Cisco Edge 340 Series Software Configuration Guide, Release 1.2

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Book Contents
Find Matches in This Book

Results

Updated:
August 18, 2016

Chapter: Importing the SHA2 Certificate

Importing the SHA2 Certificate

This appendix describes importing the SHA2 certificate to the Cisco Edge 340 Series. The details of creating, getting, or generating the certificate are not provided in this document.

There are two ways to import the SHA2 certificate in CE340:

Certificate API

The Cisco Edge 340 Series support certificate generated from Non-SCEP server as well.

Certificate API user should have key file of certificate with it.

Note Make sure to provide hostname of CE340 in Common Name Field while creating or getting certificate.

Following are the steps to insert certificate using Certificate API:

Step 1 To generate the Key and CSR from the CE340 CLI:

i. # openssl genrsa -out key_name.key 2048

Example

 

ii. # openssl req -out sha256.csr -key key_name.key -new -sha256

Example

 

Step 2 Generate the certificate from the CA server using CE340 CSR.

Step 3 To load the certificate from the local storage, use the following command:

# curl -k -X PUT -u root:aDMIN123# https://127.0.0.1/api/v3/import/certificate/nginx --form key=@<path to certificate key file> --form crt=@<path to crt file>

Example

curl -k -X PUT -u root:aDMIN123# https://127.0.0.1/api/v3/import/certificate/nginx --form key=@/home/tmp/server.key --form crt=@/home/tmp/server.crt
 

Upon success the # prompt will be shown on the screen after the above command is executed.

Upon failure the generic failure message will be shown on the screen and then the # prompt will be shown.

Step 4 To load the certificate from a remote server, use the following command:

# curl -k -X PUT -u root:aDMIN123# https://127.0.0.1/api/v3/import/certificate/nginx --form key=<link location of remote server key file> --form crt=<link location of remote server crt file>

Example

curl -k -X PUT -u root:aDMIN123# https://127.0.0.1/api/v3/import/certificate/nginx --form key=http://10.107.3.155:8080/server.key --form crt=http://10.107.3.155:8080/server.crt
 

Upon success the # prompt will be shown on the screen after the above command is executed.

Upon failure the generic failure message will be shown on the screen and then the # prompt will be shown.

Step 5 To verify that the newly loaded certificate is inserted, use the follow the command:

# curl -k -X GET -u root:aDMIN123# https://127.0.0.1/api/v3/import/certificate/nginx
 

This command will display the newly inserted certificate. Upon success the # prompt will be shown on the screen after the above command is executed.

Step 6 After loading the new certificate, restart the nginx server by executing the following command:

# service nginx restart
 

Step 7 Check the certificate in GUI as following:

 

SCEP API

Follow these steps to get certificate from the NDES server:

Step 1 Upgrade or reimage the device with the new 1.2.0.19 patch.

Step 2 Connect to the CE340 via SSH.

Step 3 Create a file named as api.txt by using the text editor present in CE340.

Following is a sample file. Please change the values in bold and italic according to your requirement.

Note Make sure to provide hostname of CE340 in Common Name Field while creating or getting certificate.

{
"module": "http",
"managed": "true",
"url": "http://<SCEP-Server-ip>/CertSrv/mscep/mscep.dll",
"challenge_password": "<SamplePassword>",
"params": {
"keysize": 2048,
"subject": "/C=<country-name>/ST=<state-name>/O=<organization-name>/CN=<device-hostname>/emailAddress=email@yourcompnay.domain"
}
}
 

Step 4 Execute the following command at the same location where api.txt was created to configure the SCEP server information:

# curl -X PUT -u root:aDMIN123# -H "Content-Type:application/json" -d @api.txt http://127.0.0.1/api/v3/system/scep
 

Upon success the # prompt will be shown on the screen after the above command is executed.

Upon failure the generic failure message will be shown on the screen and then the # prompt will be shown.

Step 5 Verify that the certificate request file and private key are generated:

# openssl req -in /usr/local/share/cpgmgt-service/scep/keystore/http/csr/server.csr -noout – text

 

Step 6 Call get_ca:

# curl -X PUT -u root:aDMIN123# -H "Content-Type:application/json" -d '{"method":"getca","module":"http"}' http://127.0.0.1/api/v3/system/scep/command
 

Upon success the # prompt will be shown on the screen after the above command is executed.

Upon failure the generic failure message will be shown on the screen and then the # prompt will be shown.

Step 7 Call enroll:

# curl -X PUT -u root:aDMIN123# -H "Content-Type:application/json" -d '{"method":"enroll","module":"http"}' http://127.0.0.1/api/v3/system/scep/command
 

Upon success the # prompt will be shown on the screen after the above command is executed.

Upon failure the generic failure message will be shown on the screen and then the # prompt will be shown.

Step 8 Make sure the certificate is generated and saved locally on CE340:

# ls /usr/local/share/cpgmgt-service/scep/keystore/http/cert server.crt
 

Step 9 Make sure that relevant or valid details are present in the certificate:

# openssl x509 -in /usr/local/share/cpgmgtservice/scep/keystore/http/cert/server.crt –text

 

Step 10 Restart the nginx server or reboot the device. This step will insert the SCEP certificate in CE340.

 

Step 11 Check the certificate in GUI as well as in NDES server to ensure that the correct certificate is inserted.

 

 

Was this Document Helpful?

FeedbackFeedback

Contact Cisco