Cisco NX-OS: gNOI endpoint does not support `LoadCertificateAuthorityBundleRequest`

[swagner-de]

Problem Statement

The Cisco NXOS Generic Network Operations Interface (gNOI) lacks support for the LoadCertificateAuthorityBundleRequest endpoint, which prevents the installation of Certificate Authority (CA) certificates. This is a major roadblock when implementing gRPC with Mutual TLS authentication, as it requires the CA certificate to be installed on devices.

Vendor Acknowledgement

Cisco has acknowledged this problem and filled CSCwr90920 (login required); however, the bug report refers to LoadCertificteBundleRequest, which does not exist in the gNOI specification. A tentative ETA of end of 2026 for release 10.7.2 was suggested.

Proposed Solution

As an interim solution, we propose using the initial bootscript to deploy the CA bundle and then installing/rotating certificates via NXAPI (CLI over HTTP). This approach allows for automation of certificate management while circumventing the limitation in Cisco's gNOI implementation.