Tell me more ×
Network Engineering Stack Exchange is a question and answer site for network engineers. It's 100% free, no registration required.
up vote 4 down vote favorite

I'm trying to create a csr for a cisco prime server.

I managed to create a csr and put it in the "defaultRepo", which is local on the disk. After what I've read I need to create a certificate repo and upload the csr to that location. Now to the real question, where am I supposed to upload the csr?

When I try to generate the csr with: admin# ncs key genkey -newdn -csr csrfile.cert repository certificates

I get the following error message:

Writing certificate signing request to /opt/CSCOlumos/migrate/restore/csrfile.cert
INFO: no staging url defined, using local space.        rval:2
ERROR: Upload of csrfile.cert failed.   rval:-200
ERROR: ncs key genkey command failed.   rval:-200

My thoughts is that i can't use that repo since it does not exist in the running config.

Follow-up question. After i have created mye certificate in a new repo, and signed it afterwards. How can i make the web-server use it (to remove URL-warnings) ?

share|improve this question
add comment (requires an account with 50 reputation)

1 Answer

up vote 5 down vote

Make sure that you have created the repository using the following commands from the Command Guide.

(Remote sftp repository for example below, but you could use tftp, ftp, etc):

ncs/admin# configure terminal
ncs/admin(config)# repository myrepository
ncs/admin(config-Repository)# url sftp://example.test.com/repository/system1
ncs/admin(config-Repository)# user luke password plain example
ncs/admin(config-Repository)# exit
ncs/admin(config)# exit

Then it looks like you have the right syntax for generating the CSR according to this document. 

ncs key genkey -newdn -csr csrfilename repository repositoryname

It just seems that NCS is missing the required repository configuration, so that NCS knows where to put the CSR once it creates it.

Once you have generated the certificate, upload it to NCS using the following:

ncs key importcacert aliasname ca-cert-filename repository repositoryname

Then just issue ncs stop and ncs start from the CLI to begin using the certificates.

share|improve this answer
Thanks for the answer Brett. Do you have an opinion on mye follow-up? – Garmroth Jun 13 at 11:31
Edited above answer with more detail directed at your follow-up. – Brett Lykins Jun 13 at 11:39
add comment (requires an account with 50 reputation)

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.