Configure enterprise certificates

Domain Name

Network domain name.

Do not exceed 17 characters.

Organizational Unit

This is a noneditable field. The organization unit must be the same as the organization name used in Cisco SD-WAN Manager.

Note

For devices using Cisco IOS XE Catalyst SD-WAN Release 17.9.3a or later releases of Cisco IOS XE Release 17.9.x, or Cisco IOS XE Catalyst SD-WAN Release 17.12.1a or later, the certificates that you install on the devices do not require the Organizational Unit field to be defined. However, if a signed certificate includes the Organizational Unit field, the field must match the organization name configured on the device. This addresses the policy of the Certification Authority Browser Forum (CA/Browser Forum), as of September 2022, to stop including an organizational unit in signed certificates. Despite the change in policy of the CA/Browser Forum, some certificate authorities might still include an organizational unit in the signed certificate.

Secondary Organization Unit

This optional field is available from Cisco IOS XE Release 17.2 or Cisco SD-WAN Release 20.1.x. If this optional field is specified, it will be applied to all SD-WAN Control Components and edge devices.

Note

If a signed certificate includes the Organizational Unit field or the Secondary Organizational Unit field, one of these fields must match the organization name configured on the device. This addresses the policy of the Certification Authority Browser Forum (CA/Browser Forum), as of September 2022, to stop including an organizational unit in signed certificates. Despite the change in policy of the CA/Browser Forum, some certificate authorities might still include an organizational unit in the signed certificate.

Organization

Organization name.

City

City name.

State

State name.

Email

Email address.

2-Letter Country Code

Country code.

Subject Alternative Name (SAN) DNS Names

Optionally, you can configure multiple host names to use the same SSL certificate.

Example: cisco.com and cisco2.com

Subject Alternative Name (SAN) URIs

Optionally, you can configure multiple uniform resource identifiers (URIs) to use the same SSL certificate.

Example: cisco.com and support.cisco.com

View Enterprise CSR (certificate signing request)

Copy the CSR and sign it using the enterprise root certificate, and upload the signed certificate on SD-WAN Manager using the install certificate operation. SD-WAN Manager automatically discovers on which hardware edge the certificate needs to be installed on.

View Enterprise Certificate

After the certificate is installed, you can see the installed certificate and download it.

Renew Enterprise CSR

If you need to install a new certificate on the hardware device, you can use the Renew Enterprise CSR option. The Renew Enterprise CSR option generates the CSR. You can then view the certificate (View Enterprise CSR option) and install the certificate (Install Certificate option). This step flaps the control connections as a new serial number. You can see the new serial number and expiration data on the Configuration > Certificates page.

Note

The certificates that you install on devices in the Cisco Catalyst SD-WAN fabric do not require the Organizational Unit field to be defined. However, if a signed certificate includes the Organizational Unit field, the field must match the organization name configured on the device.

Revoke Enterprise Certificate

Removes the enterprise certificate from the device and moves it back to prestaging. The device has only SD-WAN Validator and SD-WAN Manager controls up.

• Copy the CSR available from the device.

• Sign the certificate using the enterprise root certificate from a certifying authority.

• Upload the signed certificate on SD-WAN Manager using the Install Feature Certificate operation.

  SD-WAN Manager automatically discovers on which hardware edge the certificate needs to be installed. After you install feature certificate, the option View Feature Certificate is available.

After you install the feature certificate, you can view the feature certificate and download it.

Removes the feature certificate or trustpoint information from the WAN edge device. After revoking a certificate, all actions against devices are not available. To view all actions for a device, ensure that you configure logging information of the device to a Transport Layer Security (TLS) profile with authentication type as server, and then configure back to mutual. Alternatively, to view the actions, reset the device to factory default configuration.

To reset a device to factory default:

• From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

• Create a device template with the factory-default template.

  The factory-default template is, Factory_Default_feature-name_Template. See Create a Device Template from Feature Templates for information about creating a device template with feature template.