From YumaPro SDK version 17.10-6 onwards NETCONF over TLS is supported. To enable Transport Layer Security (TLS) between the server and client you need to setup both the server and the client with appropriate certificates and configuration. The following instructions walk you through the setup process.


Graphical representation of the server, client, and authority certificates and keys for TLS.


Server Setup


On the server create a couple of directories for working with the certificates and copy the generate-keys.sh script to the buildcerts directory that was just created:



    mydir> mkdir $HOME/buildcerts
    mydir> mkdir $HOME/certs
    mydir> cp /usr/share/yumapro/util/generate-keys.sh $HOME/buildcerts



cd to the buildcerts directory, run the key generation script and check the files were created:



    mydir> cd buildcerts
    buildcerts> ./generate-keys.sh


    buildcerts> ls -l


      -rw-rw-r-- 1 andy andy 956 Mar 16 15:05 ca.crt
      -rw-rw-r-- 1 andy andy 883 Mar 16 15:05 ca.csr
      -rw-rw-r-- 1 andy andy 1708 Mar 16 15:05 ca.key
      -rw-rw-r-- 1 andy andy 17 Mar 16 15:05 ca.srl
      -rw-rw-r-- 1 andy andy 969 Mar 16 15:05 client.crt
      -rw-rw-r-- 1 andy andy 891 Mar 16 15:05 client.csr
      -rw-rw-r-- 1 andy andy 1708 Mar 16 15:05 client.key
      -rwxrwxr-x 1 andy andy 1513 Feb 23 16:29 generate-keys.sh
      -rw-rw-r-- 1 andy andy 969 Mar 16 15:05 server.crt
      -rw-rw-r-- 1 andy andy 891 Mar 16 15:05 server.csr
      -rw-rw-r-- 1 andy andy 1704 Mar 16 15:05 server.key


The generate-keys.sh script will generate keys and certs for the “restconf” site. You can use the keys created by this script to setup TLS for your restconf site as described in Section 4 of this document.


Copy the certificates to their proper places:



    buildcerts> sudo cp ca.crt /usr/local/share/ca-certificates/
    buildcerts> cp server.crt $HOME/certs/
    buildcerts> cp server.key $HOME/certs/


Go to the /etc/ssl/certs directory, run updates and check the results:



    buildcerts> cd /etc/ssl/certs
    /etc/ssl/certs> sudo update-ca-certificates


    /etc/ssl/certs> ls -l | grep ca.crt
lrwxrwxrwx 1 root root 39 Mar 16 15:52 ca.pem -> /usr/local/share/cacertificates/ca.crt
   


The script update-ca-certificates uses the ca-certificates package. If you do not have this package on your system, for example if you are building a minimal footprint system, then the following steps, instead of the section above, will create the required certificate links:

buildcerts> mkdir temp
buildcerts> sudo ln -s /usr/local/share/ca-certificates/ca.crt temp/ca.pem
buildcerts> sudo c_rehash temp
Doing temp
buildcerts> sudo mv temp/* /etc/ssl/certs
buildcerts> ls -l /etc/ssl/certs | grep ca.pem
lrwxrwxrwx 1 root root 6 Mar 16 08:00 56c899cd.0 -> ca.pem
lrwxrwxrwx 1 root root 6 Mar 16 08:00 b2457b50.0 -> ca.pem
lrwxrwxrwx 1 root root 39 Mar 16 08:00 ca.pem -> /usr/local/share/ca-certificates/ca.crt
buildcerts>



Generate the client Fingerprint:



    certs> cd $HOME/buildcerts
    buildcerts> openssl x509 -noout -fingerprint -sha1 -inform pem -in client.crt


    SHA1 Fingerprint=4B:A7:05:1E:12:F7:BC:FF:2D:9E:48:66:0A:8B:CC:D7:A5:65:E5:97



Next you need to configure the server with the parameters needed to use TLS by editing the netconfd-pro.conf file. If you have an existing netconfd-pro.conf then add the four parameter lines, within “netconfd-pro {“ and “}”, to the existing file. If you don’t have an existing netconfd-pro.conf file then run your editor as shown and a netconfd-pro.conf file will be created, then add the lines shown.


NOTE: the cert-usermap parameter required for netconfd-pro.conf will be <YOUR_USERNAME>@<first_six_pairs_of_the_SHA1_Fingerprint> from the “Generate the client Fingerprint:” step above.
For example if user=andy creates the SHA1 Fingerprint then the cert-usermap parameter line will be:

    cert-usermap andy@4B:A7:05:1E:12:F7



    buildcerts> <your_editor> /etc/yumapro/netconfd-pro.conf


Replace <your_editor> with the editor of your choice such as vi, vim, emacs, gedit, etc.


Add following four parameters lines, substituting cert-usermap with your version – see above:



    netconfd-pro {
       with-netconf-tls true
       netconf-tls-certificate ~/certs/server.crt
       netconf-tls-key ~/certs/server.key
       cert-usermap <YOUR_USERNAME>@<first_six_pairs_of_the_SHA1_Fingerprint>
}



Client Setup


On the client create a couple of directories for working with the certificates:



    CLIENT:

     mydir> mkdir $HOME/buildcerts
     mydir> mkdir $HOME/certs


On the server copy the files you created to the client machine using sftp:



    SERVER:

     mydir> cd $HOME/buildcerts
     buildcerts> sftp CLIENT_USERNAME@CLIENT
     sftp> cd buildcerts
     sftp> put *
     sftp> bye


Now copy the certificates on the client to their proper places:



    CLIENT:
    
     mydir> cd $HOME/buildcerts
     buildcerts> sudo cp ca.crt /usr/local/share/ca-certificates
     buildcerts> cp client.crt $HOME/certs/
     buildcerts> cp client.key $HOME/certs/


Go to the /etc/ssl/certs directory, run updates and check the results:



    CLIENT:

     buildcerts> cd /etc/ssl/certs
     certs> sudo update-ca-certificates

     certs> ls -l | grep ca.crt
lrwxrwxrwx 1 root root 39 Mar 16 16:25 ca.pem -> /usr/local/share/cacertificates/ca.crt


Similarly, if you do not have the ca-certificates package see the note in the Server Setup section above on using c_rehash.


Next you need to configure the client with the parameters needed to use TLS by editing the yangcli-pro.conf file. If you have an existing yangcli-pro.conf then add the two parameter lines, within “yangcli-pro {“ and “}”, to the existing file. If you don’t have an existing yangcli-pro.conf file then run your editor as shown and a yangcli-pro.conf file will be created, then add the lines shown.



    
     buildcerts> <your_editor> /etc/yumapro/yangcli-pro.conf


Replace <your_editor> with the editor of your choice such as vi, vim, emacs, gedit, etc.


Add the following two parameters:



    yangcli-pro {
      ssl-certificate ~/certs/client.crt
      ssl-key ~/certs/client.key
 }



Test the TLS connection


To test the TLS connection run the server as you would normally, for example:



    SERVER:
      
      mydir> netconfd-pro log-level=debug4 access-control=off


Run yangcli-pro on the client and connect using the command show below:



    CLIENT:

      mydir> yangcli-pro
      ...

      > connect user=<andy> server=<SERVER_HOST> no-password transport=tls


NOTE: replace <andy> with your user name and <SERVER_HOST> with the name or address of the host for the server.




Configure a new Client


On the client create a couple of directories for working with the certificates:



    CLIENT:


  mydir> mkdir $HOME/buildcerts
  mydir> mkdir $HOME/certs



On the server copy the files you created to the client machine using sftp but this time we do not need old client keys and certificates, we will generate a completely new client keys with a new fingerprint.



    SERVER:

    mydir> cd $HOME/buildcerts
    buildcerts> sftp CLIENT_USERNAME@CLIENT
    sftp> cd buildcerts
    sftp> put *
    sftp> bye
    mydir> rm client.*
    mydir> rm server.*


Generate the client keys:



    CLIENT:

    mydir> cd $HOME/buildcerts

    # Generate Client Private Key
    buildcerts> openssl req -newkey rsa:2048 -nodes -keyout client.key -subj \
    /C=cl/ST=cl/L=cl/O=cl/CN=client.com

    # Generate Req
    buildcerts> openssl req -key client.key -new -out client.csr -subj \
    /C=cl/ST=cl/L=cl/O=cl/CN=client.com

    # Generate x509 with signed CA
    buildcerts> openssl x509 -req -in client.csr -CA ca.crt -CAkey ca.key \
    -out client.crt

    buildcerts> ls
    ca.crt  ca.csr  ca.key  ca.srl  client.crt  client.csr  client.key



Now copy the certificates on the client to their proper places:



    CLIENT:

    mydir> cd $HOME/buildcerts
    buildcerts> sudo cp ca.crt /usr/local/share/ca-certificates
    buildcerts> cp client.crt $HOME/certs/
    buildcerts> cp client.key $HOME/certs/


Generate the client Fingerprint:



    certs> cd $HOME/buildcerts
    buildcerts> openssl x509 -noout -fingerprint -sha1 -inform pem -in client.crt


    SHA1 Fingerprint=4B:A7:05:1E:12:F7:BC:FF:2D:9E:48:66:0A:8B:CC:D7:A5:65:E5:97



Add this new fingerprint to the netconfd-pro server configuration file, substituting cert-usermap with your version – see above. Refer to the server setup above for more details:



    netconfd-pro {
      with-netconf-tls true
      netconf-tls-certificate ~/certs/server.crt
      netconf-tls-key ~/certs/server.key
      cert-usermap <FIRST_CLIENT>@4B:A7:05:1E:12:F7
      cert-usermap <NEXT_CLIENT>@4B:A7:05:1E:12:F7
}


Go to the /etc/ssl/certs directory, run updates and check the results:



    CLIENT:
 
     buildcerts> cd /etc/ssl/certs
     certs> sudo update-ca-certificates 

If nothing is updated, try to remove ca.pem first and re-run update command:
     certs> sudo rm ca.pem
     certs> ls -l | grep ca.crt
lrwxrwxrwx 1 root root 39 Mar 16 16:25 ca.pem -> /usr/local/share/cacertificates/ca.crt



Similarly, if you do not have the ca-certificates package see the note in the Server Setup section above on using c_rehash.


Next you need to configure the client with the parameters needed to use TLS by editing the yangcli-pro.conf file. If you have an existing yangcli-pro.conf then add the two parameter lines, within “yangcli-pro {“ and “}”, to the existing file. If you don’t have an existing yangcli-pro.conf file then run your editor as shown and a yangcli-pro.conf file will be created, then add the lines shown.



    buildcerts> <your_editor> /etc/yumapro/yangcli-pro.conf


Replace <your_editor> with the editor of your choice such as vi, vim, emacs, gedit, etc.


Add the following two parameters:



    yangcli-pro {
      ssl-certificate ~/certs/client.crt
      ssl-key ~/certs/client.key
}