Certificate renewal — Cisco UCS

Faustino Simoes

3 min read

·

1 day ago

--

Listen

Share

Press enter or click to view image in full size

Objective Replacing the expiring FI (Fabric Interconnect) certificate for Cisco enclosures.

Impact: Automations and APIs: Ansible-based tools, scripts, or integrations that use API calls may stop responding until the issue is resolved, due to strict SSL/TLS validation (rejection of connections with expired certificates).

Access to Fabric Interconnect (SSH and HTTPS): Direct access to FI is not affected. SSH access remains unchanged. HTTPS access (web interface) will remain available, but browsers will display expired/invalid certificate alerts, requiring the user to manually navigate through the security exception options.

Environment Operation (Data Plane): Network traffic and server/blade storage will not be impacted or interrupted.

We’ll connect to Fabric via SSH. I like to use PuTTY, where we’ll use admin credentials.

login as: admin
Pre-authentication banner message from server: | Cisco UCS 6400 Series Fabric Interconnect
End of banner message from server

admin@UCS-b password:
Cisco Nexus Operating System (NX-OS) Software
TAC support: http://www.cisco.com/tac
Copyright (c) 2009, Cisco Systems, Inc. All rights reserved.
The copyrights to certain works contained in this software are
owned by other third parties and used and distributed under
license. Certain components of this software are licensed under
the GNU General Public License (GPL) version 2.0 or the GNU
Lesser General Public License (LGPL) Version 2.1. A copy of each
such license is available at
http://www.opensource.org/licenses/gpl-2.0.php and
http://www.opensource.org/licenses/lgpl-2.1.php

Once logged in, we will execute a series of commands until we reach the point where we will begin some validations. The sequence of commands is:

UCS-B# scope security
UCS-B /security # scope keyring default

Let’s validate if the certificate’s expiration date is indeed approaching. To do this, I execute the command… show detail

UCS-B /security/keyring # show detail
Keyring default:
    RSA key modulus: Mod2048
    Trustpoint CA:
    Cert Status: Self Signed Certificate
    Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            00:00:00:00:00:00:00:00:bb:00:66:66:66:00:00:00:00:00:00:00
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=UCS-B
        Validity
            Not Before: Feb  2 12:15:01 2026 GMT <- Creation
            Not After : Feb  2 12:15:01 2027 GMT <- Expiration
        Subject: CN=UCS-B
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:00:00:00:00:00:00:11:00:00:00:00:0:00:00:
                    00:00:00:00:00:00:00:11:00:00:00:00:0:00:00:
                    00:00:00:00:00:00:00:11:00:00:00:00:0:00:00:
                    00:00:00:00:00:00:00:11:00:00:00:00:0:00:00:

Now that we know its expiration date, let’s move on to the renewal.

# set regenerate yes
# commit-buffer

Now that we know the expiration date, let’s proceed with the renewal. To do so, execute these commands and then run the `show detail` command again. The exit should look something like this.

UCS-B /security/keyring # show detail
Keyring default:
    RSA key modulus: Mod2048
    Trustpoint CA:
    Cert Status: Self Signed Certificate
    Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            00:00:00:00:00:00:00:00:bb:00:66:66:66:00:00:00:00:00:00:00
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: CN=UCS-B
        Validity
            Not Before: Dez  3 22:15:01 2027 GMT <- Creation
            Not After : Dez  4 22:15:01 2028 GMT <- Expiration
        Subject: CN=UCS-B
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:00:00:00:00:00:00:11:00:00:00:00:0:00:00:
                    00:00:00:00:00:00:00:11:00:00:00:00:0:00:00:
                    00:00:00:00:00:00:00:11:00:00:00:00:0:00:00:
                    00:00:00:00:00:00:00:11:00:00:00:00:0:00:00:

It’s important to always do this during a time of low traffic, preferably with a maintenance window associated with this activity, and always with an admin user or equivalent.