Generating TLS Self-Signed Certification Between NDB Server and NDB Switch for NXAPI
This section describes how to generate TLS self-signed certification between NDB server and NDB Switch. You need to generate certificates and keys for each switch to enable TLS. TLS communication between NDB switch and NDB server uses port 443 only.
Complete the following steps to generate TLS self-signed certification between NDB Server and NDB Switch for NXAPI:
![]() Note |
You cannot configure a controller to communicate using port 80 after configuring TLS. |
Generating Self-Signed Certificate and Key
This section describes how to generate self-signed certificate and key.
Before you begin
conf t
ip domain-name cisco.com
hostname N9k-117
end
The FQDN for the switch is configured to N9K-117.cisco.com. Procedure
Step 1 |
Log in to the server. |
||
Step 2 |
Generate the private key and self-signed certificate using the openssl req command. Example:
|
||
Step 3 |
Log in to the NDB switch. |
||
Step 4 |
Copy the certificate file, sw1-ca.pem, and keyfile, sw1-ca.key, to the switch using the copy command. Example:
|
||
Step 5 |
Configure the certificate file, sw1-ca.pem, and keyfile, sw1-ca.key in the switch using the nxapi command. Example:
|
||
Step 6 |
Enable self-signed certificates on the switch using the nxapi certificate command. Example:
|
||
Step 7 |
Log in to the server. |
||
Step 8 |
Copy and convert the sw1-ca.key and sw1-ca.pem files to .PEM format using the copy command. Example:
|
||
Step 9 |
Concatenate the private key and the certificate file using cat command. Example:
|
||
Step 10 |
Convert the .pem file to .p12 file format using the openssl command. Enter the export password when prompted to create a password protected .p12 certificate file. Example:
|
||
Step 11 |
Convert the sw1-xnc.p12 to a password protected Java KeyStore (tlsKeyStore) file using the keytool command. Use the relative path to jre/bin in the xnc directory to run the keytool command. Example:
|
||
Step 12 |
List and verify content in the java tlsKeyStore using the keytool command. Example:
|
What to do next
Creating the TLS TrustStore File
TrustStore is created from the self-signed certificates that are generated for one or more switches. It holds certificates for one or more switches in the controller. This section describes how to create a Truststore using the self-signed certificate created in Generating self-signed certificate and key section. If you have multiple switches in the controller, each switch will have separate certificate file (For example, sw1-xnc-cert.pem, sw2-xnc-cert.pem)
Procedure
Step 1 |
Log in to the server. |
||
Step 2 |
Convert the certificate file (For example, sw1-xnc-cert.pem) to a Java TrustStore (tlsTrustStore) file using the keytool command. Enter a password when prompted to create a password protected Java TrustStore (tlsTrustStore) file. The password should be at least six characters. Example:
|
||
Step 3 |
List and verify keys for multiple switches in the same tlsTrustStore using the keytool command. Example:
|
Starting NDB with TLS
To start NDB with TLS, complete these steps:
Procedure
Step 1 |
Log in to the NDB server. |
||
Step 2 |
Stop the NDB application, if running, using the runxnc.sh command Example:
|
||
Step 3 |
Copy the tlsKeystore and tlsTruststore files that you created to configuration folder of NDB (xnc/configuration). Example:
|
||
Step 4 |
Start the NDB application with TLS using the runxnc.sh script. Example:
Example:To start NDB with default username (admin) and a non-default password (for example, pwd123):
|
Configuring TLS KeyStore and TrustStore Passwords on NDB
You need to configure TLS KeyStore and TrustStore passwords to enable NDB to read password protected TLS KeyStore and TrustStore files. To configure TLS KeyStore and TrustStore passwords on NDB, complete these steps:
Procedure
Step 1 |
Log in to the NDB server. |
||
Step 2 |
Navigate to bin directory. Example:
|
||
Step 3 |
Configure the TLS KeyStore and TrustStore passwords using the xnc config-keystore-passwords command. Example:
In case NDB is configured with AAA (Tacacs/LDAP/Radius), and if the above command, ndb config-keystore-passwords fails, and you see a 401 unauthorized error, then:
After the TLS is enabled on NDB, all the connections between NDB server and NDB switch are established using port 443. Ensure that you change device connections in NDB to use port 443. Up on successfully completing these steps, you can add nexus switch in the controller using port 443. Use FQDN of the switch to add the device to the NDB controller. You can verify the Certificate information using the WebUI Sandbox of the switch. |