Cisco NX-OS: gNOI endpoint LoadCertificateRequest does not allow setting ca_certificate

Problem Statement

The Cisco NXOS gNOI API for the LoadCertificateRequest endpoint (see here) does not allow setting a ca_certificate, which prevents installing certificates from a private CA. The client cannot validate the chain of trust as it cannot be linked to the issuing CA because the field is missing. This restriction effectively limits certificate installation to self-signed certificates only.

This script can be run to trigger the condition.

Vendor Acknowledgement

Cisco has labeled this issue as a feature request rather than a bug, but we argue that in conjunction with #161, the gNOI endpoint cannot handle private CA installations at all. See CSCws33167.

Additionally, this gNOI endpoint leaks private keys to the disk by running crypto ca import $trustpoint pkcs bootflash:temp_pkcs_$hex_value cisco123 in the background, where cisco123 is a static password used on every import.

Workarounds

Provision and manage TLS certificates via ZTP and NX-API for better security and control over the certificate installation process.

Add NX-API PKCS#12 workaround for certificate provisioning

Tested on NX-OS prerelease build 10.7(0)IMG9(0.81), both issues now work with caveats.

We wrote a test script that exercises the full bootstrap flow end to end:

LoadCertificate with a CA-signed leaf cert (CN/SAN = device IP, ca_certificates field populated)
LoadCertificateAuthorityBundle to push the CA
gNMI Set on System/grpc-items to configure cert + certClientRoot + port
Verified mTLS gNMI Get with no InsecureSkipVerify, using a client cert signed by the same CA

Results:

❯ go run ./hack/gnoi-cert-test/ \
    -address $DEVICE:9339 \
    -username $USER \
    -password $PASSWORD \
    -trustpoint see-if-fixed
  saved ca.crt
  saved ca.key
  saved client.crt
  saved client.key
=== Step 1: LoadCertificate with CA-signed cert (CN/SAN = device IP) ===
    Bug: NX-OS rejects non-self-signed certs with 'Certificate is not a valid self-signed CA'
OK — NX-OS accepted a CA-signed cert

=== Step 2: LoadCertificateAuthorityBundle (issue #161) ===
    Bug: NX-OS returns 'ca_certificates is unsupported'
  deleting old CA bundle trustpoint: gNOI-CA-BUNDLE-TP
OK — NX-OS accepted LoadCertificateAuthorityBundle
  found CA bundle trustpoint: gNOI-CA-BUNDLE-TP_1

=== Step 3: Set gNMI trustpoint (grpc certificate + grpc client root certificate) ===
OK — cert=see-if-fixed clientRoot=gNOI-CA-BUNDLE-TP_1
  waiting for device to apply new cert... applied

=== Step 4: gNMI Get /System/showversion-items/nxosImageFile via mTLS (no skip-verify, username only) ===
  nxosImageFile: bootflash:///nxos64-cs.10.7.0.IMG9.0.81.F.bin
OK

Remaining issue: CA bundle trustpoint identification

LoadCertificateAuthorityBundle creates a trustpoint named gNOI-CA-BUNDLE-TP (and gNOI-CA-BUNDLE-TP_1, _2, ... on subsequent calls; old ones are not cleaned up automatically). To wire up certClientRoot we need to identify which of these trustpoints holds the CA we just pushed.

gNMI exposes the trustpoint list at System/userext-items/pkiext-items/tp-items/TP-list but does not expose any cert fingerprint, subject, or serial number, only the trustpoint name and a cabundleLabel presence flag. There is no way to match a trustpoint back to the cert that was loaded into it via gNMI alone.

Workaround
Before calling LoadCertificateAuthorityBundle, delete all existing gNOI-CA-BUNDLE-TP* trustpoints via gNMI Set delete, then call the bundle RPC, then pick the only remaining gNOI-CA-BUNDLE-TP* entry. This works but is destructive and not atomic.

The clean fix would be for NX-OS to expose cert metadata (fingerprint, subject, or serial) for trustpoints via gNMI.

This issue is stale because it has been open for 90 days with no activity.

Navigation Menu

Repository navigation

Cisco NX-OS: gNOI endpoint `LoadCertificateRequest` does not allow setting `ca_certificate` #162

Problem Statement

Vendor Acknowledgement

Workarounds

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Cisco NX-OS: gNOI endpoint LoadCertificateRequest does not allow setting ca_certificate #162

Description

Problem Statement

Vendor Acknowledgement

Workarounds

Activity

swagner-de commented on Jun 12, 2026

github-actions commented on Sep 11, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Cisco NX-OS: gNOI endpoint `LoadCertificateRequest` does not allow setting `ca_certificate` #162