Use Custom Certificates on the Cisco IR1821/IR1101

Step 1: Replace ICSP - Command Center certificates

Follow the Replace ICSP - Command Center certificates section of the eyeInspect Custom Certificates Guide.

Step 2: Replace Active Sensor certificates

To replace the Active Sensor certificates, do the following:

1. Download the new certificates generated in the previous section (Replace ICSP - Command Center certificates):

   1. custom_ca.crt

   2. custom_cert.pem

   3. custom_key.pem

2. Launch a web browser and enter the IP address configured for the connected interface of Cisco IR1821/IR1101.

3. From the left navigation bar, navigate to Administration>Management and select File Manager.

4. Select the bootflash: folder.

5. Select the SHARED-IOX folder. If this folder does not exist, create a new folder and adjust the configurations consistently across all related steps.

6. Click Upload on the top right corner.

7. Browse for the certificates downloaded in step 1 and upload them.

8. Navigate to the Cisco IR1821/IR1101 Local Manager WebUI.

9. Navigate to Configuration > Services > IOx. Login using admin account credentials.

10. If the application is running/paused, click Stop from the Applications tab. If the application is not configured, follow the instructions on the Deploy an Active Sensor on Cisco IR1821/IR1101 via the GUI page - the Custom Certificates are added in Step 4 on this page.

11. Click Deactivate, and then Activate to open the application settings.

12. From Resources > Advanced Settings, enter the below docker options to refer to the correct certificates.

    IR1821:

    -e ICSP_CC_IP=<CommandCenter_Address> --cap-add=NET_ADMIN
    -v /bootflash/SHARED-IOX:/opt/active-sensor/db
    -e CA_FILE=db/certs/custom_ca.crt
    -e CERT_FILE=db/certs/custom_cert.pem
    -e KEY_FILE=db/certs/custom_key.pem

    IR1101:

    -e ICSP_CC_IP=<CommandCenter_Address> --cap-add=NET_ADMIN
    -v /flash1/iox/iox_host_data_share:/opt/active-sensor/db
    -e CA_FILE=db/certs/custom_ca.crt
    -e CERT_FILE=db/certs/custom_cert.pem
    -e KEY_FILE=db/certs/custom_key.pem

    Replace <CommandCenter_Address> with the IP address/hostname of the command center where the active sensor should be enrolled.

13. Go to the Deploy an Active Sensor on Cisco IR1821/IR1101 via the GUI page and follow steps 5 to 8.

Step 3: Reset API key

Follow the Reset API Key section of the eyeInspect Custom Certificates Guide.