Is there a need to generate a CSR on the vEdge router?

[Kenneth Goh]

Hi, I am currently using vEdge version 20.3.1. I managed to onboard vEdge to vManage and did not create CSR on vEdge.

As shown in the steos below I successfully onboarded vEdge to vManage. I would like to confirm if there is a need to generate CSR on vEdge and have it signed by Root CA Server?

1) Configure the system parameters on vEdge, including:- configuring tunnel-interface & encapsulation ipsec

2) Download the Root Certificate onto vEdge

3) Install/Trust root CA certificate on vEdge:

vEdge# request root-cert-chain install /home/admin/CA.crt

4) Register vEdge to vManage, on vManage under Configuration -> Devices -> All Edge List -> Generate Bootstrap Configuration

5) Activate vEdge with:

vEdge# request vedge-cloud activate chassis-number 158c7134-18db-6625-5726-2e88d0ecb90f token 4fbe5e5df0ab435baa5abc9b09187808

[M02@rt37]

Hello @Kenneth Goh,

While generating a CSR and having it signed by a Root CA can add an extra layer of security, the approach you've followed is valid for basic onboarding and connectivity to vManage.

[Kenneth Goh]

Hi, is there a way to verify that the vEdge has it's CSR signed by the Root CA Server? As since it was already successfully onboarded to vMansge.

[Kanan Huseynli · Accepted solution]

Hi,

based on commands, you onboarded vedge-cloud. Certificate depends on settings in vmanage. Most probably you have vmanage-signed CA option and vmanage automatically generated CSR for the router and signed with internal CA of vmanage.

This is not signed by enterprise CA. For this, you need manually generate CSR sign and import certificate to device.

Go to Settings > Administration> Check for the option "WAN Edge Cloud Certificate Authorization". If it is "automated" , then it is vmanage based CA and it signs certificates.

[Kenneth Goh]

Yes is automated!