Skip to content
Docs

Aruba AOS-S setup

This process prepares an Aruba AOS-S switch for SSL connectivity using a domain CA, and enabling the REST API.

Export CA Certificate

Section titled “Export CA Certificate”

First, export the CA public certificate from certmgr:

  • Trusted Root Certification Authority\Certificates\<domain-ca>
    → All Tasks → Export
    → Base-64 encoded X.509 (.CER)

  • Name it:

DOMAIN_CA.cer

Reset Key Configuration (Optional)

Section titled “Reset Key Configuration (Optional)”

If needed:

Terminal window
crypto pki zeroize

Configure Switch Identity

Section titled “Configure Switch Identity”

Give the switch an FQDN:

Terminal window
conf t
hostname "SwitchName"
ip dns domain-name ad.domain.com

Create TA Profile

Section titled “Create TA Profile”

Create a ta-profile and import the CA certificate:

Terminal window
crypto pki ta-profile DOMAIN_CA
copy tftp ta-certificate DOMAIN_CA <TFTP-server-IP> DOMAIN_CA.cer

Verify installation:

Terminal window
show crypto pki ta-profile DOMAIN_CA

The Profile Status should change from:

  • pending → certificate installed

Generate CSR

Section titled “Generate CSR”

Create a certificate signing request (CSR):

Terminal window
crypto pki create-csr certificate-name ssl-cert ta-profile DOMAIN_CA usage web key-type rsa key-size 2048 subject common-name SwitchName.ad.domain.com

Copy the generated Base64-encoded CSR.

Submit CSR to CA

Section titled “Submit CSR to CA”

Navigate to:

http://<domain-ca>/certsrv/certrqxt.asp
  • Paste the CSR into the request box
  • In Additional Attributes, add:
san:dns=SwitchName.ad.domain.com&ipaddress=12.34.56.78

(use the LAN IP)

  • Select:
    • Template → SSL Certificate
  • Click:
    • Submit >

After issuance:

  • Select:
    • Base 64 encoded
  • Click:
    • Download certificate

Prepare Certificate

Section titled “Prepare Certificate”
  • Open certnew.cer in Notepad
  • Copy the encoded certificate text to clipboard

Install Signed Certificate

Section titled “Install Signed Certificate”

Install the certificate on the switch:

Terminal window
crypto pki install-signed-certificate
  • Paste the certificate when prompted
  • Press ENTER

Enforce SSL Management

Section titled “Enforce SSL Management”

Force web management and REST API over SSL:

Terminal window
no web-management plaintext
web-management ssl
rest-interface

Enable RADIUS (Optional)

Section titled “Enable RADIUS (Optional)”

To enable RADIUS authentication via the REST API:

Terminal window
aaa authentication rest login radius local
aaa authentication rest enable radius local

Legacy Firmware Note (16.10.x.x)

Section titled “Legacy Firmware Note (16.10.x.x)”

For older firmware (e.g. 2920 series), create a local user matching the service account:

Terminal window
password manager user-name portweaver plaintext <password>