Security

last person joined: 5 hours ago 

Enterprise security using ClearPass Policy Management, ClearPass Security Exchange, IntroSpect, VIA, 360 Security Exchange, Extensions and Policy Enforcement Firewall (PEF).
Expand all | Collapse all

AOS CX Switch Failed Install Certificate - DUR

This thread has been viewed 35 times
  • 1.  AOS CX Switch Failed Install Certificate - DUR

    Posted Jun 12, 2021 07:49 AM
    I follow the video to install the root certificate.
    Failed when installing it on the CX switch with error message.

    "A signer certificate is not set for signing in its Key Usage extension. Not accepted."





    I follow this video Aruba Dynamic Segmentation on AOS-CX: downloadable user roles
    YouTube remove preview
    Aruba Dynamic Segmentation on AOS-CX: downloadable user roles
    In this video you will learn how to setup downloadable user roles on AOS-CX. The video also shows you how to setup the configuration on ClearPass, and this i...
    View this on YouTube >


    ------------------------------
    Choh Koon Tan
    ------------------------------


  • 2.  RE: AOS CX Switch Failed Install Certificate - DUR

    Posted Jun 12, 2021 10:08 AM
    What do you have on the certificat ? (it is self signed ?)

    ------------------------------
    PowerArubaSW : Powershell Module to use Aruba Switch API for Vlan, VlanPorts, LACP, LLDP...

    PowerArubaCP: Powershell Module to use ClearPass API (create NAD, Guest...)

    PowerArubaCX: Powershell Module to use ArubaCX API (get interface/vlan/ports info)..

    ACEP / ACMX #107 / ACDX #1281
    ------------------------------



  • 3.  RE: AOS CX Switch Failed Install Certificate - DUR

    Posted Jun 13, 2021 07:56 AM
    Hi Alagoutte
    Radius and public SSL certificate.

    Do you mean I need to create self-signed certificate ?
    Curious is what certificate I retrive via http://10.x.x.x/.well-known/aruba/clearpass/https-root.pem

    ------------------------------
    Choh Koon Tan
    ------------------------------



  • 4.  RE: AOS CX Switch Failed Install Certificate - DUR

    Posted Jun 14, 2021 05:11 PM
    What release of CPPM ?

    ------------------------------
    PowerArubaSW : Powershell Module to use Aruba Switch API for Vlan, VlanPorts, LACP, LLDP...

    PowerArubaCP: Powershell Module to use ClearPass API (create NAD, Guest...)

    PowerArubaCX: Powershell Module to use ArubaCX API (get interface/vlan/ports info)..

    ACEP / ACMX #107 / ACDX #1281
    ------------------------------



  • 5.  RE: AOS CX Switch Failed Install Certificate - DUR

    Posted Jun 15, 2021 09:56 PM
    ClearPass Policy Manager 6.9.5.131053


    -----------------------------------------------------------------------------
    ArubaOS-CX
    (c) Copyright 2017-2021 Hewlett Packard Enterprise Development LP
    -----------------------------------------------------------------------------
    Version : ML.10.06.0101
    Build Date : 2021-02-28 17:31:44 PST
    Build ID : ArubaOS-CX:ML.10.06.0101:f197b0b27572:202103010059
    Build SHA : f197b0b27572722305744111dc8e7502e35d771f
    Active Image : primary

    Service OS Version : ML.01.07.0001
    BIOS Version : FL.01.0003

    ------------------------------
    Choh Koon Tan
    ------------------------------



  • 6.  RE: AOS CX Switch Failed Install Certificate - DUR

    Posted Jun 17, 2021 11:04 AM
    The message indicates that the certificate that you try to upload, is not a CA certificate. This may be the case if you have a self-signed certificate for HTTPS on your ClearPass.

    Did you validate that certificate that you downloaded as https-root.pem (and uploaded as TA), that it is actually the RootCA that signed your HTTPS server certificate? You should be able to import it in Windows or Mac (keychain) and validate what is in it, and if it has the ca:true field (which all roots should have).

    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------



  • 7.  RE: AOS CX Switch Failed Install Certificate - DUR

    Posted Jun 20, 2021 11:34 AM
    I really don't know what certificate was retrived from http://10.x.x.x/.well-known/aruba/clearpass/https-root.pem.

    I follow your info that the certificate require basically is https server certificate.
    I export out the HTTPS certificate to .PEM.
    Then I copy paste it onto switch ta-certificate , it works.

    ** there are 3 certificates in exported .PEM , first one I copy/paste it failed to install. The the second certificate (i think it is intermidiate CA) and it works .

    ------------------------------
    Choh Koon Tan
    ------------------------------



  • 8.  RE: AOS CX Switch Failed Install Certificate - DUR

    Posted Jun 21, 2021 06:43 AM
    Let me correct myself, if I wasn't clear. You should NOT import the ClearPass HTTPS Server certificate as your trust-anchor. You should import the Root CA that signed your HTTPS certificate. ClearPass will give you just that, if you fetch the certificate from that URL. That one should work, and if it doesn't check the PEM file for it contents, for example by importing it into your computer so you can view the contents.

    If you export your server certificate and mention that you got multiple certs and importing the second worked, that is expected, as you export in order the server certificate itself (which will not work), and the intermediate certificates. You can import an intermediate cert as well, but that is not a root cert, but will work (but may give complications later).

    Please work with your partner or Aruba support, as it is important to get this done right.

    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------



  • 9.  RE: AOS CX Switch Failed Install Certificate - DUR

    Posted Jun 25, 2021 04:06 AM
    Hi Herman,

    I did exported the HTTPS server public certificate (Go Daddy) to .PEM.
    I open up there are 3 certificates, I compare  the texts with the one I retrived from http://10.x.x.x/.well-known/aruba/clearpass/https-root.pem
    None matched .

    I also exported RADIUS/Database/ Onboard Root CA certificate and make comparison, none match to the one retrive from URL.


    ------------------------------
    Choh Koon Tan
    ------------------------------



  • 10.  RE: AOS CX Switch Failed Install Certificate - DUR

    Posted 30 days ago
    Maybe it is best to check with your partner or Aruba Support. It's hard for me to see what is wrong without having a look at the actual certificates, and your partner or TAC should be able to have that look and find a solution. If you need an answer of course, if it works and you feel good with it, that is fine as well.

    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------