On a VM Host system architecture there may be a situation in which you want to disable libvirtd TLS certificate. This document provides instructions on how to do so.

An instruction to disable libvirtd TLS certificate for internal connections.

Steps to Disable the TLS Certificate Validity Testing

Requirements:

• You need to have "root" access to the underlying FreeBSD shell of a Junos device
• If you have any questions, you can contact the Technical Assistant Center for more information.

Instruction:

1.   Log in to the system as "root" user - this is required to run the "request vmhost exec ..." commands.

2.  From the "cli>" prompt, use the command below to check if the workaround has been implemented:

request vmhost exec "grep tls_no_sanity /etc/libvirt/libvirtd.conf"

Check the output:

#tls_no_sanity_certificate = 1 -  means you need to go to the next step to implement the fix (notice the "#" in the beginning.

tls_no_sanity_certificate = 1 - means the fix has been applied, no need to go to the next step

3. From the "cli>" prompt, use the following command to disable TLS validation: (this is in 1 single line)

request vmhost exec "sed -i -E 's/^[[:space:]]*#?[[:space:]]*(tls_no_sanity_certificate =).*$/\1 1/' /etc/libvirt/libvirtd.conf"

4. Validate the new TLS setting using step 2.

request vmhost exec "grep tls_no_sanity /etc/libvirt/libvirtd.conf"

This concludes the process to disable the TLS certificate validity on a Junos device.

First publication 2025-10-14