Developer

 View Only
last person joined: 9 days ago 

Expand all | Collapse all

Upload certificate to Mobility Conductor / Controllers

This thread has been viewed 81 times
  • 1.  Upload certificate to Mobility Conductor / Controllers

    Posted Nov 17, 2023 10:35 AM

    I'm using the REST API for Mobility Master, trying to automate cert-renewal.

    I am able to get a list of existing certificates, but when I try to use post, it doesn't work.

    I'm using this API request:

    https://mobilitymaster:4343/v1/configuration/object/crypto_local_pki_cert?config_path=%2Fmd%2FLocation%2F00:00:00:00:00:00

    body = {'cert_type':"ServerCert","name":"testcert","filename":"certificate.pfx"}

    However, the certificate itself is not attached to this request, and I don't know how to add it.



  • 2.  RE: Upload certificate to Mobility Conductor / Controllers

    MVP GURU
    Posted Nov 18, 2023 04:53 AM

    What the API swagger about body ? because i think you need to "upload" the certificate 



    ------------------------------
    PowerArubaSW : Powershell Module to use Aruba Switch API for Vlan, VlanPorts, LACP, LLDP...

    PowerArubaCP: Powershell Module to use ClearPass API (create NAD, Guest...)

    PowerArubaCL: Powershell Module to use Aruba Central

    PowerArubaCX: Powershell Module to use ArubaCX API (get interface/vlan/ports info)..

    ACEP / ACMX #107 / ACDX #1281
    ------------------------------



  • 3.  RE: Upload certificate to Mobility Conductor / Controllers

    Posted Nov 20, 2023 06:26 AM

    Do you mean the https://mobilitymaster:4343/api/ documentation thing?

    It only says this:
    {
      "cert_type": "ServerCert",
      "name": "string",
      "filename": "string"
    }

    But the filename parameter is just a string, it is not the file itself. 




  • 4.  RE: Upload certificate to Mobility Conductor / Controllers

    MVP GURU
    Posted Nov 20, 2023 06:55 AM

    Hi,

    I think filename is the payload of file (using base64 encoding ?)

    What do you have when make a get ?



    ------------------------------
    PowerArubaSW : Powershell Module to use Aruba Switch API for Vlan, VlanPorts, LACP, LLDP...

    PowerArubaCP: Powershell Module to use ClearPass API (create NAD, Guest...)

    PowerArubaCL: Powershell Module to use Aruba Central

    PowerArubaCX: Powershell Module to use ArubaCX API (get interface/vlan/ports info)..

    ACEP / ACMX #107 / ACDX #1281
    ------------------------------



  • 5.  RE: Upload certificate to Mobility Conductor / Controllers

    Posted Nov 20, 2023 07:20 AM

    There is a limit on how long the string can be, so base64 would be too much:
    "Error : Expecting string of length 1 to 31"

    Here's the output for get:

      '_data': {  'crypto_local_pki_cert': [  {  '_flags': {  'default': True,
                                                               'inherited': True},
                                                  'cert_type': 'PublicCert',
                                                  'filename': 'master-ssh-pub-cert',
                                                  'name': 'master-ssh-pub-cert'},
                                               {  'cert_type': 'ServerCert',
                                                  'filename': 'mobility-ctrl01.pfx',
                                                  'name': 'mobility-ctrl01'}]}}



  • 6.  RE: Upload certificate to Mobility Conductor / Controllers

    Posted Dec 08, 2023 09:36 AM

    I have not gotten any further with this. Can anyone assist?




  • 7.  RE: Upload certificate to Mobility Conductor / Controllers

    EMPLOYEE
    Posted Dec 08, 2023 10:42 AM

    I have not found a way to upload a certificate through the API of MCR or controllers (next step if you want to do renewals). The 'Expecting string of length 1 to 31' most times is that the filename used for the certificate is too long.

    And filename is a file on the flash filesystem, for which I don't see a API call to get/put one.

    I've seen examples where people used 'expect' or 'paramiko' to script certificate uploads through SSH  (but could not find them back just a moment ago).

    If someone managed to update certificates via the controller API, I'd like to learn how as well.



    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------



  • 8.  RE: Upload certificate to Mobility Conductor / Controllers
    Best Answer

    Posted Dec 11, 2023 09:32 AM

    First you will have to upload the certificate to the controllers flash using {{url_md}}/v1/configuration/object/copy_scp_flash


    Second
    you will have to install the certificate on the controller using {{url_md}}/v1/configuration/object/crypto_pki_import_cer

    With this body:

    {
      "format": "pkcs12",
      "cert": "ServerCert",
      "name": "<display_name_of_certificate>",
      "filename": "newcert.pfx",
      "passphrase": "************"
    }

    Results

    },
    "_global_result": {
    "status": 0,
    "status_str": "Success",
    "_pending": false
    }

    Last, if the controller is managed by a Conductor, you will have set the new certificate with the following API call to the Conductor

    {{url_mm}}/v1/configuration/object/crypto_local_pki_cert

    Body:

    {
      "cert_type": "ServerCert",
      "name": "ctrl-01",
      "filename": "domain.pfx"
    }

    Results:

    },
    "_global_result": {
    "status": 0,
    "status_str": "Success",
    "_pending": false
    }
    In short, you cannot upload and set the new certificate in all-in-one command crypto_local_pki_cert
    You will have to 1. upload with scp/ftp/tftp, 2. install certificate on controller, and 3. configure the Conductor (which in turns configure the controller to use the new certificate.
    Remember to commit pending changes
    {{url_mm}}/v1/configuration/object/write_memory
    Body:
    {
        "action": "commit"
    }



  • 9.  RE: Upload certificate to Mobility Conductor / Controllers

    EMPLOYEE
    Posted Dec 13, 2023 11:53 AM

    Awesome info, works like a charm... using ftp instead of scp to avoid putting scp credentials in the script, but with these steps it works nicely!



    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------



  • 10.  RE: Upload certificate to Mobility Conductor / Controllers

    Posted Dec 14, 2023 06:51 AM

    Big thanks to my colleague olehaa who figured this out and posting the solution :)




  • 11.  RE: Upload certificate to Mobility Conductor / Controllers

    Posted Dec 22, 2023 07:26 AM

    I've made some changes to the solution. Here everything is done towards the Mobility Master. You need to specify the path for each controller. The path can be found by typing "cd ?" when logged into the Mobility Master with SSH.

    {{url_mm}}/v1/configuration/object/copy_tftp_flash?config_path=%2Fmd%2FMyCompany%2FMyLocation%2F00:00:00:00:00:00
    {{url_mm}}/v1/configuration/object/crypto_pki_import_cert?config_path=%2Fmd%2FMyCompany%2FMyLocation%2F00:00:00:00:00:00
    {{url_mm}}/v1/configuration/object/crypto_local_pki_cert?config_path=%2Fmd%2FMyCompany%2FMyLocation%2F00:00:00:00:00:00
    {{url_mm}}/v1/configuration/object/write_memory?config_path=%2Fmd%2FMyCompany%2FMyLocation%2F00:00:00:00:00:00
    (config_path might not be needed on that last one)

    However, there is one last step that I'm missing, and that is to configure the Web Server with the new certificate that has been uploaded. I can't find any API endpoints that configure the Web Server.

    If I try to upload a certificate with the same name as before I get an error that says that it already exists a certificate with that name (It's the second API request above that gives the error).




  • 12.  RE: Upload certificate to Mobility Conductor / Controllers

    EMPLOYEE
    Posted Dec 22, 2023 09:23 AM

    Ah, I didn't realize, but that is what I did in my lab.

    In order to apply the certification you would need the /v1/configuration/object/httpd_wrap_prof

    { "cp_cert": { "captive-portal-cert": certname }} does the captive portal certificate.

    I haven't tested, but the Web UI cert should be { "switch_cert": { "switch-cert": certname }} ; but check the httpd_wrap_prof object for confirmation.



    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------



  • 13.  RE: Upload certificate to Mobility Conductor / Controllers

    Posted Dec 22, 2023 11:28 AM

    I think you need to change the web UI cert via Admin -> Admin Authentication Options -> Server certificate

    This will update it in the profile as well.

    Log from the web UI if I change it through Admin Authentication Options manually:
    Controller mobility-ctrl01 in Managed Network > XXXXX > XXXXXX
    System > Admin > Admin Authentication Options:
    Server certificate = mobility-ctrl01-2023-64.pfx
    Authentication = Disabled
    System > Profiles > Other Profiles > Web Server Configuration:
    Switch Certificate = mobility-ctrl01-2023-64.pfx
    Additional changes from CLI

    However, I have a hard time navigating through the API to find the correct place to set this.




  • 14.  RE: Upload certificate to Mobility Conductor / Controllers

    Posted Dec 22, 2023 01:50 PM