Course contents

Unit 5: Onboarding and trustLesson 5.1 (1 of 5 in this unit)21 of 27 in the Cisco SD-WAN course

PKI, root CA, certificates and authorization

What the root CA, device certificates and the device authorisation list each prove in Cisco SD-WAN, why a valid certificate is not enough to join, and how to check trust on a router.

Intermediate · 10 min read

You'll learn to explain what a root CA, a device certificate and the device authorisation list each prove, say why a valid certificate is still not enough to join the fabric, and check trust on a router.

Technical definition

PKI (public key infrastructure) is the set of parts that make certificates trustworthy: a certificate authority (CA) that signs certificates, the certificates themselves, and the rules for who trusts which CA. In Cisco SD-WAN, every controller and WAN Edge presents a certificate during the control connection, and each side checks it against a root CA certificate that it already holds.

A valid certificate that still gets refused

BR-02 has a route to the Validator (formerly vBond), the right system IP and the right organisation name, yet its control connection is dropped soon after the handshake starts. The other branches are fine. When the network path is clean and the session still fails, the cause is usually trust: one side does not accept the other side's certificate, or accepts it but does not list the device. This lesson covers the parts of that trust, so the symptom can be placed.

Four ideas that are easy to mix up

PartWhat it provesHeld by
Root CA certificateWhich signer to trust. It is the starting point for checking every other certificate.Every controller and every WAN Edge
Device certificateThis device holds the identity it claims, signed by a trusted CA.The device itself
Device authorisation listThis identity is allowed to join this fabric.The controllers, loaded from the Manager
Organisation nameThis device belongs to the same organisation. See Organisation Name.In the configuration and in the certificate subject

The first two are about authenticity, the last two about permission. A fault in any one of them stops the control connection, and they fail in slightly different ways, which is why it helps to keep them apart.

Four ideas
Four ideasCertificate, trust, authentication and authorisation.PKI ideasCertificateproves identityTrustwho signed itAuthenticationis it validAuthorisationis it allowed

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Each answers a different question.

How a certificate is trusted

  1. A CA signs a certificate. The CA vouches for the pairing of a name and a public key by signing it with its own private key.
  2. The router holds the CA's root certificate. It is stored on the router before the first control connection. Without it, the router has nothing to check a controller against.
  3. A controller shows its certificate. The router checks the signature against the root certificate it holds, checks the dates, and checks that the name fits.
  4. The router shows its own. The controller does the same check in the other direction. This two-way check is why the connection is called mutually authenticated.

The root certificate is a trust anchor: it is installed by an administrator or by the onboarding process, not learned from the network. A device that was handed the wrong root certificate will reject genuine controllers.

How trust is built
How trust is builtA certificate is signed by a CA that the other side trusts.Device certsigned by CARoot certinstalled on peerChainverifiedTrusted

On small screens, swipe sideways or focus the diagram and use the arrow keys.

The root certificate must be installed.

Who plays the CA

Fabrics differ here, and the choice affects how new certificates are issued and renewed. Typical options are a Cisco-operated service, the Manager acting as a CA, or the organisation's own enterprise CA. Which options your release offers, and where the setting lives in the Manager, is release dependent. What stays the same is the rule above: every device must hold the root certificate of the CA that signed its peers.

Authorisation: the second gate

After the certificate check passes, the controller looks the device up. The Manager holds the fabric's list of devices (an older name for the permitted list is the white list) and distributes it to the controllers. A device that is not on it is refused even with a perfect certificate. This is the control that stops a stolen or cloned identity from joining by itself: someone has to have added the device to the list.

Authentication and authorisation
Authentication and authorisationA valid certificate is not enough.AuthenticationCertificate is validAuthorisationDevice is on the listand

On small screens, swipe sideways or focus the diagram and use the arrow keys.

The serial number must also be on the allowed list.
Router typeIdentityHow it becomes authorised
Virtual router (Catalyst 8000V)A chassis number issued by the Manager, plus a one-time tokenThe token is used on the router (see Manual Bootstrap). The Manager issues the certificate.
Hardware routerA certificate installed at manufacture, tied to the chassis serial numberThe serial number is added to the device list, often through the Plug and Play (PnP) portal. Release dependent.

Treat the hardware row as a summary, not a procedure. Exact certificate types, renewal and the PnP linkage change between releases and between hardware models.

Checking trust on a router

These commands are for a lab or your own device. The names below are the usual IOS XE SD-WAN forms, but check your release because syntax and output change between versions.

Checking trust
Checking trustCheck the certificate, the root and the time.Certificate validDates and subjectRoot installedChain can be checkedClock correctNTP

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Time errors look like trust errors.
show clock show sdwan certificate root-ca-cert show sdwan certificate serial

Clock first, because every certificate check uses the date. Then the root certificate the router holds, then the identity it presents. Run on the router; the Manager has the equivalent views in its GUI.

Example output written for this lesson, simplified; real output has more fields and a different layout
BR-01#show sdwan certificate serial
Chassis number: EXAMPLE-CHASSIS-0001
Certificate serial number: EXAMPLE-SERIAL-0001
Organization: LAB-EXAMPLE
The values are placeholders. What to look for: a chassis number that exists in the Manager's device list, a certificate that has actually been issued (not empty), and an organisation name that matches the controllers exactly.

If the root certificate is missing or is the wrong one, install the correct file before anything else. The install command takes the file you copied to the router's storage:

request platform software sdwan root-cert-chain install bootflash:<root-ca-file>

The file name is yours; the storage name (bootflash: here) depends on the platform. Check your release.

Reading the symptom

Reading the symptom
Reading the symptomSymptom; Most likely part. Fails on every transport, at the handshake: Root certificate missing or wrong, or the clock is far off Handshake works, then the controller closes the session: The device is not on the authorisation list, or the organisation name differs Worked for months, now fails on all devices: A certificate or the root has expired; check validity dates on the controllers Only one new router fails: That router's identity: chassis number, token or list entrySymptomMost likely partFails on every transport,at the handshakeRoot certificate missing or wrong, or the clock is far offHandshake works, then thecontroller closes thesessionThe device is not on the authorisation list, or the organisation namediffersWorked for months, nowfails on all devicesA certificate or the root has expired; check validity dates on thecontrollersOnly one new router failsThat router's identity: chassis number, token or list entry

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Each item on the left, with what it means on the right.

Learn more: Control Connections (DTLS and TLS)Organisation NameValidator

Mistakes around certificates

  • Fixing the network when the error is trust. If another router on the same transport connects, the path is not the problem.
  • Assuming a certificate means permission. It means identity. The list and the organisation name decide membership.
  • Ignoring the clock on a new virtual router. A wrong date makes valid certificates look expired or not yet valid.
  • Installing a root certificate from a different fabric because the file name looked right. Compare the issuer before relying on it.

Test yourself on trust

Predict · scenario 1

BR-02 has a certificate signed by a CA that the Controller trusts, but its chassis number was not added to the fabric's device list. What happens?

Predict · scenario 2

What does the root CA certificate on a router let it do?

Predict · scenario 3

A new virtual router fails to connect on both of its transports. The date on it is two years in the past. What should you fix first?

Predict · scenario 4

Which statement about certificate sources for the Catalyst 8000V and for hardware routers is the most accurate?

FAQ

Is the root CA the same thing as the Manager?
Not necessarily. The Manager (formerly vManage) can act as a certificate authority in some designs, and other designs use a Cisco-operated or an enterprise CA. Which one a fabric uses is a deployment choice, so check your release's guide and your own design.
If a router has a valid certificate, why can it still be refused?
A certificate says who the device is and that a trusted CA signed it. It does not say the device is allowed in this fabric. The controllers also keep a list of authorised devices, and an identity that is not on it is rejected. The organisation name must match as well.
Do hardware routers and virtual routers get certificates the same way?
No. A hardware router normally carries a certificate installed in the factory, tied to its serial number. A virtual router such as the Catalyst 8000V has no factory hardware identity, so it is given an identity with a chassis number and a one-time token from the Manager. Details vary by release, so check yours.