Customer Success - Guided resource

Cisco Catalyst SD-WAN: Getting started guide

This guide walks you through the core steps required to get your network up and running, from initial onboarding to operational best practices.

  • Networking
  • Catalyst SD-WAN
  • Guide

Controller deployment and security trust

Establish PKI trust, install root certificates, and activate controller mutual authentication

Install Enterprise or Cisco PKI Certificate Authority (CA) across all controller nodes, establish mutual DTLS/TLS trust, and configure Smart Licensing Using Policy (SLP) token registration.

Content summarized by AI

To help you get started with your task, content across Cisco recommended sources has been summarized by AI

Information:  Summary is generated by AI and may not be validated by a subject matter expert.  Before using results, verify accuracy and completeness via the sources links below.

Summarized on September 30, 2026

Before controller nodes can participate in the Cisco Catalyst SD-WAN overlay, each must have both a root Certificate  Authority (CA) certificate and a signed device certificate installed. [1] Root certificates come pre-installed for Cisco PKI deployments, but for Enterprise CA deployments, the administrator must first upload the full root CA chain to SD-WAN Manager, which then automatically distributes it to all other control components (SD-WAN Validator and SD-WAN Controller). WAN Edge routers must also have the appropriate root certificate installed — either the Cisco PKI root or the Enterprise root — before they can authenticate to control components; this can be done manually, through automated provisioning (PnP), or via SD-WAN Manager distribution.

There are three supported methods for signing and installing control component certificates:

  1. Automated Cisco PKI (recommended): SD-WAN Manager generates a CSR for each control component and automatically submits it to the Cisco PKI server; the signed certificate is retrieved and installed without manual intervention. Smart Account credentials and DNS resolution to Cisco cloud servers on TCP 443 are required.
  2. Manual Cisco PKI: The administrator generates CSRs from SD-WAN Manager, manually submits each to the Cisco PnP Connect portal's Certificates tab, downloads the signed certificates, and uploads them back to SD-WAN Manager for installation.
  3. Enterprise Root CA: The administrator installs the full root CA chain in SD-WAN Manager first, then generates CSRs, submits them to the Enterprise CA for signing, and uploads the resulting certificates to SD-WAN Manager.

Once certificates are installed, mutual DTLS/TLS trust is established between all control components. [1] The WAN Edge Authorized Serial Number file must also be loaded into SD-WAN Manager — either by manually downloading it from the PnP Connect portal and uploading it, or by using the Sync Smart Account option — and then distributed to all control components via the Send to Controllers action. For Smart Licensing Using Policy (SLP) token registration, Smart Account credentials are configured in SD-WAN Manager under Administration > Settings > Smart Account Credentials, which also enables the automated certificate signing workflow. [2]

Sources

  1. Design Zone for Branch/WAN - Cisco Catalyst SD-WAN Control Components Certificates and Authorized Serial Number File Prescriptive Deployment Guide
  2. Cisco Catalyst SD-WAN Getting Started Guide - Certificate Management [Cisco SD-WAN]
Copy
Helpful
Unhelpful
Previous Next