Cisco APIC Security Configuration Guide, Release 6.2(x)

Configure a custom certificate for Cisco ACI HTTPS access by using the GUI

Updated: April 17, 2026

Want to summarize with AI?

Configure a custom certificate to secure HTTPS access to the Cisco APIC cluster and fabric switches. Perform this procedure during a maintenance window because the NGINX web servers restart.

Before you begin

Identify the certificate authority (CA) that will sign the certificate, and obtain the intermediate and root CA certificates.

Caution

Perform this procedure only during a maintenance window. The procedure can cause temporary management-access downtime.

The NGINX web servers on the Cisco Application Policy Infrastructure Controller ( APIC ) cluster and fabric switches restart during this procedure. The restart temporarily affects external access for configuration, management, and troubleshooting. It does not affect Cisco APIC -to-switch connectivity or the fabric data plane.

Procedure

On the menu bar, choose Admin > AAA .
In the Navigation pane, choose Security .
In the Work pane, choose Certificate Authorities > Actions > Create Certificate Authority .
In the Create Certificate Authority dialog box, enter a name in the Name field.
In the Description field, enter a description of the certificate authority.
In the Certificate Chain field, paste the intermediate and root certificates for the CA that will sign the certificate signing request (CSR).
The certificates must be Base64-encoded X.509 certificates in CER format. Place the intermediate certificate before the root CA certificate, as shown in the following example:
```
-----BEGIN CERTIFICATE-----
<intermediate-certificate>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<root-CA-certificate>
-----END CERTIFICATE-----
```
Click Save .
In the Work pane, choose Key Rings > Actions > Create Key Ring .
Key rings manage the following items:
- Private keys that are imported from an external system or generated on the Cisco APIC .
- CSRs that are generated from the private keys.
- Certificates that are issued from the CSRs.
In the Create Key Ring dialog box, enter a name in the Name field.
In the Description field, enter a description of the key ring.
In the Certificate Authority field, click Select Certificate Authority and choose the certificate authority that you created.

To create another certificate authority, click Create Certificate Authority .
In the Private Key field, choose Generate New Key or Import Existing Key .
If you chose Import Existing Key , enter the private key in the Private Key field.
If you chose Generate New Key , choose a Key Type .
The available key types are:
- RSA —Rivest-Shamir-Adleman.
- ECC —Elliptic curve cryptography, which uses the Elliptic Curve Digital Signature Algorithm (ECDSA).
Configure the Certificate field.
1. To generate a CSR from the key ring, leave the Certificate field empty.
2. If you generated the private key and CSR outside the Cisco APIC and already have the signed certificate, paste the certificate into the Certificate field.
If you chose Generate New Key , select the key strength.
1. For an RSA key, choose a value from the Modulus drop-down list.
2. For an ECC key, choose a curve from the ECC Curve options.
In the Create Key Ring dialog box, click Save .
In the Work pane, choose Key Rings > key-ring-name , and expand the key ring.

If you did not import both a signed certificate and a private key, the Admin State is Started while the key ring waits for a CSR to be generated and signed.

If you imported both the signed certificate and the private key, the Admin State is Completed .

Warning

Do not delete the key ring. Deleting the key ring also deletes the associated private key.
If you did not import a signed certificate, click Create Certificate Request in the Certificate Request pane.

The Request Certificate dialog box opens.
1. In the Subject field, enter the common name (CN) for the CSR.
  
  You can use a wildcard fully qualified domain name (FQDN) for the Cisco APIC cluster. For a modern certificate, use an identifiable certificate name in this field and enter the FQDN for each Cisco APIC in the Alternate Subject Name field. Many modern browsers require the FQDN in the Subject Alternative Name (SAN).
2. In the Alternate Subject Name field, enter the FQDN for each Cisco APIC .
  To use an IPv4 address as a SAN, enter the address in the following format:
```
IP:192.168.2.1
```
  You can enter DNS names, IPv4 addresses, or both. IPv6 addresses are not supported.
3. In the Locality field, enter the city or town where the organization is located.
4. In the State field, enter the state where the organization is located.
5. In the Country field, enter the two-letter ISO country code.
6. In the Organization Name and Organization Unit Name fields, enter the organization and organizational unit names.
7. In the Email field, enter the email address of the organization contact.
8. Enter a password in the Password field, and enter it again in the Confirm Password field.
9. Click OK .
Review the information in the Certificate Request Settings pane.
Submit the generated CSR to the certificate authority that is associated with the key ring.
After the certificate authority returns the signed certificate, choose Key Rings > key-ring-name in the Work pane, and add the signed certificate to the key ring.

Note

The certificate must be signed by the certificate authority that is associated with the key ring. Certificates that contain MS-DOS line endings are not accepted. If an error occurs, remove the MS-DOS line endings and add the certificate again.

After the certificate is verified, the Admin State changes to Completed . The key ring is ready for use in the HTTP policy.
On the menu bar, choose Fabric > Fabric Policies .
In the Navigation pane, choose Policies > Pod > Management Access > default .
In the Work pane, choose the key ring from the Admin Key Ring drop-down list.
To enable certificate-based authentication, choose the previously created local user policy from the Client Certificate TP drop-down list, and set Client Certificate Authentication state to Enabled .
Click Submit .

The web servers restart, the certificate becomes active, and the nondefault key ring is associated with HTTPS access.

What to do next

Monitor the certificate expiration date and renew the certificate before it expires. To retain the same key pair, preserve and resubmit the original CSR. Do not delete the key ring or create a replacement key ring. Deleting the key ring also deletes the private key that is stored on the Cisco APIC .

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.