certific.html 

Answer to your last question: if web-server certification, technically nothing special happens. You can still access to vManage GUI.

[RS19]

I was testing this in the  Cisco Sand box.
I got the attached error. Any idea what is this  & how to resolve this ?

[RS19]

Any help or inputs ?

[RS19]

In the link which you have shared, under the problem heading, it says access to Graphical User Access to the Graphical User Interface (GUI) can be lost . 

I am still having concern that if certificate is expired, will the vManage will be still accessible or not ?

[Kanan Huseynli]

Hello,

recently in production, our vmanage cert has expired and we could access. Basically, it simple shows an error message that "certificate is not secure" (well-known browser page when you have problem with certificate).

Regarding openssl, I'm not sure at which level access is granted for sandbox user. You can do respective steps (create CA) on your linux machine or windows on linux.

[RS19]

I tried the same in my production. Getting the attached error message. Any idea what is this ?

PEM routines:get_header_and_data:bad end line:crypto/pem/pem_lib.c:841

[Kanan Huseynli]

What did you do and where do you see this error? Screen picture please