Configure certificate settings

From the SD-WAN Manager menu, choose Administration > Settings.

Choose Certificate settings.

1. Configure the control component certificate authorization settings.

   Field	Description
   Certificate authorization setting	Choose from one of the following options: Cisco PKI Enterprise
   If you choose Cisco PKI configure the following parameters.
   Sync root certificate	Click to sync root certificates to all connected devices before saving the Cisco PKI mechanism.
   Validity period	Select the validity period from the drop-down list.
   If you choose Enterprise configure the following parameters.
   Set CSR properties	Enable this option and enter the details for the following parameters: Domain: Network domain name. Do not exceed 17 characters. Organization: Enter the organization name. Organizational unit: This is a noneditable field. The organization unit must be the same as the organization name used in Cisco SD-WAN Manager. City: Enter the city name State: Enter the state name. Email: Enter the email address. 2-letter country code: Enter the country code. Subject Alternative Name(SAN) DNS Names : Optionally, you can configure multiple host names to use the same SSL certificate. Example: cisco.com and cisco2.com Subject Alternative Name(SAN) URIs : Optionally, you can configure multiple uniform resource identifiers (URIs) to use the same SSL certificate. Example: cisco.com and support.cisco.com

2. Configure the WAN edge cloud certificate authorization settings.

   Field	Description
   vEdge Cloud	Choose one of the following options to configure the type of Cisco vEdge cloud authorization: Automated (Manager signed) Manual (Enterprise CA - recommended)
   Save	Click to save the changes that you made and hide the WAN Edge Cloud Certificate Authorization options.
   Cancel	Click to discard the changes that you made and hide the WAN Edge Cloud Certificate Authorization options.

3. Configure the hardware WAN edge certificate authorization settings

   Field	Description
   Certificate authorization setting	Choose from one of the following options: Cisco PKI (SUDI certificate) Enterprise
   If you choose Enterprise configure the following parameters.
   Set CSR properties	Enable this option and enter the details for the following parameters: Domain: Network domain name. Do not exceed 17 characters. Organization: Enter the organization name. Organizational unit: This is a noneditable field. The organization unit must be the same as the organization name used in Cisco SD-WAN Manager. City: Enter the city name State: Enter the state name. Email: Enter the email address. 2-letter country code: Enter the country code. Subject Alternative Name(SAN) DNS Names : Optionally, you can configure multiple host names to use the same SSL certificate. Example: cisco.com and cisco2.com Subject Alternative Name(SAN) URIs : Optionally, you can configure multiple uniform resource identifiers (URIs) to use the same SSL certificate. Example: cisco.com and support.cisco.com

4. You can configure the enterprise certificate settings in advance or when you configure the certificate authorization for the control components and the WAN edge devices.

   Table 1. Enterprise Certificate Settings

   Field	Description
   Enrollment protocol type	Choose from one of the following: Manual EST SCEP For EST and SCEP options the route type can be vpn 0 or vpn 512, through which you can allow reachability to the CA server.
   If you choose Manual configure the following parameters.
   Enterprise root certificate	Choose Select a file to upload a root certificate authority file. The uploaded root certificate authority displays in the text box.
   If you choose EST configure the following parameters.
   URL base	Enter the full EST URL seen on CA server for EST/SCEP certificate authorization server.
   (Optional) Username	Enter the username for the EST CA server. Enter the same details here as per the configurations on the CA server.
   (Optional) Password	Enter the password to authenticate the EST CA server. Enter the same details here as per the configurations on the CA server.
   (Optional) CA Label	Enter the CA label for EST CA server. Enter the same details here as per the configurations on the CA server. Use the following format to enter the CA label: ip-address:port and enter alias, or host-name:port and enter alias
   Root CA certificate	Click Select a file to upload the root CA certificate of EST/SCEP CA server. If the root CA has intermediate CA which is a certificate chain, then provide the full chain here.
   Generate EST Client CSR	Enter the details for the following parameters: Domain: Network domain name. Do not exceed 17 characters. Organization: Enter the organization name. Organizational unit: This is a noneditable field. The organization unit must be the same as the organization name used in Cisco SD-WAN Manager. City: Enter the city name State: Enter the state name. Email: Enter the email address. 2-letter country code: Enter the country code. Subject Alternative Name(SAN) DNS Names : Optionally, you can configure multiple host names to use the same SSL certificate. Example: cisco.com and cisco2.com Subject Alternative Name(SAN) URIs : Optionally, you can configure multiple uniform resource identifiers (URIs) to use the same SSL certificate. Example: cisco.com and support.cisco.com
   Upload signed certificate file	Optionally, click Select a file to upload a signed certificate file. The signed certificate is obtained by signing the EST client CSR manually by CA.
   If you choose SCEP configure the following parameters.
   URL base	Enter the full SCEP URL as configured on the certificate authorization server. With this url you can call endpoints for certificate enrollment and renewal.
   (Optional) Challenge password	Enter the password for SCEP CA server. Enter the same details here as per the configurations on the CA server.
   (Optional) Root CA fingerprint	Use the md5 fingerprint of root CA.
   Root CA certificate	Click Select a file to upload the root CA certificate. If the root CA has intermediate CA which is a certificate chain, then provide the full chain here.

Click Save.