Contrail Service Orchestration version: 6.x
This article documents the steps to verify CA server reachablity from the Contrail Service Orchestration (CSO) server. In the CSO UI, the PKI CA server details are configured under Administration/Authentication.
Perform the following steps:
Get the CA server details from under Administration/Authentication.
Log in to the CSO server and go to the "usr/local/lib/python2.7/dist-packages/tssm_services/script" location.
Execute the following command with the CRL server details from Step 2.
root@csp:/usr/local/lib/python2.7/dist-packages/tssm_services/script# sscep_static getca -v -F sha1 -c test.crt -u http://pki.server.test.net/sdwanlab/certsrv/mscep/mscep.dll
This command will indicate whether the CA server is reachable and providing the correct certificate or not.
#########. < Working output snip> root@csp:/usr/local/lib/python2.7/dist-packages/tssm_services/script# sscep_static getca -v -F sha1 -c test.crt -u http://pki.server.test.net/sdwanlab/certsrv/mscep/mscep.dll sscep_static: starting sscep, version 0.6.1 sscep_static: new transaction sscep_static: transaction id: SSCEP transactionId sscep_static: hostname: pki-server.test.net sscep_static: directory: sdwan/certsrv/mscep/mscep.dll sscep_static: port: 80 sscep_static: SCEP_OPERATION_GETCA sscep_static: server returned status code 200 sscep_static: MIME header: application/x-x509-ca-ra-cert sscep_static: valid response from server sscep_static: found certificate with subject: /C=GB/O=XYZ Group/CN=SDWAN-MSCEP-RA issuer: /C=GB/O=XYZ Group/CN=ReadyNet SDWAN Issuing CA usage: Digital Signature SHA1 fingerprint: E0:26:5C:FB:75:30:FD:B0:87:AD:67:FE:2C:34:54:82:54:65:8A:A1 sscep_static: certificate written as test.crt-0 sscep_static: found certificate with subject: /C=GB/O=XYZ Group/CN=SDWAN-MSCEP-RA issuer: /C=GB/O=XYZ Group/CN=ReadyNet SDWAN Issuing CA usage: Key Encipherment SHA1 fingerprint: 3B:64:2A:1E:68:70:1C:04:0F:C4:7B:DE:33:BD:ED:7A:90:56:37:04 sscep_static: certificate written as test.crt-1 sscep_static: found certificate with subject: /C=GB/O=XYZ Group/CN=Vodafone Customer Services Root CA issuer: /C=GB/O=XYZ Group/CN=Vodafone Customer Services Root CA usage: Certificate Sign, CRL Sign SHA1 fingerprint: C1:FA:7F:25:1D:2C:94:EE:F8:CC:D8:73:DE:8B:AA:75:D6:A2:FA:E7 sscep_static: certificate written as test.crt-2 sscep_static: found certificate with subject: /C=GB/O=XYZ Group/CN=ReadyNet SDWAN Issuing CA issuer: /C=GB/O=XYZ Group/CN=Vodafone Customer Services Root CA usage: Digital Signature, Certificate Sign, CRL Sign SHA1 fingerprint: E1:BE:4C:D9:47:E3:85:6E:96:03:BC:A1:7C:77:25:73:CD:CA:4D:5F sscep_static: certificate written as test.crt-3
#########. <Non Working output snip> root@csp:/usr/local/lib/python2.7/dist-packages/tssm_services/script# sscep_static getca -v -F sha1 -c test.crt -u http://pki.server.test.net/sdwanlab/certsrv/mscep/mscep.dll sscep_static: starting sscep, version 0.6.1 sscep_static: new transaction sscep_static: transaction id: SSCEP transactionId sscep_static: hostname: pki.test.net sscep_static: directory: sdwanlab/certsrv/mscep/mscep.dll sscep_static: port: 80 sscep_static: SCEP_OPERATION_GETCA sscep_static: server returned status code 502 sscep_static: mime_err: HTTP/1.1 502 Bad Gateway. ------> " showing bad gateway " Content-Type: text/html Server: Microsoft-IIS/10.0 Date: Mon, 06 Nov 2023 13:16:03 GMT Connection: close Content-Length: 1477 <h2>502 - Web server received an invalid response while acting as a gateway or proxy server.</h2> <h3>There is a problem with the page you are looking for, and it cannot be displayed. When the Web server (while acting as a gateway or proxy) contacted the upstream content server, it received an invalid response from the content server.</h3> </fieldset></div> sscep_static: wrong (or missing) MIME content type sscep_static: error while sending message
2023-12-19: Initial version