Root Certificate Query

[knaik99]

if Viptela router is working and we are going to add new Viptela router then can we copy root certificate from working Viptela router or Vmanage or Vbond?

if yes,then why do so ?

I think --each Viptela router has individual root certificate

[Dan Frey]

Root chain certificates (rcc) must be the same across the entire SDWAN fabric including the control components and the routers.  If you are using the Cisco CA service then the rcc is embedded in the software, and if you are using enterprise CA the same rcc must be loaded on each device.   There is a field in network plug and play portal to load enterprise rcc so this task is automated with ZTP turn up.  Virtual devices (CAT8kv, vbond, vsmart, vmanage) can have the enterprise rcc loaded in the day0 file.

[Kanan Huseynli]

Hi,

each device, normally, has root cert chain, but if you use enterprise CA for controller and/ or router certification, then you should push this information (your enterprise root CA) to other routers (also to controllers). This can be done via PNP/ZTP and also manually with CLI command.

HTH,