1. Create a set of certs for the gNMI client and device signed by a Certificate Authority (CA). a. Create Certs with OpenSSL on Linux. b. Install Certs on a device. c. Configure gNMI on the device. d. Verify whether gNMI is enabled and running. 2. Connect the gNMI client using client and root certificates configured in previous steps. Creating Certs with OpenSSL on Linux Certs and trustpoint are only required for secure gNMI servers. The following example shows how to create Certs with OpenSSL on a Linux machine:
# Setting up a CA openssl genrsa -out rootCA.key 2048 openssl req -subj /C=/ST=/L=/O=/CN=rootCA -x509 -new -nodes -key rootCA.key -sha256 -out rootCA.pem # Setting up device cert and key openssl genrsa -out device.key 2048 openssl req -subj /C=/ST=/L=/O=/CN= -new -key device.key -out device.csr openssl x509 -req -in device.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out device.crt -sha256 openssl pkcs12 -export -out mycert.pfx -inkey device.key -in device.crt -certfile rootCA.pem -aes128 Enter Export Password:cisco Verifying - Enter Export Password:cisco # Setting up client cert and key openssl genrsa -out client.key 2048 openssl req -subj /C=/ST=/L=/O=/CN=gnmi_client -new -key client.key -out client.csr openssl x509 -req -in client.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out client.crt -sha256 Installing Certs on a Device Through the CLI The following example show how to install certs on a device:
# Send: Device# configure terminal Enter configuration commands, one per line. End with CNTL/Z. Device(config)# crypto pki trustpoint trustpoint1 Device(ca-trustpoint)# revocation-check none Device(ca-trustpoint)# crypto pki import AESTEST pkcs12 bootflash:mycert.pfx password cisco % Importing pkcs12... Source filename [mycert.pfx]? Reading file from bootflash:mycert.pfx CRYPTO_PKI: Imported PKCS12 file successfully. Device(config)# gNMI Protocol Creating Certs with OpenSSL on Linux gNMI Protocol 15