Field Notice: FN74135 - Cisco SUDI Certificate Expires When Registered to a PKI and Used to Configure Certain Functionalities on Catalyst 9000 Platforms - Workaround Provided

A Cisco Secure Unique Device Identifier (SUDI) certificate that is registered to a public key infrastructure (PKI) and that is also used to configure certain functionalities will expire on a limited number of Cisco Catalyst 9000 Switching Family products (for more information on affected products, see the Products Affected section of this Field Notice). Any service that relies on a SUDI certificate to establish a secure connection might not work after the certificate expires.

SUDI is an X.509v3 certificate that maintains the product identifier and serial number. The identity is implemented at manufacturing and is linked to a publicly identifiable root certificate authority (CA). The SUDI can be used as an immutable identity for configuration, security, auditing, and management. 

The Cisco SUDI certificate, when registered to a PKI and used to configure certain functionalities on Cisco IOS XE Software, will expire on a limited number of Catalyst 9000 Switching products. Refer to the How to Identify Affected Products and Serial Number Validation sections of this Field Notice to identify affected devices. 

To determine if a SUDI trust point is used, enter the following command:

Switch# show run |  CISCO_IDEVID_SUDI 

If there is no output, no impact is expected and no further action is required.

Customers can check the expiration date of the SUDI certificate on their device using the show crypto pki certificates command.

The SUDI expiration date is bolded in the sample output below:

Switch#show crypto pki certificates
Certificate

  Status: Available

  Certificate Serial Number (hex): 0380EC27

  Certificate Usage: General Purpose

  Issuer:

    cn=ACT2 SUDI CA

    o=Cisco

  Subject:

    Name: C9200-24T

    Serial Number: PID:C9200-24T SN:XXXXXXXXXXX

    cn=C9200-24T

    ou=ACT-2 Lite SUDI

    o=Cisco

    serialNumber=PID:C9200-24T SN:XXXXXXXXXXX

  Validity Date:

    start date: 08:37:26 UTC Feb 12 2019

    end   date: 20:25:41 UTC May 14 2029 

  Associated Trustpoints: CISCO_IDEVID_SUDI 

Various features that might be linked to the SUDI certificate are shown in the following sample configurations:

HTTPS

ip http secure-trustpoint CISCO_IDEVID_SUDI

ip http client secure-trustpoint CISCO_IDEVID_SUDI

SSH authentication that uses certificates

ip ssh server certificate

   profile server

      trustpoint sign CISCO_IDEVID_SUDI

Zero Touch Deployment (ZTD) that uses a certificate enrollment profile for enrollment or reenrollment

crypto pki profile enrollment profile-name

   credential CISCO_IDEVID_SUDI

Any services that rely on a trustpoint that is configured with an expired Cisco SUDI certificate will be affected. Some examples are as follows:

• HTTP server over TLS (HTTPS) - HTTPS will produce an error in the browser that indicates that the certificate is expired.
• SSH server - Applications that use SUDI certificates to authenticate the SSH session might fail to authenticate.

Note: This use of SUDI certificates is rare. Username and password authentication and non-SUDI public or private key authentication are not affected.

Customers should refer to the information below to apply the recommended action for their device.

For suggestions related to software upgrade , please evaluate your network deployment before upgrading the devices.

Catalyst 9200

All units have a SUDI expiration in 2099; however, due to defect CSCwf94778, the device may show an earlier SUDI expiration date.

Recommended Action: Upgrade to fixed versions 17.12.2/17.9.5/17.13.1 and later or apply the workarounds described below.

Note: The Serial Number Validation Tool/Link is not applicable for this product family.

Catalyst 9300

All units that show as Affected in the Serial Number Validation Tool have a SUDI expiration of Date of Manufacturing + 10 years or 2029, whichever is earlier.

Recommended Action: Refer to the workarounds described below.

All units that show as Not Affected in the Serial Number Validation Tool have a SUDI expiry of 2099; however, due to defect CSCwd82114, units may show an earlier SUDI expiration date.

Recommended Action: Upgrade to fixed versions 17.12.1/17.9.5/17.13.1 and later or apply the workarounds described below.

Catalyst 9400

All units that show as Affected in the Serial Number Validation Tool have a SUDI expiration of Date of Manufacturing + 10 years or 2029, whichever is earlier.

Recommended Action: Refer to the workarounds described below.

All units that show as Not Affected in the Serial Number Validation Tool have a SUDI expiration of 2099; however, due to defect CSCwd82114, units may show an earlier SUDI expiration date.

Recommended Action: Upgrade to fixed versions 17.12.1/17.9.5/17.13.1 and later or apply the workarounds described below.

Catalyst 9500 - C9500-16X, C9500-40X, C9500-12Q, C9500-24Q

All units that show as Affected in the Serial Number Validation Tool have a SUDI expiration of Date of Manufacturing + 10 years or 2029 or 2037, whichever is earlier.

Recommended Action: Refer to the workarounds described below.

All units that show as Not Affected in the Serial Number Validation Tool have a SUDI expiration of 2099; however, due to defect CSCwd82114, units may show an earlier SUDI expiration date.

Recommended Action: Upgrade to fixed versions 17.12.1/17.9.5/17.13.1 and later or apply the workarounds described below.

Catalyst 9500 - C9500-32C, C9500-32QC, C9500-48Y4C, C9500-24Y4C

All units have a SUDI expiration of 2099; however, due to defect CSCwd82114, devices may show an earlier SUDI expiration date.

Recommended Action: Upgrade to fixed versions 17.12.1/17.9.5/17.13.1 and later or apply the workarounds described below.

Note: The Serial Number Validation Tool/Link is not applicable for this product family.

Catalyst 9600/9600X

All units have a SUDI expiration of 2099; however, due to defect CSCwd82114, devices may show an earlier SUDI expiration date.

Recommended Action: Upgrade to fixed versions 17.12.1/17.9.5/17.13.1 and later or apply the workarounds described below.

Note: The Serial Number Validation Tool/Link is not applicable for this product family.

Workarounds

Customers should use one of the following three workaround methods to install an alternate certificate:

• Install a certificate from a CA.
• Use the local Cisco IOS CA server to generate and sign a new certificate.
• Use the Simple Certificate Enrollment Protocol (SCEP) to acquire a certificate from the customer's PKI.

Notes:

• Introduction of a new certificate on a device might require import of the issuer's certificate on any peer devices where the new certificate is used to protect communication.
• After a new non-SUDI certificate is obtained, the configuration of any feature that is identified in the Background section of this Field Notice must be updated. The trust point configuration commands must be reconfigured to be able to use the new certificate.

For more information on each workaround option, see below.

Install a Certificate from a CA

In this workaround, a certificate request is generated and displayed by Cisco IOS XE Software. The administrator then copies the request and submits it to a third-party CA and retrieves the result.

Note: Use of a CA to sign certificates is a security best practice. This procedure is provided as a workaround in this field notice. However, Cisco recommends continuing to use the third-party CA-signed certificate after you apply this workaround rather than using a self-signed certificate.

To install a certificate from a third-party CA, complete the following steps:

1. Create a certificate signing request (CSR) using the following CLI input:

   Switch#conf t
   Enter configuration commands, one per line. End with CNTL/Z.
   Switch(config)# crypto pki trustpoint TEST
   Switch(ca-trustpoint)# enrollment term pem
   Switch(ca-trustpoint)# subject-name CN=TEST
   Switch(ca-trustpoint)# revocation-check none
   Switch(ca-trustpoint)# rsakeypair TEST
   Switch(ca-trustpoint)# exit
   Switch(config)# crypto pki enroll TEST
   % Start certificate enrollment ..
   % The subject name in the certificate will include: CN=TEST
   % The subject name in the certificate will include: Switch.cisco.com
   % The serial number in the certificate will be: <serial no>
   % Include an IP address in the subject name? [no]: no
   >Display Certificate Request to terminal? [yes/no]: yes
   Certificate Request follows:
     -----BEGIN CERTIFICATE REQUEST-----
   A Base64 Certificate is displayed here. Copy it, along with the ---BEGIN and ---END lines.
   -----END CERTIFICATE REQUEST-----
   ---End - This line not part of the certificate request---

2. Submit the CSR to the third-party CA.
   Note: The procedure to submit the CSR to a third-party CA and retrieve the resulting certificate varies based on the CA that is used. Consult the documentation of your CA for instructions on how to perform this step.
3. Download the new identity certificate for the switch along with the CA certificate.
4. Install the CA certificate on the device using the following CLI input:

   Switch# conf t
   Enter configuration commands, one per line.  End with CNTL/Z.
   Switch(config)# crypto pki auth TEST
   Enter the base 64 encoded CA certificate.
   End with a blank line or the word "quit" on a line by itself
   -----BEGIN CERTIFICATE-----
   REMOVED
   -----END CERTIFICATE-----
   Certificate has the following attributes:
      Fingerprint MD5: 79D15A9F C7EB4882 83AC50AC 7B0FC625
      Fingerprint SHA1: 0A80CC2C 9C779D20 9071E790 B82421DE B47E9006
   % Do you accept this certificate? [yes/no]: yes
   Trustpoint CA certificate accepted.
   % Certificate successfully imported
   Install the identity certificate on the device.
   Switch(config)# crypto pki import TEST certificate
       Enter the base 64 encoded certificate.
   End with a blank line or the word "quit" on a line by itself
     -----BEGIN CERTIFICATE-----
   REMOVED
   -----END CERTIFICATE-----
   % Switch Certificate successfully imported

Use the Local Cisco IOS CA server to Generate and Sign a New Certificate

To use the local Cisco IOS CA server to generate and sign a new certificate, use the following CLI input.

Note: The local CA server feature is not available on all products. 

Switch# conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)# ip http server
Switch(config)# crypto pki server IOS-CA
Switch(cs-server)# grant auto
Switch(cs-server)# database level complete
Switch(cs-server)# no shut
%Some server settings cannot be changed after CA certificate generation.
% Please enter a passphrase to protect the private key
% or type Return to exit
Password: <password>
Re-enter password: <password>
% Generating 1024 bit RSA keys, keys will be non-exportable...
[OK] (elapsed time was 1 seconds)
% Certificate Server enabled.
Switch# show crypto pki server IOS-CA Certificates
Serial Issued date Expire date Subject Name
1 21:31:40 EST Jan 1 2020 21:31:40 EST Dec 31 2022 cn=IOS-CA
Switch# conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)# crypto pki trustpoint TEST
Switch(ca-trustpoint)# enrollment url http://<local interface ip>:80
   # Replace <local interface ip> with the IP address of an interface on the switch
Switch(ca-trustpoint)# subject-name CN=TEST
Switch(ca-trustpoint)# revocation-check none
Switch(ca-trustpoint)# rsakeypair TEST
Switch(ca-trustpoint)# exit
Switch# conf t
Enter configuration commands, one per line.  End with CNTL/Z.
Switch(config)# crypto pki auth TEST
Certificate has the following attributes:
Fingerprint MD5: C281D9A0 337659CB D1B03AA6 11BD6E40
Fingerprint SHA1: 1779C425 3DCEE86D 2B11C880 D92361D6 8E2B71FF
% Do you accept this certificate? [yes/no]: yes
Trustpoint CA certificate accepted.
Switch(config)# crypto pki enroll TEST
%
% Start certificate enrollment ..
% Create a challenge password. You will need to verbally provide this
password to the CA Administrator in order to revoke your certificate.
For security reasons your password will not be saved in the configuration.
Please make a note of it.
Password: <password>
Re-enter password: <password>
% The subject name in the certificate will include: CN=TEST
% The subject name in the certificate will include: Switch.cisco.com
% Include the switch serial number in the subject name? [yes/no]: yes
% The serial number in the certificate will be: <serial no>
% Include an IP address in the subject name? [no]: no
Request certificate from CA? [yes/no]: yes
% Certificate request sent to Certificate Authority
% The 'show crypto pki certificate verbose TEST' command will show the fingerprint.

Use SCEP to Acquire a Certificate from the Customer's PKI

This use case is typical for utility customers. To set up the device to acquire a certificate from the customer's PKI, use the following steps:

1. Create a new trustpoint Locally Significant Device Identifier (LDevID) using the following CLI input:

   crypto pki trustpoint LDevID
    enrollment retry count 10
    enrollment retry period 2
    enrollment profile LDevID
    serial-number none
    fqdn none
    ip-address none
    password
    fingerprint 3F520C4C0F3236C9CA3D5C209C9948EC
    subject-name serialNumber=PID:<product id> SN:<serial no>,CN=<serial no>
    revocation-check none
    rsakeypair LDevID 2048

2. Create an enrollment profile for the new trustpoint LDevID using the following CLI input:

   crypto pki profile enrollment LDevID
   enrollment url  http://192.168.0.254:80  < This is the RA or CA IP address and the port number.

3. Authenticate the trustpoint using the followig CLI input:

   conf t
   crypto pki authenticate LDevID

4. Enroll the trustpoint using the following CLI input:

   conf t
   crypto pki enroll LDevID

5. Use the new LDevID certificate instead of SUDI for configurations and applications.

To determine if a product may be affected, refer to the Serial Number Validation section of this Field Notice.

If the product is listed as Affected or Not Affected, refer to the Workaround/Solution section of this Field Notice for more details on the recommended action for the product.

Note: Serial Number Validation is not applicable for Catalyst 9200/Catalyst 9500 (Selected Products) and Catalyst 9600. Refer to the Workaround/Solution section for more details.