topic Re: OpenFlow Instance with TLS -- how to create Certificate for OpenFlow? in Software Defined Networking

OpenFlow Instance with TLS -- how to create Certificate for OpenFlow?

RGBD — Wed, 29 Jan 2014 17:09:06 GMT

I get this error when trying to configure my OF instance on PV 3800 (KA_15_14):

3800B(config)# openflow instance vpatch controller-id 1 secure
Certificate for OpenFlow is not configured.
3800B(config)#

I tried to create self-signed cert from the web UI, but no luck.

Does anyone have the process for creating/getting the correct cert and installing?

The config guide just says you need one and is not specific on how to configure it.

Re: OpenFlow Instance with TLS -- how to create Certificate for OpenFlow?

EricAtHP — Wed, 29 Jan 2014 18:58:11 GMT

First, if you are using the HP controller, the certificate used on the switch must be the signed by the same CA as the cert on the controller. So a self-signed cert won't work.

To install a CA signed cert on a provision based switch:

Set the time correctly (either manually or with SNTP/Timep)
Configure the identity of the switche with "crypto pki identity-profile"
Generate a CSR with "crypto pki create-csr" make sure you use the "usage" option in the command and specify "all" or "openflow"
Then take the CSR to a CA of your choice
Install the resulting certificate onto the switch with "crypto pki install-signed-certificate"

These commands are just the beginning of the command, use tab or ? to complete the command.

Hope that helps.

Re: OpenFlow Instance with TLS -- how to create Certificate for OpenFlow?

sdnindia — Wed, 05 Feb 2014 11:34:27 GMT

Hello,

Just following up to see if the previous post answers your query.

Please feel free to reply incase you have more questions around the same topic or open a new thread if new topic.
If you feel we have answered your question, please do let us know by marking this response as an 'accepted solution’.

Thanks
HP SDN Team