How to upload Custom Cert on activate using Curl commands?

MVP Expert
MVP Expert
Requirement:

 

We would need to upload a custom self signed cert to IAP to form a VPN tunnel between VMC and IAP as VMC doesn't have a Aruba TPM cert.



Solution:

 

We have a list of Curl commands to perform this action



Configuration:

 

Below are the commands used,

 

To login:

-----------

 curl -k --insecure -c cookie.txt -X POST -d "credential_0=username&credential_1=password" https://activate.arubanetworks.com/LOGIN

To add a new certificate:

------------------------



cat <certname> | python -c "import sys, json; print 'json={\"cert\":' + json.dumps(sys.stdin.read()) + '}'" | curl -kv -b cookie.txt -X POST --data-urlencode "@-" https://activate.arubanetworks.com/api/ext/ta.json?action=add

To update with a new certificate:

--------------------------------

 

cat <certname> | python -c "import sys, json; print 'json={\"cert\":' + json.dumps(sys.stdin.read()) + '}'" | curl -kv -b cookie.txt -X POST --data-urlencode "@-" https://device.arubanetworks.com/api/ext/ta.json?action=update

To verify the certificate details

 

curl -kv -b cookie.txt https://device.arubanetworks.com/api/ext/ta.json?action=detail


Verification

Sample outputs,

 

To login:

--------

 

$ curl -k --insecure -c cookie.txt -X POST -d "credential_0=arubatac&credential_1=******" https://activate.arubanetworks.com/LOGIN

 

To add a new cert:

-----------------

 

cat certn.pem | python -c "import sys, json; print 'json={\"cert\":' + json.dumps(sys.stdin.read()) + '}'" | curl -kv -b cookie.txt -X POST --data-urlencode "@-" https://activate.arubanetworks.com/api/ext/ta.json?action=add

Note: Unnecessary use of -X or --request, POST is already inferred.

*   Trying 104.36.249.200...

* TCP_NODELAY set

* Connected to activate.arubanetworks.com (104.36.249.200) port 443 (#0)

* ALPN, offering h2

* ALPN, offering http/1.1

* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH

* successfully set certificate verify locations:

*   CAfile: /etc/ssl/cert.pem

  CApath: none

* TLSv1.2 (OUT), TLS handshake, Client hello (1):

* TLSv1.2 (IN), TLS handshake, Server hello (2):

* TLSv1.2 (IN), TLS handshake, Certificate (11):

* TLSv1.2 (IN), TLS handshake, Server key exchange (12):

* TLSv1.2 (IN), TLS handshake, Server finished (14):

* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):

* TLSv1.2 (OUT), TLS change cipher, Client hello (1):

* TLSv1.2 (OUT), TLS handshake, Finished (20):

* TLSv1.2 (IN), TLS change cipher, Client hello (1):

* TLSv1.2 (IN), TLS handshake, Finished (20):

* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384

* ALPN, server did not agree to a protocol

* Server certificate:

*  subject: C=US; ST=California; L=Sunnyvale; O=Aruba Networks, Inc.; OU=Cloud; CN=activate.arubanetworks.com

*  start date: Jan 29 00:00:00 2018 GMT

*  expire date: Jan 28 12:00:00 2021 GMT

*  issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=GeoTrust TLS RSA CA G1

*  SSL certificate verify ok.

> POST /api/ext/ta.json?action=add HTTP/1.1

> Host: activate.arubanetworks.com

> User-Agent: curl/7.54.0

> Accept: */*

> Cookie: csrf_token=2ff77e52-a5a3-4001-becd-bafdf284db97; session=f923dca1-67cd-4bbd-9bcb-a46baaff3db3

> Content-Length: 1199

> Content-Type: application/x-www-form-urlencoded

> Expect: 100-continue

< HTTP/1.1 100 Continue

* We are completely uploaded and fine

< HTTP/1.1 200 OK

< Date: Mon, 05 Aug 2019 15:37:55 GMT

< Server: Apache/2.4.6 (CentOS)

< X-Frame-Options: SAMEORIGIN

< Cache-Control: no-cache

< Content-Disposition: inline;filename=ta.json

< Content-Length: 34

< Content-type: application/json; charset=utf-8

< Expires: -1

< Pragma: no-cache

* Connection #0 to host activate.arubanetworks.com left intact

 

To update the cert:

------------------

$ cat certn.pem | python -c "import sys, json; print 'json={\"cert\":' + json.dumps(sys.stdin.read()) + '}'" | curl -kv -b cookie.txt -X POST --data-urlencode "@-" https://activate.arubanetworks.com/api/ext/ta.json?action=update

Note: Unnecessary use of -X or --request, POST is already inferred.

*   Trying 104.36.249.200...

* TCP_NODELAY set

* Connected to activate.arubanetworks.com (104.36.249.200) port 443 (#0)

* ALPN, offering h2

* ALPN, offering http/1.1

* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH

* successfully set certificate verify locations:

*   CAfile: /etc/ssl/cert.pem

  CApath: none

* TLSv1.2 (OUT), TLS handshake, Client hello (1):

* TLSv1.2 (IN), TLS handshake, Server hello (2):

* TLSv1.2 (IN), TLS handshake, Certificate (11):

* TLSv1.2 (IN), TLS handshake, Server key exchange (12):

* TLSv1.2 (IN), TLS handshake, Server finished (14):

* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):

* TLSv1.2 (OUT), TLS change cipher, Client hello (1):

* TLSv1.2 (OUT), TLS handshake, Finished (20):

* TLSv1.2 (IN), TLS change cipher, Client hello (1):

* TLSv1.2 (IN), TLS handshake, Finished (20):

* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384

* ALPN, server did not agree to a protocol

* Server certificate:

*  subject: C=US; ST=California; L=Sunnyvale; O=Aruba Networks, Inc.; OU=Cloud; CN=activate.arubanetworks.com

*  start date: Jan 29 00:00:00 2018 GMT

*  expire date: Jan 28 12:00:00 2021 GMT

*  issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=GeoTrust TLS RSA CA G1

*  SSL certificate verify ok.

> POST /api/ext/ta.json?action=update HTTP/1.1

> Host: activate.arubanetworks.com

> User-Agent: curl/7.54.0

> Accept: */*

> Cookie: csrf_token=2ff77e52-a5a3-4001-becd-bafdf284db97; session=f923dca1-67cd-4bbd-9bcb-a46baaff3db3

> Content-Length: 1199

> Content-Type: application/x-www-form-urlencoded

> Expect: 100-continue

< HTTP/1.1 100 Continue

* We are completely uploaded and fine

< HTTP/1.1 200 OK

< Date: Mon, 05 Aug 2019 15:41:29 GMT

< Server: Apache/2.4.6 (CentOS)

< X-Frame-Options: SAMEORIGIN

< Cache-Control: no-cache

< Content-Disposition: inline;filename=ta.json

< Content-Length: 34

< Content-type: application/json; charset=utf-8

< Expires: -1

< Pragma: no-cache

* Connection #0 to host activate.arubanetworks.com left intact

 

 

To view the cert:

----------------

 

curl -kv -b cookie.txt https://activate.arubanetworks.com/api/ext/ta.json?action=detail

*   Trying 104.36.249.200...

* TCP_NODELAY set

* Connected to activate.arubanetworks.com (104.36.249.200) port 443 (#0)

* ALPN, offering h2

* ALPN, offering http/1.1

* Cipher selection: ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH

* successfully set certificate verify locations:

*   CAfile: /etc/ssl/cert.pem

  CApath: none

* TLSv1.2 (OUT), TLS handshake, Client hello (1):

* TLSv1.2 (IN), TLS handshake, Server hello (2):

* TLSv1.2 (IN), TLS handshake, Certificate (11):

* TLSv1.2 (IN), TLS handshake, Server key exchange (12):

* TLSv1.2 (IN), TLS handshake, Server finished (14):

* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):

* TLSv1.2 (OUT), TLS change cipher, Client hello (1):

* TLSv1.2 (OUT), TLS handshake, Finished (20):

* TLSv1.2 (IN), TLS change cipher, Client hello (1):

* TLSv1.2 (IN), TLS handshake, Finished (20):

* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384

* ALPN, server did not agree to a protocol

* Server certificate:

*  subject: C=US; ST=California; L=Sunnyvale; O=Aruba Networks, Inc.; OU=Cloud; CN=activate.arubanetworks.com

*  start date: Jan 29 00:00:00 2018 GMT

*  expire date: Jan 28 12:00:00 2021 GMT

*  issuer: C=US; O=DigiCert Inc; OU=www.digicert.com; CN=GeoTrust TLS RSA CA G1

*  SSL certificate verify ok.

> GET /api/ext/ta.json?action=detail HTTP/1.1

> Host: activate.arubanetworks.com

> User-Agent: curl/7.54.0

> Accept: */*

> Cookie: csrf_token=1aa43116-d3d9-455c-a4d7-2820cf9af3c0; session=26956d31-11a7-4041-8f47-00f9050a67ac

< HTTP/1.1 200 OK

< Date: Mon, 05 Aug 2019 15:42:46 GMT

< Server: Apache/2.4.6 (CentOS)

< X-Frame-Options: SAMEORIGIN

< Cache-Control: no-cache

< Content-Disposition: inline;filename=ta.json

< Content-Length: 1157

< Content-type: application/json; charset=utf-8

< Expires: -1

< Pragma: no-cache

< Vary: Accept-Encoding

* Connection #0 to host activate.arubanetworks.com left intact

{"trust_anchor":{"customer_id":"9a4b44dd-a5f8-4076-95a1-4c28917d9d3f",

"cert":"-----BEGIN CERTIFICATE-----

\nMIIC4DCCAcigAwIBAgIBADANBgkqhkiG9w0BAQUFADAhMR8wHQYDVQQDExZBT1M6

\nOjAwOjUwOjU2Ojg5Ojk5OjYyMB4XDTE5MDUyMDEzNTQ1MloXDTI5MDUxNzEzNTQ1

\nMlowITEfMB0GA1UEAxMWQU9TOjowMDo1MDo1Njo4OTo5OTo2MjCCASIwDQYJKoZI

\nhvcNAQEBBQADggEPADCCAQoCggEBAL7//DYpU6adFcIz6KKRJGZvCgyUMV6Wj/LD

\nVzGI1vQNyl39suhn7Zydx+BvKJb5779KTJcrt82Vd50l+2JH59RqtTyK6MSz1DV4

\nCFxyZHOMRyEwAp+Uw/FcdiVTAO5vL1+3I1FzDlanO8ggn9lMYsuZ7+sE4X7QgPso

\nvlH+rfBpwhLVddVss7vca2J/9Q3z4hMQA6Yram+iFT6wqa+blWbNQLmzno8VcfqN

\nuHn238kKm+I37nCce7kuYBtmtwLeJTediJYoLud/roSV6F6p6WdBPnZLJSmAKUQq

\n2ENsSAM7N6D95WmuKS94pUNreMvZq4fhwiu2x5gWdOTZlQkPHc0CAwEAAaMjMCEw

\nDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAaYwDQYJKoZIhvcNAQEFBQAD

\nggEBAK9NddjAS9FggFjpI9+eXYHgCfF5QMBsXQGHy1rQxzm2czoLcqzRqQ7w5Fu0

\nytH/mOgl72WmDBJDaN/hlQQEMc3LJ6dAl8Wm3SvJuxURwM10B/Vsq2SpvawvXXzv

\nYqYEoR6WF56KiCw56RCjqf7S7XMgs3VML84MxUYaWrFha3jVVVkmBzp5cVnOtEW8

\nLmQRrmckPlBe3HI+uXCxgr8gthGkry75spgZ8zBzu7YKvuixZvIttwysI3p5SEUY

\nPQ3EezY0iF23ejV9ZpokdTIWKB4=\n-----END CERTIFICATE-----\n"}}

 

Version history
Revision #:
2 of 2
Last update:
2 weeks ago
Updated by:
 
Labels (1)
Contributors
Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: