06-30-2022 02:48 PM
Hi,
I have read the Cisco documentation on HTTPS certs for Cisco IOS here
Sadly, I don't quite understand what a "TrustPoint" is, and what steps I do and do not need to take to generate a CSR to submit to our internal AD CA. It's also talking about URLs, and I'm not sure which CA URLs it is asking for.
My 9200 stack has a default trust point and self signed cert configured automatically.
Can anyone tell me which steps I need to follow in order to create a "TrustPoint" for our CA, and how to then generate a CSR?
Many thanks.
James
Solved! Go to Solution.
07-06-2022 01:46 PM
You need upgrade the IOS in normal process of upgrade, config syntax (some may change). since you moving from LITE to next version. ( 95% should work as expected).
07-07-2022 02:17 AM
Think I'm just going to try and open a support ticket with Cisco, as I find it hard to believe I need a completely different image just to be able to generate and import a bloody SSL certificate.
07-07-2022 08:48 AM
Cisco support have directed me to this post, and I have been able to generate a cert:
My issue, is as per the other commenter on that post, in that Chrome/Edge still does not trust the cert, as there is no SAN.
How do I specify a SAN during cert request?
This issue is not limited to the 9200 series, as I have the same issue with SG350X switches I have posted about here:
SG350XG SSL Certificate SAN - Cisco Community
Thanks
James
07-12-2022 08:33 AM
Cisco support have advised I needed to use OpenSSL to generate the CSR with a SAN which I have now done.
I have the cert in multiple different formats (Cer, Perm, PKCS12), so now I'm wondering if someone can advise how to just import this certificate into the switch?
Cheers
James
11-18-2022 03:11 AM
I have a resolution to this problem. Cisco support advised my issue was that the cert was missing DEK header information.
So, my process is;
1. Generate key and CSR using below command:
openssl req -newkey rsa:2048 -subj "[certificate_details]" -sha256 -keyout [key_name].key -out [csr_name].csr -config [ConfigFilePath]\openssl-san.cnf
2. Convert the key or add DEK header info using the below command:
openssl rsa -in keyin.key -out keyout.key -des3
3. Generate cert from CSR
4. Import cert to switch using below command:
crypto pki import TRUSTPOINT_NAME pem terminal password KEY_PASSWORD
5. Enter the root CA cert, key and cert text when prompted
6. Set the trustpoint as the one used for https using below command:
ip http secure-trustpoint TRUSTPOINT_NAME
Hope this helps others.
Regards
James
04-27-2023 05:50 AM
I came across your post because I am attempting to go through the same process. I think I am confused as to what the trustpoint is ? Is this the name of my root CA certificate, issuing CA or the actual DNS name of the switch ?
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide