Field Notice: FN74166 - Expired Device Certificate Causes Cisco SD-WAN Umbrella DNS Connections to Fail - Software Upgrade Recommended

The digital certificate that is used by Cisco Catalyst SD-WAN Routers to register with Cisco Umbrella DNS expired on September 30, 2024. Cisco SD-WAN Routers with the expired certificate will fail to register with the Cisco Umbrella DNS service.

The Cisco Umbrella DNS security solution uses digital certificates during the SSL handshake to establish secure HTTPS connections for device registration. The current SSL certificate on affected Cisco SD-WAN Routers expired on September 30, 2024.

This problem affects all Cisco IOS-XE Software-based routers when they are deployed in autonomous and controller mode and are configured to use the Cisco Umbrella API keys for registration, including the following:

• Aggregation Services Routers (ASRs)
• Catalyst 8000 Routers
• Catalyst 8000v Edge
• Catalyst IR Rugged Series Routers
• CSR 1000v Cloud Services Routers
• Integrated Services Routers (ISRs)
• Integrated Services Virtual Routers (ISRVs)

Note: This issue does not affect customers who are using the Token-based authentication for the Cisco Umbrella DNS registration. This issue does not impact Cisco Umbrella Secure Internet Gateway (SIG) Tunnels.

Affected Cisco Catalyst SD-WAN devices with expired Cisco Umbrella root CA certificates cannot establish secure connections with the Cisco Umbrella DNS for device registration. Because the device is not registered with Cisco Umbrella DNS Service, user DNS requests are not redirected to the Cisco Umbrella domain server by Cisco Catalyst SD-WAN Edge devices for DNS Security policy enforcement. The DNS request from the users behind Cisco Catalyst SD-WAN Edge devices will not be dropped and will be serviced by the DNS domain server that is configured on the devices.

Note: Cisco Catalyst SD-WAN Edge devices that are configured for Cisco Umbrella DNS Security and already in operation will not be impacted until reboot. The expired certificate is used only during device registration with the Cisco Umbrella DNS service, not for individual DNS requests. Device registration occurs when the Cisco Umbrella DNS service is initially configured or when the configured device is rebooted.

Solution

Affected devices must have the affected certificate replaced with a new Umbrella root certificate that is valid until the year 2035. Customers who do not currently use Cisco Umbrella DNS, but who expect to deploy it in the future can replace the affected certificate by upgrading the Cisco Catalyst SD-WAN Router software to a release that contains the new certificate. The new certificate is installed automatically during the upgrade.

For affected devices, the following X1 certificate must be downloaded and installed. The installation method depends on the software release that is installed on the affected device.

This certificate can also be downloaded from https://letsencrypt.org/certs/isrgrootx1.pem

Complete the following installation instructions that correspond to the software release currently installed on the affected device.

Cisco Devices That Are Running Cisco IOS XE Software Release 17.5.x or Earlier in Controller Mode

1. Download the new unexpired certificate from the following website and place it on a device that has access to the affected router(s) in the SD-WAN overlay:

   https://letsencrypt.org/certs/isrgrootx1.pem

2. Enter the Linux scp command or similar mechanism to perform a secure file copy from the download device onto each affected router. For example:

   scp ./isrgrootx1.pem admin@<EdgeIP>:trustidrootx3_ca.ca

   Substitute <EdgeIP> with the IP address of the affected router.

3. Once the file copy completes, reload the router to complete the installation process.

Alternatively, the new ISRG Root X1 rooted certificate can be downloaded to Cisco vManage and copied to each affected router. It is not possible to copy the new certificate directly into the router bootflash with this method. Instead, the new certificate must be copied into a temporary directory first and then copied into the final bootflash location while logged into the router.

1. Log in to Cisco vManage and access vshell.

   vManage# vshell
   vManage:~$ pwd
   /home/admin

2. Download the new unexpired certificate from letsencrypt.org.

   wget https://letsencrypt.org/certs/isrgrootx1.pem --no-check-certificate

3. Enter the Linux scp command to perform a secure file copy from Cisco vManage into a temporary location on each affected router. For example:

   scp -P 830 isrgrootx1.pem admin@<EdgeIP>:/bootflash/sdwan/trustidrootx3_ca.ca

   Substitute <EdgeIP> with the IP address of the affected router.

4. Log in to the affected router.

5. Enter the copy CLI command to copy the new certificate from the temporary location into bootflash.

   router# copy bootflash:/sdwan/trustidrootx3_ca.ca bootflash:
        Destination filename [trustidrootx3_ca.ca]?

6. Enter the delete CLI command to remove the certificate file from the temporary location.

   router# delete bootflash:/sdwan/trustidrootx3_ca.ca

7. Reload the router to complete the certificate installation process.

Cisco Devices That Are Running Cisco IOS XE Software Release 17.6.x to 17.8.x in Controller Mode

1. Download the new unexpired certificate from the following website and place it on a device that has access to the affected router(s) in the SD-WAN overlay:

   https://letsencrypt.org/certs/isrgrootx1.pem

2. Enter the Linux scp command or similar mechanism to perform a secure file copy from the download device onto each affected router. For example:

   scp ./isrgrootx1.pem admin@<EdgeIP>:trustidrootx3_ca_092024.ca

   Substitute <EdgeIP> with the IP address of the affected router.

3. Once the file copy completes, reload the router to complete the installation process.

Alternatively, the new ISRG Root X1 rooted certificate can be downloaded to Cisco vManage and copied to each affected router. It is not possible to copy the new certificate directly into the router bootflash with this method. Instead, the new certificate must be copied into a temporary directory first and then copied into the final bootflash location while logged into the router.

1. Log in to Cisco vManage and access vshell.

   vManage# vshell
   vManage:~$ pwd
   /home/admin

2. Download the new unexpired certificate from letsencrypt.org.

   wget https://letsencrypt.org/certs/isrgrootx1.pem --no-check-certificate

3. Enter the Linux scp command to perform a secure file copy from Cisco vManage into a temporary location on each affected router. For example:

   scp -P 830 isrgrootx1.pem admin@<EdgeIP>:/bootflash/sdwan/trustidrootx3_ca_092024.ca

   Substitute <EdgeIP> with the IP address of the affected router.

4. Log in to the affected router.

5. Enter the copy CLI command to copy the new certificate from the temporary location into bootflash.

   router# copy bootflash:/sdwan/trustidrootx3_ca_092024.ca bootflash:
        Destination filename [trustidrootx3_ca_092024.ca]?

6. Enter the delete CLI command to remove the certificate file from the temporary location.

   router# delete bootflash:/sdwan/trustidrootx3_ca_092024.ca

7. Reload the router to complete the certificate installation process.

Cisco Devices That Are Running Cisco IOS XE Software Release 17.9.x to 17.12.x in Controller Mode

To automate the process follow the instructions in the document Update DNS Umbrella Certificate to Work in October 2024 or perform the following steps manually:

1. Log in to Cisco vManage.
2. Choose Administration > Settings > Umbrella DNS Certificate.
3. In the Umbrella Root Certificate window, delete the old certificate text and paste in the new certificate. Alternatively, upload the certificate from a file by choosing the Select a File option.
4. Click Save. Cisco vManage will now push the new certificate file to each affected device.
5. After the file has been pushed to each device, a copy must be created on each device to ensure that the new certificate is used for all subsequent registration requests.  
6. Log in to each affected device.
7. Use the copy CLI command to copy the file that was pushed to the new Umbrella digital certificate file by Cisco vManage, as shown in the following example:

   router# copy bootflash:umbrella_root_ca_1.ca bootflash:trustidrootx3_ca_092024.ca
   
   

Cisco Devices That Are Running Cisco IOS XE Software Release 17.13.x or later in Controller Mode

To automate the process follow the instructions in the document Update DNS Umbrella Certificate to Work in October 2024 or perform the following steps manually:

1. Log in to Cisco vManage.
2. Choose Administration > Settings.
3. Choose Cloud Credentials.
4. Choose Umbrella DNS Certificate.
5. Paste the new certificate in the edit window. Alternatively, upload the certificate from a file by choosing the Select a File option.
6. Click Save. Cisco vManage will now push the new certificate file to each affected device.
7. After the file has been pushed to each device, a copy must be created on each device to ensure that the new certificate is used for all subsequent registration requests.  
8. Log in to each affected device.
9. Use the copy CLI command to copy the file that was pushed to the new Umbrella digital certificate file by Cisco vManage, as shown in the following example:

   router# copy bootflash:umbrella_root_ca_1.ca bootflash:trustidrootx3_ca_092024.ca

Cisco Devices That Are Running Any Affected Release of Cisco IOS XE Software in Autonomous Mode

1. Download the new unexpired certificate from the following web site:

   https://letsencrypt.org/certs/isrgrootx1.pem

2. Log in to the affected device.

3. Configure a Trustpoint: If one is not already present, create a trustpoint that will be used to store the certificate.

   Router# configure terminal
   Router(config)# crypto pki trustpoint MY_TRUSTPOINT_NAME
   Router(config-trustpoint)# enrollment terminal
   Router(config-trustpoint)# revocation-check none
   Router(config-trustpoint)# exit
   Router(config)#

   Replace MY_TRUSTPOINT_NAME with the name you want to assign to your trustpoint.

4. Import the Certificate: Use the crypto pki authenticate CLI config command to import the certificate by pasting in the text from the certificate file downloaded in step 1.

   Router(config)# crypto pki authenticate MY_TRUSTPOINT_NAME
   
   Enter the base 64 encoded CA certificate.
   End with a blank line or the word "quit" on a line by itself
   [paste certificate text here]
   Certificate has the following attributes:
          Fingerprint MD5: 0CD2F9E0 DA1773E9 ED864DA5 E370E74E 
         Fingerprint SHA1: CABD2A79 A1076A31 F21D2536 35CB039D 4329A5E8 
   % Do you accept this certificate? [yes/no]: yes
   Trustpoint CA certificate accepted.
   % Certificate successfully imported 
   Router(config)#exit
   Router#