Certificate management

As more and more services move to "secure by default" behavior, it becomes important to simplify the PKI/TLS infrastructure provisioning in the lab environments. Containerlab embeds parts of cfssl project to automate certificate generation and provisioning.

For SR Linux nodes containerlab creates Certificate Authority (CA) and generates signed cert and key for each node of a lab. This makes SR Linux node to boot up with TLS profiles correctly configured and enable operation of a secured management protocol - gNMI.

Note

For other nodes the automated TLS pipeline is not provided yet and can be addressed by contributors.

Apart from automated pipeline for certificate provisioning, containerlab exposes the following commands that can create a CA and node's cert/key:

tools cert ca create - creates a Certificate Authority
tools cert sign - creates certificate/key for a host and signs the certificate with CA

With these two commands users can easily create CA node certificates and secure the transport channel of various protocols. This lab demonstrates how with containerlab's help one can easily create certificates and configure Nokia SR OS to use it for secured gNMI communication.