Our Cisco 3850's are running 16.6.2.
We are having immense difficulty installing certs into our switches.
We have been following this document: https://www.cisco.com/c/en/us/support/docs/interfaces-modules/catalyst-6500-series-ssl-services-module/63456-sslm-csr.html suggested from Cisco TAC.
This is our process:
1. Generate Key:
crypto key generate rsa exportable label KEY1 modulus 2048
2. Create Trustpoint
crypto pki trustpoint CA1
enrollment terminal pem
subject-name C=x, ST=x, L=x, O=x, CN=hostname, serialNumber=x
fqdn x
rsakeypair KEY1
exit
3. Create CSR (And Submit request)
crypto pki enroll CA1
y
n
y
4. Create second trustpoint for ROOT Cert (Per the configuration guide above:)
(If you have an intermediate certificate, you need to configure two trustpoints. One trustpoint contains the CA root certificate only. You only need to configure enrollment terminal PEM and Certificate Revocation List (CRL) optional. The second trustpoint contains the intermediate certificate and the server certificate. The second trustpoint is configured similar to the first trustpoint, however, instead of the root certificate, use the intermediate certificate.)
!
crypto pki trustpoint ROOT
enrollment terminal pem
exit
crypto pki authenticate ROOT
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
y
5. Add intermediate and public cert
This is where the problems begin. The document above has told us to create two trustpoints, and so now we are going to try to add the intermediate cert:
crypto pki authenticate CA1
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
Trustpoint 'CA1' is a subordinate CA.
Authentication failed - could not validate certificate
% Error in saving certificate: status = FAIL
However if I were to paste in the public cert we got back from the CA at this point, it would accept the CERT. But then I am now without the intermediate, and my https is still saying the switch is using a self-signed certificate. (I am using command: ip https secure-trustpoint CA1)
Help!
