To enable TLS communication between MDM and managed NEs, you must deploy a signed TLS certificate to each MDM-managed device that supports gRPC TLS, and import the CA certificates that allow MDM to validate that NE certificate. While it is possible to have more than one CA certificate added to each MDM truststore, to maintain network security it is preferable to limit the number of CA certificates to the minimum required.

You can also enable mutual TLS authentication ( mTLS) on the network mediation interface of the NSP clusters.

The following steps describe how to secure the following NSP communication with NEs by importing a TLS certificate:

• telemetry

• gNMI on_change notifications

CA certificates and certificate chains for gRPC TLS

In one-way TLS between NSP and the NE, the NE acts as the TLS server and MDM acts as the TLS client. MDM must trust the certificate chain presented by the NE: the truststore must contain every certificate required to build a certification path from the NE leaf certificate to a trusted anchor (PKIX validation).

If the NE leaf certificate is issued by an intermediate CA, importing only the root CA into the MDM truststore is often insufficient. Import the intermediate CA certificate (or certificates) as well as the root. You can concatenate intermediate and root PEM files into a single PEM file for placement under tls/telemetry, or place separate PEM files in that directory and import each certificate into the MDM truststore using a distinct keytool alias.

Before you import certificates into MDM, you can verify the chain against the NE certificate with OpenSSL; for example:

# openssl verify -CAfile root_CA.pem -untrusted intermediate_CA.pem node.pem ↵

where root_CA.pem is the trust anchor, intermediate_CA.pem is the issuing intermediate (add another -untrusted option for each additional intermediate), and node.pem is the NE TLS certificate.

When you run keytool -importcert on a PEM file, only the first certificate in the file is typically imported. If a PEM file contains multiple certificates, split the file or import each certificate from a separate PEM file using a separate alias.

Some deployments have required both a combined chain PEM file and the root CA PEM file to remain in tls/telemetry for nspdeployerctl install --config --deploy to process telemetry TLS material as expected. If certificate deployment or gRPC TLS fails after you add only a chain file, add the root CA PEM in the same directory and retry the deploy step, or contact Nokia technical support for your NSP release.

You must perform the procedure on each NSP cluster in a DR deployment.

The TLS certificates for gRPC mediation are separate from the certificates used for internal NSP component communication and NSP client communication.

release-ID in a file path has the following format:

R.r.p-rel.version

where

R.r.p is the NSP release, in the form MAJOR.minor.patch

version is a numeric value