From 7ac3c496ecac9a311e331ecd6f64959ca42143b5 Mon Sep 17 00:00:00 2001 From: Chris Date: Mon, 10 Aug 2026 09:28:37 -0400 Subject: [PATCH 1/4] adding info about IP SAN requirement for CA cert used in SCO. --- docs/sec-conductor-onboard.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/docs/sec-conductor-onboard.md b/docs/sec-conductor-onboard.md index a79863beeb5..218bb1dafea 100644 --- a/docs/sec-conductor-onboard.md +++ b/docs/sec-conductor-onboard.md @@ -28,6 +28,10 @@ To provide a secure and mutually authenticated onboarding mechanism, the followi The public certificate and CA certificate are configured on the conductor at the Authority level. +Secure Conductor Onboarding requires the use of an IP SAN (subject alternative name) for each router that is onboarding to the conductor. This requires that the certificate issued by the CA includes includes the IP SAN, which allows the conductor to perform validation and authentication. + +For additional information about certificates, see [Certificate Requirements and Validation](cert_validation_requirements.md). + ## Basic Configuration The following information are the steps to configure and use Secure Conductor Onboarding. For details about any of the commands and steps, see [How It Works](#how-it-works) From 5681b6a01328498a2fc2f15aee2011e781ab1869 Mon Sep 17 00:00:00 2001 From: Chris Date: Mon, 10 Aug 2026 14:14:14 -0400 Subject: [PATCH 2/4] updates per review --- docs/sec-conductor-onboard.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/sec-conductor-onboard.md b/docs/sec-conductor-onboard.md index 218bb1dafea..ed37c233d6b 100644 --- a/docs/sec-conductor-onboard.md +++ b/docs/sec-conductor-onboard.md @@ -28,9 +28,11 @@ To provide a secure and mutually authenticated onboarding mechanism, the followi The public certificate and CA certificate are configured on the conductor at the Authority level. -Secure Conductor Onboarding requires the use of an IP SAN (subject alternative name) for each router that is onboarding to the conductor. This requires that the certificate issued by the CA includes includes the IP SAN, which allows the conductor to perform validation and authentication. +Secure Conductor Onboarding requires the use of an IP SAN (subject alternative name) for routers to securely identify the conductor's identity. This requires that the certificate issued by the CA includes the IP SAN for the conductor, allowing the router to validate the connection to the conductor and securely onboard. -For additional information about certificates, see [Certificate Requirements and Validation](cert_validation_requirements.md). +For an HA conductor, each node must have an separate IP SAN entry. + +For additional information about certificates, see [Certificate Requirements and Validation](cert_validation_requirements.md). For details on the IP SAN naming and configuration, see [Issue a `certificate-signing-request`](config_custom_certs#issue-a-certificate-signing-request.md). ## Basic Configuration From e5f97bd9c7c6b6b4585083b6b17ff09e32eb4b24 Mon Sep 17 00:00:00 2001 From: Chris Date: Mon, 10 Aug 2026 14:30:08 -0400 Subject: [PATCH 3/4] had the file extension in the wrong place... --- docs/sec-conductor-onboard.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/sec-conductor-onboard.md b/docs/sec-conductor-onboard.md index ed37c233d6b..bc639835cea 100644 --- a/docs/sec-conductor-onboard.md +++ b/docs/sec-conductor-onboard.md @@ -32,7 +32,7 @@ Secure Conductor Onboarding requires the use of an IP SAN (subject alternative n For an HA conductor, each node must have an separate IP SAN entry. -For additional information about certificates, see [Certificate Requirements and Validation](cert_validation_requirements.md). For details on the IP SAN naming and configuration, see [Issue a `certificate-signing-request`](config_custom_certs#issue-a-certificate-signing-request.md). +For additional information about certificates, see [Certificate Requirements and Validation](cert_validation_requirements.md). For details on the IP SAN naming and configuration, see [Issue a `certificate-signing-request`](config_custom_certs.md#issue-a-certificate-signing-request). ## Basic Configuration From bfab5c81ccaf358e86e6b89fc5ecdf0c0bcc2b9c Mon Sep 17 00:00:00 2001 From: Chris Date: Wed, 12 Aug 2026 15:10:27 -0400 Subject: [PATCH 4/4] updating with additional command information, as well as the re-onboarding procedure from I95-65820. --- docs/sec-conductor-onboard.md | 62 +++++++++++++++++++++++++++++++++++ 1 file changed, 62 insertions(+) diff --git a/docs/sec-conductor-onboard.md b/docs/sec-conductor-onboard.md index bc639835cea..86f20cd2273 100644 --- a/docs/sec-conductor-onboard.md +++ b/docs/sec-conductor-onboard.md @@ -30,6 +30,8 @@ The public certificate and CA certificate are configured on the conductor at the Secure Conductor Onboarding requires the use of an IP SAN (subject alternative name) for routers to securely identify the conductor's identity. This requires that the certificate issued by the CA includes the IP SAN for the conductor, allowing the router to validate the connection to the conductor and securely onboard. +The IP SAN should be incuded under the `authority -> conductor-address` list, which specifies addresses routers should use to reach the conductor. + For an HA conductor, each node must have an separate IP SAN entry. For additional information about certificates, see [Certificate Requirements and Validation](cert_validation_requirements.md). For details on the IP SAN naming and configuration, see [Issue a `certificate-signing-request`](config_custom_certs.md#issue-a-certificate-signing-request). @@ -109,6 +111,66 @@ Once the Secure Conductor Onboarding workflow is initiated, the router performs Once the secure SSH tunnels are established, the SCO workflow concludes. All future communication between the router and conductor will occur over port 930. +### Re-Onboarding Workflow + +Secure Cloud Onboarding (SCO) re-onboarding may be necessary when a router is factory reset and fails to re-onboard because the conductor identifies it as **already onboarded**. This may also occur in scenarios involving transitions from non-SCO to SCO environments. + +1. Rename the asset ID. + +`config authority router node asset-id -temp` + +The conductor processes the removal of the original asset ID and cleans up the associated content. The asset is then removed from the `show assets` list. + +2. Check the show assets command ouptut to verify the original ID is no longer present. + +``` +admin@node0.Conductor# show assets Spoke1Node0 +Mon 2026-08-10 18:29:01 UTC +✔ Retrieving assets... +==================================================== + Spoke1Node0 +==================================================== + Router: Spoke1 + Node: node0 + Current Version: 7.1.6-7.sts.el9 + Platform: OpenStack Nova + Install Type: Image + Status: Synchronized + Conductor Connectivity: Connected + Peer Conductor Connectivity: Connected + Service Status: Running + First Connection Date: 2026-08-03 19:03:19 + Time in Status: 2h 34m 41s +Completed in 0.14 seconds +admin@node0.Conductor# show assets Spoke1Node0 +Mon 2026-08-10 18:29:06 UTC +✖ Retrieving assets... +% Error: Failed to retrieve assets: Asset id 'Spoke1Node0' does not exist + +``` + +3. Restore the original asset ID. + + `config authority router node asset-id ` + + The conductor is ready for the device to re-onboard. Verify this using `show secure-conductor-onboarding ` + +``` +admin@node0.Conductor# show secure-conductor-onboarding +Mon 2026-08-10 18:43:30 UTC +✔ Retrieving Secure Conductor Onboarding state... +====================================== + Secure Conductor Onboarding Detail +====================================== + Asset Id: + Auth State: waiting + Last Problem: + Last Attempt Time: — + Number of Attempts: 0 + Mode: weak/strong +Completed in 0.01 seconds +``` + ### Verifying Onboarding Status In The Conductor UI After SCO is enabled, the conductor GUI **Routers** page displays a **Secure Conductor Onboarding** panel for each node, replacing the legacy asset-id onboarding view. Use this panel to monitor the SCO handshake as it progresses.