{"id":250,"date":"2026-04-27T00:00:00","date_gmt":"2026-04-26T20:30:00","guid":{"rendered":"https:\/\/www.anynet.ir\/blog\/%da%af%d9%88%d8%a7%d9%87%db%8c%d9%87%d8%a7%db%8c-gnsi-%da%86%d8%b1%d8%ae%d9%87-%d8%ad%db%8c%d8%a7%d8%aa-%da%af%d9%88%d8%a7%d9%87%db%8c-tls-%d8%af%d8%b1-cisco-ios-xr\/"},"modified":"2026-04-27T00:00:00","modified_gmt":"2026-04-26T20:30:00","slug":"%da%af%d9%88%d8%a7%d9%87%db%8c%d9%87%d8%a7%db%8c-gnsi-%da%86%d8%b1%d8%ae%d9%87-%d8%ad%db%8c%d8%a7%d8%aa-%da%af%d9%88%d8%a7%d9%87%db%8c-tls-%d8%af%d8%b1-cisco-ios-xr","status":"publish","type":"post","link":"https:\/\/www.anynet.ir\/blog\/%da%af%d9%88%d8%a7%d9%87%db%8c%d9%87%d8%a7%db%8c-gnsi-%da%86%d8%b1%d8%ae%d9%87-%d8%ad%db%8c%d8%a7%d8%aa-%da%af%d9%88%d8%a7%d9%87%db%8c-tls-%d8%af%d8%b1-cisco-ios-xr\/","title":{"rendered":"\u06af\u0648\u0627\u0647\u06cc\u200c\u0647\u0627\u06cc gNSI \u2014 \u0686\u0631\u062e\u0647 \u062d\u06cc\u0627\u062a \u06af\u0648\u0627\u0647\u06cc TLS \u062f\u0631 Cisco IOS XR"},"content":{"rendered":"<div>\n<div>\n<div>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u0645\u0634\u06a9\u0644<\/h2>\n<p style=\"direction: rtl; text-align: right\"><a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/grpc-authorization-with-authz\" style=\"color: rgb(0, 102, 204)\">\u0645\u062c\u0648\u0632\u062f\u0647\u06cc (Authz)<\/a> \u0648 <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/securing-gnmi-with-pathz\" style=\"color: rgb(0, 102, 204)\">\u0645\u0633\u06cc\u0631\u062f\u0647\u06cc (Pathz)<\/a> \u06a9\u0646\u062a\u0631\u0644 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u06a9\u0647 \u06a9\u0644\u0627\u06cc\u0646\u062a\u200c\u0647\u0627 \u062f\u0631 \u0628\u0633\u062a\u0631 gRPC \u0648 gNMI \u0686\u0647 \u0627\u0642\u062f\u0627\u0645\u0627\u062a\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0627\u0646\u062c\u0627\u0645 \u062f\u0647\u0646\u062f\u060c \u0627\u0645\u0627 \u062a\u0645\u0627\u0645\u06cc \u0627\u06cc\u0646 \u0645\u0648\u0627\u0631\u062f \u0628\u0647 \u062a\u0646\u0638\u06cc\u0645 \u0635\u062d\u06cc\u062d TLS \u0648\u0627\u0628\u0633\u062a\u0647 \u0627\u0633\u062a. \u06af\u0648\u0627\u0647\u06cc\u200c\u0647\u0627 (Certificates) \u0645\u0646\u0642\u0636\u06cc \u0645\u06cc\u200c\u0634\u0648\u0646\u062f. \u0628\u0633\u062a\u0647\u200c\u0647\u0627\u06cc \u0627\u0639\u062a\u0645\u0627\u062f (Trust Bundles) \u0642\u062f\u06cc\u0645\u06cc \u0645\u06cc\u200c\u0634\u0648\u0646\u062f. \u0644\u06cc\u0633\u062a\u200c\u0647\u0627\u06cc \u0627\u0628\u0637\u0627\u0644 \u06af\u0648\u0627\u0647\u06cc (CRLs) \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc \u062f\u0627\u0631\u0646\u062f. \u0648 \u0647\u0631 \u06cc\u06a9 \u0627\u0632 \u0627\u06cc\u0646 \u062a\u063a\u06cc\u06cc\u0631\u0627\u062a \u0628\u0627\u06cc\u062f \u0628\u062f\u0648\u0646 \u0642\u0637\u0639 \u0634\u062f\u0646 \u0633\u0631\u0648\u0631 gRPC \u0627\u0646\u062c\u0627\u0645 \u0634\u0648\u062f. \u0628\u0647 \u0637\u0648\u0631 \u0633\u0646\u062a\u06cc\u060c \u0645\u062f\u06cc\u0631\u06cc\u062a \u0645\u0646\u0627\u0628\u0639 TLS \u062f\u0631 IOS XR \u0628\u0647 \u0645\u0639\u0646\u0627\u06cc \u06a9\u067e\u06cc \u06a9\u0631\u062f\u0646 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc PEM \u062f\u0631 \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc \u0645\u0634\u062e\u0635 \u0648 \u0627\u0645\u06cc\u062f \u0628\u0647 \u0642\u0631\u0627\u0631\u06af\u06cc\u0631\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0635\u062d\u06cc\u062d \u062f\u0631 \u062c\u0627\u06cc \u062f\u0631\u0633\u062a \u0628\u0648\u062f. \u0647\u06cc\u0686 API \u0627\u0633\u062a\u0627\u0646\u062f\u0627\u0631\u062f\u06cc \u0628\u0631\u0627\u06cc \u0686\u0631\u062e\u0634 \u06af\u0648\u0627\u0647\u06cc\u200c\u0647\u0627 (Certificate Rotation)\u060c \u0647\u06cc\u0686 \u0642\u0627\u0628\u0644\u06cc\u062a \u0628\u0627\u0632\u06af\u0634\u062a\u06cc (Rollback) \u062f\u0631 \u0635\u0648\u0631\u062a \u0628\u0631\u0648\u0632 \u062e\u0637\u0627 \u0648 \u0647\u06cc\u0686 \u0631\u0648\u0634 \u062a\u0645\u06cc\u0632\u06cc \u0628\u0631\u0627\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a \u0686\u0646\u062f\u06cc\u0646 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 TLS \u0628\u0631 \u0631\u0648\u06cc \u06cc\u06a9 \u062f\u0633\u062a\u06af\u0627\u0647 \u0648\u062c\u0648\u062f \u0646\u062f\u0627\u0634\u062a.<\/p>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">Certz \u0686\u06cc\u0633\u062a\u061f<\/h2>\n<p style=\"direction: rtl; text-align: right\"><a href=\"https:\/\/github.com\/openconfig\/gnsi\/tree\/main\/certz\" style=\"color: rgb(0, 102, 204)\">\u06af\u0648\u0627\u0647\u06cc\u0646\u0627\u0645\u0647\u200c\u0647\u0627\u06cc gNSI<\/a> \u0627\u06cc\u0646 \u0645\u0634\u06a9\u0644 \u0631\u0627 \u0628\u0627 \u062f\u0633\u062a\u0647\u200c\u0628\u0646\u062f\u06cc \u062a\u0645\u0627\u0645 \u0645\u0648\u0627\u0631\u062f \u0645\u0648\u0631\u062f \u0646\u06cc\u0627\u0632 TLS \u062f\u0631<strong style=\"color: rgb(26, 26, 26)\">\u067e\u0631\u0648\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc SSL (SSL Profiles)<\/strong>\u062d\u0644 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0647\u0631 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 \u0634\u0627\u0645\u0644 \u0645\u0648\u0627\u0631\u062f \u0632\u06cc\u0631 \u0627\u0633\u062a:<\/p>\n<ul style=\"direction: rtl; text-align: right\">\n<li><strong style=\"color: rgb(26, 26, 26)\">\u06af\u0648\u0627\u0647\u06cc \u0648 \u06a9\u0644\u06cc\u062f \u062e\u0635\u0648\u0635\u06cc (Private Key)<\/strong>\u2014 \u0645\u0633\u062a\u0646\u062f\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u0633\u0631\u0648\u0631<\/li>\n<li><strong style=\"color: rgb(26, 26, 26)\">\u0628\u0633\u062a\u0647 \u0627\u0639\u062a\u0645\u0627\u062f (Trust Bundle)<\/strong>\u2014 \u0632\u0646\u062c\u06cc\u0631\u0647 \u06af\u0648\u0627\u0647\u06cc \u0645\u0631\u062c\u0639 (CA) \u06a9\u0647 \u06a9\u0644\u0627\u06cc\u0646\u062a\u200c\u0647\u0627 \u0628\u0631\u0627\u06cc \u0627\u0639\u062a\u0628\u0627\u0631\u0633\u0646\u062c\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f<\/li>\n<li><strong style=\"color: rgb(26, 26, 26)\">\u0628\u0633\u062a\u0647 CRL<\/strong>\u2014 \u0644\u06cc\u0633\u062a\u200c\u0647\u0627\u06cc \u0627\u0628\u0637\u0627\u0644 \u06af\u0648\u0627\u0647\u06cc (Certificate Revocation Lists)<\/li>\n<li><strong style=\"color: rgb(26, 26, 26)\">\u0633\u06cc\u0627\u0633\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a (Authentication Policy)<\/strong>\u2014 \u0628\u0631\u0627\u06cc TLS \u0645\u062a\u0642\u0627\u0628\u0644 \u0648 \u0627\u0644\u06af\u0648\u0647\u0627\u06cc \u0645\u0634\u0627\u0628\u0647<\/li>\n<\/ul>\n<p style=\"direction: rtl; text-align: right\">\u0628\u0647 \u062c\u0627\u06cc \u06a9\u067e\u06cc \u06a9\u0631\u062f\u0646 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u060c \u06cc\u06a9 \u06a9\u0646\u062a\u0631\u0644\u0631 (Controller) \u0645\u0637\u0627\u0644\u0628 \u062c\u062f\u06cc\u062f \u0631\u0627 \u0627\u0632 \u0637\u0631\u06cc\u0642 \u06cc\u06a9<strong style=\"color: rgb(26, 26, 26)\">\u0686\u0631\u062e\u0634 (Rotate)<\/strong>\u0641\u0631\u0627\u062e\u0648\u0627\u0646\u06cc \u0631\u0648\u06cc\u0647 \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 (RPC) \u0645\u0631\u062d\u0644\u0647\u200c\u0628\u0646\u062f\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u0622\u0646 \u0631\u0627 \u0627\u0639\u062a\u0628\u0627\u0631\u0633\u0646\u062c\u06cc \u06a9\u0631\u062f\u0647 \u0648 \u0646\u0647\u0627\u06cc\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f \u2014 \u06cc\u0627 \u062c\u0631\u06cc\u0627\u0646 \u0631\u0627 \u0628\u0631\u0627\u06cc \u0628\u0627\u0632\u06af\u0634\u062a \u0628\u0647 \u062d\u0627\u0644\u062a \u0642\u0628\u0644 (Roll back) \u0631\u0647\u0627 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u062f\u0631 IOS XR\u060c<strong style=\"color: rgb(26, 26, 26)\">EMSd<\/strong>\u0642\u0627\u0628\u0644\u06cc\u062a Certz \u0631\u0627 \u067e\u06cc\u0627\u062f\u0647\u200c\u0633\u0627\u0632\u06cc \u06a9\u0631\u062f\u0647 \u0648 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644\u200c\u0647\u0627 \u0631\u0627 \u062f\u0631 \u0645\u0633\u06cc\u0631<code>\/misc\/config\/grpc\/gnsi\/certz\/ssl_profiles\/<\/code>.<\/p>\n<p style=\"direction: rtl; text-align: right\">\u0627\u06cc\u0646 \u0645\u0642\u0627\u0644\u0647 \u0628\u0647 \u0628\u0631\u0631\u0633\u06cc \u067e\u0631\u0648\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc SSL\u060c \u0634\u0634 RPC\u060c \u062f\u0648 \u062c\u0631\u06cc\u0627\u0646 \u0686\u0631\u062e\u0634 (Rotation) \u0633\u0631\u062a\u0627\u0633\u0631\u06cc (CSR \u062a\u0648\u0644\u06cc\u062f \u0634\u062f\u0647 \u062a\u0648\u0633\u0637 \u0631\u0648\u062a\u0631 \u062f\u0631 \u0645\u0642\u0627\u0628\u0644 \u06a9\u0644\u06cc\u062f \u062a\u0648\u0644\u06cc\u062f \u0634\u062f\u0647 \u062a\u0648\u0633\u0637 \u0627\u06cc\u0633\u062a\u06af\u0627\u0647 \u06a9\u0627\u0631\u06cc) \u0648<strong style=\"color: rgb(26, 26, 26)\">grpcurl<\/strong>\u0645\u062b\u0627\u0644\u200c\u0647\u0627 \u0645\u06cc\u200c\u067e\u0631\u062f\u0627\u0632\u062f. \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u062f\u0631 \u0633\u0637\u062d \u0633\u0631\u0648\u06cc\u0633 \u062a\u0648\u0633\u0637 <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/grpc-authorization-with-authz\" style=\"color: rgb(0, 102, 204)\">Authz<\/a>\u061b \u0648 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u062f\u0631 \u0633\u0637\u062d \u0645\u0633\u06cc\u0631 \u062a\u0648\u0633\u0637 <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/securing-gnmi-with-pathz\" style=\"color: rgb(0, 102, 204)\">Pathz<\/a> \u0645\u062f\u06cc\u0631\u06cc\u062a \u0645\u06cc\u200c\u0634\u0648\u062f. Certz \u0627\u0645\u0646\u06cc\u062a \u0644\u0627\u06cc\u0647 \u0627\u0646\u062a\u0642\u0627\u0644 (Transport) \u0631\u0627 \u0642\u0627\u0628\u0644 \u0627\u0639\u062a\u0645\u0627\u062f \u0646\u06af\u0647 \u0645\u06cc\u200c\u062f\u0627\u0631\u062f.<\/p>\n<p style=\"direction: rtl; text-align: right\">\u062f\u0631 \u0686\u0627\u0631\u0686\u0648\u0628 AAA\u060c \u0628\u062e\u0634 Certz \u0646\u0642\u0634<strong style=\"color: rgb(26, 26, 26)\">\u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a (Authentication)<\/strong>\u0631\u0627 \u0628\u0631\u0627\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a gRPC \u0627\u06cc\u0641\u0627 \u0645\u06cc\u200c\u06a9\u0646\u062f\u061b \u0627\u06cc\u0646 \u0628\u062e\u0634 \u0645\u0633\u0626\u0648\u0644 \u0645\u062f\u06cc\u0631\u06cc\u062a \u0645\u062a\u0631\u06cc\u0627\u0644 TLS \u0627\u0633\u062a \u06a9\u0647 \u067e\u06cc\u0634 \u0627\u0632 \u0627\u062c\u0631\u0627\u06cc \u0647\u0631\u06af\u0648\u0646\u0647 \u062a\u0635\u0645\u06cc\u0645 Authz\/Pathz\u060c<em>\u0647\u0648\u06cc\u062a<\/em>\u06a9\u0644\u0627\u06cc\u0646\u062a \u0631\u0627 \u062a\u0623\u06cc\u06cc\u062f \u0645\u06cc\u200c\u06a9\u0646\u062f. (\u0628\u062e\u0634 \u0647\u0645\u062a\u0627\u06cc \u0622\u0646 \u06cc\u0639\u0646\u06cc <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/gnsi-credentialz-ssh-credential-rotation-on-cisco-ios-xr\" style=\"color: rgb(0, 102, 204)\">Credentialz<\/a> \u0646\u0642\u0634 \u0645\u0634\u0627\u0628\u0647\u06cc \u0631\u0627 \u0628\u0631\u0627\u06cc \u0628\u062e\u0634 SSH \u0627\u06cc\u0641\u0627 \u0645\u06cc\u200c\u06a9\u0646\u062f.)<\/p>\n<hr>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u06af\u0648\u0627\u0647\u06cc\u200c\u0647\u0627 (Certificates) \u062f\u0631 \u0645\u0642\u0627\u06cc\u0633\u0647 \u0628\u0627 gNOI cert<\/h2>\n<p style=\"direction: rtl; text-align: right\">\u0633\u06cc\u0633\u062a\u0645\u200c\u0639\u0627\u0645\u0644 IOS XR \u0645\u062f\u062a\u200c\u0647\u0627\u0633\u062a \u06a9\u0647 \u0627\u0632 gNOI \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f <a href=\"https:\/\/github.com\/openconfig\/gnoi\/tree\/master\/cert\" style=\"color: rgb(0, 102, 204)\"><code>cert.proto<\/code><\/a> \u0628\u0631\u0627\u06cc \u0639\u0645\u0644\u06cc\u0627\u062a \u06af\u0648\u0627\u0647\u06cc (Certificate). \u067e\u0631\u0648\u062a\u06a9\u0644 Certz \u062a\u06a9\u0627\u0645\u0644\u200c\u06cc\u0627\u0641\u062a\u0647 gNSI \u062f\u0631 OpenConfig \u0627\u0633\u062a \u0648 \u062c\u0627\u06cc\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0642\u0627\u0628\u0644\u06cc\u062a\u200c\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f \u062f\u0631 \u0622\u0646 \u067e\u06cc\u0627\u062f\u0647\u200c\u0633\u0627\u0632\u06cc \u0645\u06cc\u200c\u0634\u0648\u0646\u062f. \u062c\u062f\u0648\u0644 \u0632\u06cc\u0631 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u0686\u0631\u0627 \u0627\u067e\u0631\u0627\u062a\u0648\u0631\u0647\u0627 \u0628\u0627\u06cc\u062f \u0627\u0632 \u0631\u0627\u0628\u0637 \u0642\u062f\u06cc\u0645\u06cc \u0628\u0647 \u0633\u0645\u062a Profiles \u0648 Rotate \u0645\u0647\u0627\u062c\u0631\u062a \u06a9\u0646\u0646\u062f:<\/p>\n<table class=\"english-numbers\" style=\"direction: rtl; text-align: right\">\n<thead>\n<tr>\n<th>\u0645\u0648\u0636\u0648\u0639<\/th>\n<th>gNOI<code>cert.proto<\/code>(\u0642\u062f\u06cc\u0645\u06cc)<\/th>\n<th>gNSI<code>certz.proto<\/code><\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u0633\u0627\u0632\u0645\u0627\u0646<\/td>\n<td>\u0634\u0646\u0627\u0633\u0647 \u06af\u0648\u0627\u0647\u06cc (Certificate ID) \u0628\u0631\u0627\u06cc \u0647\u0631 \u0628\u0631\u06af\u061b \u0628\u0647\u200c\u0631\u0648\u0632\u0631\u0633\u0627\u0646\u06cc\u200c\u0647\u0627\u06cc \u0628\u0633\u062a\u0647 CA\u060c \u06cc\u06a9 \u0628\u0633\u062a\u0647 \u0648\u0627\u062d\u062f \u0631\u0627 \u0628\u0627\u0632\u0646\u0648\u06cc\u0633\u06cc \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f<\/td>\n<td>\u062a\u0645\u0627\u0645 \u0645\u0648\u0627\u0631\u062f PKI \u062a\u062d\u062a \u06cc\u06a9 \u0646\u0627\u0645 \u06af\u0631\u0648\u0647\u200c\u0628\u0646\u062f\u06cc \u0634\u062f\u0647\u200c\u0627\u0646\u062f<strong style=\"color: rgb(26, 26, 26)\">\u067e\u0631\u0648\u0641\u0627\u06cc\u0644 SSL<\/strong><\/td>\n<\/tr>\n<tr>\n<td>\u062f\u0631\u062e\u0648\u0627\u0633\u062a \u0627\u0645\u0636\u0627\u06cc \u06af\u0648\u0627\u0647\u06cc (CSR)<\/td>\n<td>\u0639\u062f\u0645 \u0648\u062c\u0648\u062f SAN \u062f\u0631 \u067e\u0627\u0631\u0627\u0645\u062a\u0631\u0647\u0627\u06cc CSR \u062f\u0631 \u0628\u0631\u062e\u06cc \u0627\u0632 \u0627\u0633\u062a\u06a9\u200c\u0647\u0627<\/td>\n<td><strong style=\"color: rgb(26, 26, 26)\">\u0646\u0627\u0645 \u062c\u0627\u06cc\u06af\u0632\u06cc\u0646 \u0645\u0648\u0636\u0648\u0639 (SAN)<\/strong>\u0628\u062e\u0634\u06cc \u0627\u0632<strong style=\"color: rgb(26, 26, 26)\"><code>\u067e\u0627\u0631\u0627\u0645\u062a\u0631\u0647\u0627\u06cc CSR (CSRParams)<\/code><\/strong><\/td>\n<\/tr>\n<tr>\n<td>\u0633\u0637\u062d RPC<\/td>\n<td>\u0646\u0635\u0628 \/ \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc CA \/ \u0627\u0628\u0637\u0627\u0644 \u0628\u0647 \u0639\u0646\u0648\u0627\u0646<strong style=\"color: rgb(26, 26, 26)\">\u062c\u062f\u0627\u06af\u0627\u0646\u0647<\/strong>RPC\u0647\u0627<\/td>\n<td><strong style=\"color: rgb(26, 26, 26)\">\u06cc\u06a9 \u0627\u0633\u062a\u0631\u06cc\u0645\u06cc\u0646\u06af<code>\u0686\u0631\u062e\u0634 (Rotate)<\/code><\/strong>\u062d\u0645\u0644 \u06af\u0648\u0627\u0647\u06cc\u060c \u06a9\u0644\u06cc\u062f\u060c \u0628\u0633\u062a\u0647 \u0627\u0639\u062a\u0645\u0627\u062f (Trust Bundle) \u0648 CRL \u062f\u0631<strong style=\"color: rgb(26, 26, 26)\"><code>\u062f\u0631\u062e\u0648\u0627\u0633\u062a \u0622\u067e\u0644\u0648\u062f (UploadRequest)<\/code><\/strong><\/td>\n<\/tr>\n<tr>\n<td>\u0627\u0644\u06af\u0648\u0631\u06cc\u062a\u0645\u200c\u0647\u0627<\/td>\n<td>\u062a\u0627\u0631\u06cc\u062e\u0686\u0647 \u0645\u0628\u062a\u0646\u06cc \u0628\u0631 RSA<\/td>\n<td><strong style=\"color: rgb(26, 26, 26)\">RSA, ECDSA, Ed25519<\/strong>\u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc \u0634\u062f\u0647<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p style=\"direction: rtl; text-align: right\">\u062c\u0647\u062a\u200c\u06af\u06cc\u0631\u06cc \u0635\u0646\u0639\u062a\u060c \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 gNOI<code>cert.proto<\/code>\u0631\u0627 \u0645\u0646\u0633\u0648\u062e (Deprecated) \u0645\u06cc\u200c\u062f\u0627\u0646\u062f. \u062f\u0631 \u067e\u06cc\u0627\u062f\u0647\u200c\u0633\u0627\u0632\u06cc\u200c\u0647\u0627\u06cc \u062c\u062f\u06cc\u062f \u0628\u0627\u06cc\u062f \u0627\u0632 Certz \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u0648\u062f.<\/p>\n<hr>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u067e\u0631\u0648\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc SSL \u062f\u0631 IOS XR<\/h2>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u067e\u0631\u0648\u0641\u0627\u06cc\u0644 SSL (SSL Profile) \u0686\u06cc\u0633\u062a\u061f<\/h3>\n<p style=\"direction: rtl; text-align: right\">\u067e\u0631\u0648\u0641\u0627\u06cc\u0644 SSL \u06cc\u06a9 \u0645\u06a9\u0627\u0646 \u0648\u0627\u062d\u062f \u0627\u0633\u062a \u06a9\u0647 \u0631\u0648\u062a\u0631 (Router) \u0647\u0646\u06af\u0627\u0645 \u0631\u0627\u0647\u200c\u0627\u0646\u062f\u0627\u0632\u06cc gRPC\u060c \u0628\u0631\u0627\u06cc \u06cc\u0627\u0641\u062a\u0646 \u00ab\u0647\u0631 \u0622\u0646\u0686\u0647 TLS \u0646\u06cc\u0627\u0632 \u062f\u0627\u0631\u062f\u00bb \u0628\u0647 \u0622\u0646 \u0645\u0631\u0627\u062c\u0639\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f:<\/p>\n<ul style=\"direction: rtl; text-align: right\">\n<li><strong style=\"color: rgb(26, 26, 26)\">\u0645\u0648\u0627\u062f \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a (Authentication Material)<\/strong>\u2014 \u06af\u0648\u0627\u0647\u06cc\u200c\u0646\u0627\u0645\u0647 (Certificate) \u0628\u0631\u06af \u0648 \u06a9\u0644\u06cc\u062f \u062e\u0635\u0648\u0635\u06cc (Private Key) \u0622\u0646<\/li>\n<li><strong style=\"color: rgb(26, 26, 26)\">\u0644\u0646\u06af\u0631\u0647\u0627\u06cc \u0627\u0639\u062a\u0645\u0627\u062f (Trust Anchors)<\/strong>\u2014 \u0632\u0646\u062c\u06cc\u0631\u0647 \u06af\u0648\u0627\u0647\u06cc CA \u06a9\u0647 \u06a9\u0644\u0627\u06cc\u0646\u062a\u200c\u0647\u0627 \u0628\u0631 \u0627\u0633\u0627\u0633 \u0622\u0646 \u0627\u0639\u062a\u0628\u0627\u0631\u0633\u0646\u062c\u06cc \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f<\/li>\n<li><strong style=\"color: rgb(26, 26, 26)\">\u0627\u0628\u0637\u0627\u0644 (Revocation)<\/strong>\u2014 \u062f\u0633\u062a\u0647\u200c\u0647\u0627\u06cc CRL<\/li>\n<li><strong style=\"color: rgb(26, 26, 26)\">\u0633\u06cc\u0627\u0633\u062a (Policy)<\/strong>\u2014 \u0642\u0644\u0627\u0628\u200c\u0647\u0627\u06cc \u0627\u062e\u062a\u06cc\u0627\u0631\u06cc \u0628\u0631\u0627\u06cc TLS \u0645\u062a\u0642\u0627\u0628\u0644 (\u0628\u0631\u062e\u06cc \u0641\u06cc\u0644\u062f\u0647\u0627 \u0645\u062e\u062a\u0635 \u067e\u0644\u062a\u0641\u0631\u0645 \u0628\u0627\u0642\u06cc \u0645\u06cc\u200c\u0645\u0627\u0646\u0646\u062f\u061b \u06cc\u0627\u062f\u062f\u0627\u0634\u062a\u200c\u0647\u0627\u06cc \u0627\u0646\u062a\u0634\u0627\u0631 (Release Notes) \u0631\u0627 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f)<\/li>\n<\/ul>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u067e\u0631\u0648\u0641\u0627\u06cc\u0644 \u067e\u06cc\u0634\u200c\u0641\u0631\u0636 (Default Profile):<code>gNxI<\/code><\/h3>\n<p style=\"direction: rtl; text-align: right\">\u0633\u0631\u0648\u0631 gRPC \u062f\u0631 IOS XR \u0627\u0632 \u0634\u0646\u0627\u0633\u0647 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 (Profile ID)<code>gNxI<\/code>\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f \u0645\u06af\u0631 \u0627\u06cc\u0646\u06a9\u0647 \u0628\u0647 \u0634\u06a9\u0644 \u062f\u06cc\u06af\u0631\u06cc \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0634\u062f\u0647 \u0628\u0627\u0634\u062f. \u062f\u0631<code>RotateCertificateRequest<\/code>, \u062e\u0627\u0644\u06cc \u06af\u0630\u0627\u0634\u062a\u0646<code>ssl_profile_id<\/code>\u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0628\u0647<code>gNxI<\/code>.<\/p>\n<p style=\"direction: rtl; text-align: right\">\u067e\u0631\u0648\u0641\u0627\u06cc\u0644 \u0645\u062a\u0635\u0644 \u0628\u0647 \u0633\u0631\u0648\u0631 \u0641\u0639\u0627\u0644 gRPC \u0642\u0627\u0628\u0644 \u062d\u0630\u0641 \u0646\u06cc\u0633\u062a \u2014<code>DeleteProfile<\/code>\u06cc\u06a9 \u062e\u0637\u0627 \u0628\u0631\u0645\u06cc\u200c\u06af\u0631\u062f\u0627\u0646\u062f.<\/p>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u0645\u0627\u0646\u062f\u06af\u0627\u0631\u06cc \u0631\u0648\u06cc \u062f\u06cc\u0633\u06a9 (On-disk Persistence)<\/h3>\n<p style=\"direction: rtl; text-align: right\">\u0633\u06cc\u0633\u062a\u0645\u200c\u0639\u0627\u0645\u0644 IOS XR \u067e\u0631\u0648\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc SSL Certz \u0631\u0627 \u062f\u0631 \u0645\u0633\u06cc\u0631 \u0632\u06cc\u0631 \u0630\u062e\u06cc\u0631\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f:<\/p>\n<pre><code><span>\/misc\/config\/grpc\/gnsi\/certz\/ssl_profiles\/&lt;ssl_profile_id&gt;\/\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u0645\u062a\u0627\u062f\u06cc\u062a\u0627\u0647\u0627\u06cc\u06cc \u0645\u0627\u0646\u0646\u062f<code>\u0646\u0633\u062e\u0647 (version)<\/code>\u0648<code>\u062a\u0627\u0631\u06cc\u062e \u0627\u06cc\u062c\u0627\u062f (created_on)<\/code>\u062f\u0631 \u06a9\u0646\u0627\u0631 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc PEM \u0628\u0647 \u0635\u0648\u0631\u062a JSON \u0630\u062e\u06cc\u0631\u0647 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f. \u0647\u0645\u06af\u0627\u0645\u200c\u0633\u0627\u0632\u06cc (Synchronization) \u067e\u0631\u062f\u0627\u0632\u0646\u062f\u0647 \u0631\u0632\u0631\u0648 (Standby RP) \u0628\u0631\u0627\u06cc \u062a\u0645\u0627\u0645\u06cc \u0645\u0648\u0627\u0631\u062f \u062a\u062d\u062a \u0645\u0633\u06cc\u0631<code>\/misc\/config\/grpc\/gnsi\/<\/code>\u0627\u0632 \u0637\u0631\u06cc\u0642 RDSFS \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u0634\u0648\u062f. \u0641\u0631\u0622\u06cc\u0646\u062f \u062a\u063a\u06cc\u06cc\u0631 \u0645\u0633\u06cc\u0631 (Failover) \u0648 \u0631\u0627\u0647\u200c\u0627\u0646\u062f\u0627\u0632\u06cc \u0645\u062c\u062f\u062f EMSd \u0628\u0647 \u062d\u0641\u0638 \u06cc\u06a9\u067e\u0627\u0631\u0686\u06af\u06cc \u0622\u0646 \u062f\u0631\u062e\u062a \u062f\u0627\u06cc\u0631\u06a9\u062a\u0648\u0631\u06cc \u0648\u0627\u0628\u0633\u062a\u0647 \u0627\u0633\u062a.<\/p>\n<hr>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">RPC\u0647\u0627\u06cc Certz<\/h2>\n<table class=\"english-numbers\" style=\"direction: rtl; text-align: right\">\n<thead>\n<tr>\n<th>RPC<\/th>\n<th>\u0646\u0648\u0639<\/th>\n<th>\u0639\u0645\u0644\u06a9\u0631\u062f<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><code>GetProfileList<\/code><\/td>\n<td>\u06cc\u06a9\u200c\u0637\u0631\u0641\u0647 (Unary)<\/td>\n<td>\u0641\u0647\u0631\u0633\u062a \u06a9\u0631\u062f\u0646 \u062a\u0645\u0627\u0645<code>ssl_profile_id<\/code>\u0645\u0648\u062c\u0648\u062f \u0631\u0648\u06cc \u062f\u0633\u062a\u06af\u0627\u0647<\/td>\n<\/tr>\n<tr>\n<td><code>AddProfile<\/code><\/td>\n<td>\u06cc\u06a9\u200c\u0637\u0631\u0641\u0647 (Unary)<\/td>\n<td>\u0627\u06cc\u062c\u0627\u062f \u06cc\u06a9 \u067e\u0648\u0633\u062a\u0647 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 \u062e\u0627\u0644\u06cc\u061b \u062f\u0627\u062f\u0647\u200c\u0647\u0627 \u0627\u0632 \u0637\u0631\u06cc\u0642<code>Rotate<\/code><\/td>\n<\/tr>\n<tr>\n<td><code>CanGenerateCSR<\/code><\/td>\n<td>\u06cc\u06a9\u200c\u0637\u0631\u0641\u0647 (Unary)<\/td>\n<td>\u0628\u0631\u0631\u0633\u06cc \u0627\u06cc\u0646\u06a9\u0647 \u0622\u06cc\u0627<code>CSRParams<\/code>\u0627\u0631\u0627\u0626\u0647 \u0634\u062f\u0647 \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc \u0645\u06cc\u200c\u0634\u0648\u0646\u062f<\/td>\n<\/tr>\n<tr>\n<td><code>Rotate<\/code><\/td>\n<td>\u062c\u0631\u06cc\u0627\u0646 \u062f\u0648\u0637\u0631\u0641\u0647 (Bidirectional stream)<\/td>\n<td>\u062a\u0648\u0644\u06cc\u062f \u0627\u062e\u062a\u06cc\u0627\u0631\u06cc CSR\u060c<code>UploadRequest<\/code>\u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc \u062f\u0627\u062f\u0647\u200c\u0647\u0627 (Payloads)\u060c \u0633\u067e\u0633<code>finalize_rotation<\/code><\/td>\n<\/tr>\n<tr>\n<td><code>DeleteProfile<\/code><\/td>\n<td>\u06cc\u06a9\u200c\u0637\u0631\u0641\u0647 (Unary)<\/td>\n<td>\u062d\u0630\u0641 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644\u06cc \u06a9\u0647 \u0628\u0647 \u0633\u0631\u0648\u0631 gRPC \u0641\u0639\u0627\u0644 \u0645\u062a\u0635\u0644 \u0646\u06cc\u0633\u062a<\/td>\n<\/tr>\n<tr>\n<td><code>GetIntegrityManifest<\/code><\/td>\n<td>\u06cc\u06a9\u200c\u0637\u0631\u0641\u0647 (Unary)<\/td>\n<td>\u0645\u0627\u0646\u06cc\u0641\u0633\u062a \u06cc\u06a9\u067e\u0627\u0631\u0686\u06af\u06cc \/ RIM (\u0627\u063a\u0644\u0628<code>\u067e\u06cc\u0627\u062f\u0647\u200c\u0633\u0627\u0632\u06cc \u0646\u0634\u062f\u0647 (Unimplemented)<\/code>\u062f\u0631 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0641\u0639\u0644\u06cc IOS XR)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<blockquote style=\"direction: rtl; text-align: right\">\n<p><strong style=\"color: rgb(26, 26, 26)\">\u062a\u0648\u062c\u0647:<\/strong>\u062a\u0648\u0636\u06cc\u062d \u0633\u0631\u0648\u06cc\u0633 OpenConfig \u0628\u06cc\u0627\u0646 \u0645\u06cc\u200c\u06a9\u0646\u062f \u06a9\u0647 \u062f\u0631 \u0647\u0631 \u0644\u062d\u0638\u0647 \u062a\u0646\u0647\u0627 \u06cc\u06a9 RPC \u0627\u0632 \u0646\u0648\u0639 Certz \u0628\u0627\u06cc\u062f \u0627\u062c\u0631\u0627 \u0634\u0648\u062f. \u062f\u0633\u062a\u0631\u0633\u06cc \u0631\u0627 \u0628\u0647 \u0647\u0645\u0627\u0646 \u0631\u0648\u0634\u06cc \u06a9\u0647 \u0628\u0631\u0627\u06cc <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/grpc-authorization-with-authz\" style=\"color: rgb(0, 102, 204)\">Authz<\/a> Rotate \u06cc\u0627 <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/securing-gnmi-with-pathz\" style=\"color: rgb(0, 102, 204)\">Pathz<\/a> Rotate \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u0633\u0631\u06cc\u0627\u0644\u200c\u0633\u0627\u0632\u06cc (Serialize) \u06a9\u0646\u06cc\u062f.<\/p>\n<\/blockquote>\n<blockquote style=\"direction: rtl; text-align: right\">\n<p><strong style=\"color: rgb(26, 26, 26)\">\u062f\u0631 \u0646\u0633\u062e\u0647 25.3.1:<\/strong><code>grpcurl \u2026 list gnsi.certz.v1.Certz<\/code>\u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f<code>GetIntegrityManifest<\/code>\u060c \u0627\u0645\u0627 \u06cc\u06a9 \u0641\u0631\u0627\u062e\u0648\u0627\u0646\u06cc \u0648\u0627\u0642\u0639\u06cc \u0628\u0631\u0645\u06cc\u200c\u06af\u0631\u062f\u0627\u0646\u062f<code>\u06a9\u062f: \u067e\u06cc\u0627\u062f\u0647\u200c\u0633\u0627\u0632\u06cc \u0646\u0634\u062f\u0647 (Unimplemented)<\/code>. \u0642\u0627\u0628\u0644\u06cc\u062a \u0628\u0627\u0632\u062a\u0627\u0628 (Reflection) \u062a\u0648\u0635\u06cc\u0641\u200c\u06af\u0631 \u0631\u0627 \u062a\u0628\u0644\u06cc\u063a \u0645\u06cc\u200c\u06a9\u0646\u062f\u061b \u0627\u0645\u0627 \u062a\u0636\u0645\u06cc\u0646 \u0646\u0645\u06cc\u200c\u06a9\u0646\u062f \u06a9\u0647 EMSd \u0627\u06cc\u0646 RPC \u0631\u0627 \u067e\u06cc\u0627\u062f\u0647\u200c\u0633\u0627\u0632\u06cc \u06a9\u0631\u062f\u0647 \u0628\u0627\u0634\u062f. \u0647\u0645\u06cc\u0634\u0647 \u0628\u0627 \u06cc\u06a9 \u0641\u0631\u0627\u062e\u0648\u0627\u0646\u06cc \u0648\u0627\u0642\u0639\u06cc \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f.<\/p>\n<\/blockquote>\n<hr>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u0646\u062d\u0648\u0647 \u0639\u0645\u0644\u06a9\u0631\u062f Rotate RPC<\/h2>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u0645\u062f\u0644 \u062a\u0631\u0627\u06a9\u0646\u0634 (Transaction Model)<\/h3>\n<p style=\"direction: rtl; text-align: right\">Rotate \u06cc\u06a9 \u062a\u0631\u0627\u06a9\u0646\u0634 \u0627\u0633\u062a\u0631\u06cc\u0645\u200c\u0634\u062f\u0647 \u0628\u0631\u0627\u06cc \u06cc\u06a9 \u0645\u0648\u0631\u062f \u0627\u0633\u062a<code>ssl_profile_id<\/code>:<\/p>\n<ol style=\"direction: rtl; text-align: right\">\n<li>\u062c\u0631\u06cc\u0627\u0646 (Stream) \u0631\u0627 \u0628\u0631\u0627\u06cc \u06cc\u06a9 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 (Profile) \u0648\u0627\u062d\u062f \u0628\u0627\u0632 \u06a9\u0646\u06cc\u062f.<\/li>\n<li>\u0627\u0631\u0633\u0627\u0644 \u0627\u062e\u062a\u06cc\u0627\u0631\u06cc<code>generate_csr<\/code>\u060c \u0633\u067e\u0633 \u06cc\u06a9 \u06cc\u0627 \u0686\u0646\u062f<code>\u06af\u0648\u0627\u0647\u06cc\u200c\u0646\u0627\u0645\u0647 (Certificates)<\/code>\u067e\u06cc\u0627\u0645\u200c\u0647\u0627 (<code>UploadRequest<\/code>\u0628\u0627 \u0645\u0642\u0627\u062f\u06cc\u0631 \u062a\u06a9\u0631\u0627\u0631\u06cc<code>Entity<\/code>)\u060c \u0633\u067e\u0633<code>finalize_rotation<\/code>.<\/li>\n<li>\u062a\u0627 \u0632\u0645\u0627\u0646\u06cc \u06a9\u0647 finalize \u062f\u0631\u06cc\u0627\u0641\u062a \u0646\u0634\u0648\u062f\u060c \u0645\u062a\u0631\u06cc\u0627\u0644 \u062c\u062f\u06cc\u062f \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u06a9\u0627\u0646\u062f\u06cc\u062f\u0627 (Candidate) \u0628\u0627\u0642\u06cc \u0645\u06cc\u200c\u0645\u0627\u0646\u062f. \u0628\u0631\u0627\u06cc \u0641\u0639\u0627\u0644\u200c\u0633\u0627\u0632\u06cc \u0628\u0627\u0632\u06af\u0634\u062a \u0628\u0647 \u062d\u0627\u0644\u062a \u0642\u0628\u0644 (Rollback)\u060c \u062c\u0631\u06cc\u0627\u0646 \u0631\u0627 \u0628\u062f\u0648\u0646 finalize \u0631\u0647\u0627 \u06a9\u0646\u06cc\u062f.<\/li>\n<li>\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632<code>force_overwrite: true<\/code>\u0628\u0631\u0627\u06cc \u062c\u0627\u06cc\u06af\u0632\u06cc\u0646\u06cc \u06cc\u06a9<code>\u0646\u0633\u062e\u0647 (Version)<\/code>\u0645\u0648\u062c\u0648\u062f. \u0628\u062f\u0648\u0646 \u0622\u0646\u060c \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u062c\u062f\u062f \u0627\u0632 \u06cc\u06a9 \u0646\u0633\u062e\u0647 \u0631\u062f \u0645\u06cc\u200c\u0634\u0648\u062f \u2014 \u067e\u0631\u0648\u062a\u0648 (Proto) \u0627\u06cc\u0646 \u0645\u0648\u0631\u062f \u0631\u0627<code>AlreadyExists<\/code>\u0646\u0627\u0645\u200c\u06af\u0630\u0627\u0631\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u0627\u0645\u0627 \u062f\u0631 IOS XR 24.4.x \u0628\u0647 \u0635\u0648\u0631\u062a<code>InvalidArgument: certificate: same version sent<\/code>\u0646\u0645\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f (\u0645\u062b\u0627\u0644 \u06a9\u0627\u0645\u0644 \u062f\u0631 \u0632\u06cc\u0631).<\/li>\n<\/ol>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u0631\u0641\u062a\u0627\u0631 IOS XR (24.4.x)<\/h3>\n<p style=\"direction: rtl; text-align: right\">\u062f\u0631 \u0627\u06cc\u0645\u06cc\u062c\u200c\u0647\u0627\u06cc \u0622\u0632\u0645\u0627\u06cc\u0634\u06af\u0627\u0647\u06cc \u0627\u062e\u06cc\u0631\u060c<strong style=\"color: rgb(26, 26, 26)\">\u0647\u0631<\/strong><code>RotateCertificateRequest<\/code>\u062f\u0631 \u062c\u0631\u06cc\u0627\u0646 (Stream) \u2014 \u0634\u0627\u0645\u0644 \u067e\u06cc\u0627\u0645 \u0646\u0647\u0627\u06cc\u06cc\u200c\u0633\u0627\u0632\u06cc (finalize) \u2014 \u0628\u0647 \u0647\u0645\u0627\u0646<code>sslProfileId<\/code>\u0646\u06cc\u0627\u0632 \u062f\u0627\u0631\u062f. \u062d\u0630\u0641 \u0622\u0646 \u062f\u0631 \u0645\u0631\u062d\u0644\u0647 \u0646\u0647\u0627\u06cc\u06cc\u200c\u0633\u0627\u0632\u06cc \u0645\u0646\u062c\u0631 \u0628\u0647 \u062e\u0637\u0627\u06cc \u0632\u06cc\u0631 \u0645\u06cc\u200c\u0634\u0648\u062f:<\/p>\n<pre><code><span>InvalidArgument: Not expecting rotate RPC for multiple SSL profiles in single stream\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u0644\u0637\u0641\u0627\u064b \u0645\u062a\u0646 \u0648\u0631\u0648\u062f\u06cc \u062e\u0648\u062f \u0631\u0627 \u0627\u0631\u0633\u0627\u0644 \u06a9\u0646\u06cc\u062f \u062a\u0627 \u0637\u0628\u0642 \u0642\u0648\u0627\u0646\u06cc\u0646 \u0648 \u062f\u0633\u062a\u0648\u0631\u0627\u0644\u0639\u0645\u0644\u200c\u0647\u0627\u06cc \u062a\u0639\u06cc\u06cc\u0646\u200c\u0634\u062f\u0647\u060c \u062a\u0631\u062c\u0645\u0647 \u0622\u0646 \u0631\u0627 \u0627\u0646\u062c\u0627\u0645 \u062f\u0647\u0645.<\/p>\n<pre><code><span><span>{<\/span><span>\"sslProfileId\"<\/span><span>:<\/span><span>\"lab-profile-1\"<\/span><span>,<\/span><span>\"generateCsr\"<\/span><span>:<\/span><span>{<\/span>...<span>}<\/span><span>}<\/span>\n<\/span><span><span>{<\/span><span>\"sslProfileId\"<\/span><span>:<\/span><span>\"lab-profile-1\"<\/span><span>,<\/span><span>\"certificates\"<\/span><span>:<\/span><span>{<\/span>...<span>}<\/span><span>}<\/span>\n<\/span><span><span>{<\/span><span>\"sslProfileId\"<\/span><span>:<\/span><span>\"lab-profile-1\"<\/span><span>,<\/span><span>\"finalizeRotation\"<\/span><span>:<\/span><span>{<\/span><span>}<\/span><span>}<\/span>\n<\/span><\/code><\/pre>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u0627\u0633\u062a\u0631\u06cc\u0645\u06cc\u0646\u06af \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 grpcurl<\/h3>\n<p style=\"direction: rtl; text-align: right\">\u0627\u0628\u0632\u0627\u0631 grpcurl \u0686\u0646\u062f\u06cc\u0646 \u0634\u06cc\u0621 JSON \u0631\u0627 \u062f\u0631 \u0648\u0631\u0648\u062f\u06cc \u0627\u0633\u062a\u0627\u0646\u062f\u0627\u0631\u062f (stdin) \u0645\u06cc\u200c\u067e\u0630\u06cc\u0631\u062f \u2014 \u06cc\u06a9\u06cc<code>RotateCertificateRequest<\/code>\u062f\u0631 \u0647\u0631 \u062e\u0637 \u2014 \u0628\u0631\u0627\u06cc \u0639\u0645\u0644\u06cc\u0627\u062a Rotate:<\/p>\n<pre><code><span>grpcurl \u2026 <span>-d<\/span> <span>'@'<\/span> \u2026 gnsi.certz.v1.Certz.Rotate <span>&lt;&lt;<\/span><span>'EOF'\n<\/span><\/span><span><span>{... first request...}\n<\/span><\/span><span><span>{... second request...}\n<\/span><\/span><span><span>EOF<\/span>\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u0627\u0633\u062a\u0641\u0627\u062f\u0647<code>-d '@<\/code>\u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u06a9\u0648\u062a\u06cc\u0634\u0646\u200c\u0647\u0627\u06cc \u062a\u06a9\u06cc \u062a\u0627 grpcurl \u0627\u0632 \u0648\u0631\u0648\u062f\u06cc \u0627\u0633\u062a\u0627\u0646\u062f\u0627\u0631\u062f (stdin) \u0628\u062e\u0648\u0627\u0646\u062f.<\/p>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u0686\u06cc\u0633\u062a<code>\u0628\u0627\u0632\u0646\u0648\u06cc\u0633\u06cc \u0627\u062c\u0628\u0627\u0631\u06cc (force_overwrite)<\/code>\u062f\u0631 \u0648\u0627\u0642\u0639 \u0686\u0647 \u06a9\u0627\u0631\u06cc \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u062f\u0647\u062f<\/h3>\n<p style=\"direction: rtl; text-align: right\">\u062a\u0648\u0636\u06cc\u062d proto \u062f\u0631 \u0645\u0648\u0631\u062f<code>force_overwrite<\/code>\u0645\u06cc\u200c\u06af\u0648\u06cc\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u062c\u062f\u062f \u0627\u0632 \u06cc\u06a9<code>\u0646\u0633\u062e\u0647 (version)<\/code>\u0628\u062f\u0648\u0646 \u0622\u0646\u060c \u062e\u0637\u0627\u06cc<code>AlreadyExists<\/code>\u0631\u0627 \u0628\u0631\u0645\u06cc\u200c\u06af\u0631\u062f\u0627\u0646\u062f. \u062f\u0631 \u0633\u06cc\u0633\u062a\u0645\u200c\u0639\u0627\u0645\u0644 IOS XR \u0646\u0633\u062e\u0647 24.4.x \u0647\u0645\u06cc\u0646 \u0648\u0636\u0639\u06cc\u062a \u0628\u0647 \u0634\u06a9\u0644 \u0632\u06cc\u0631 \u0638\u0627\u0647\u0631 \u0645\u06cc\u200c\u0634\u0648\u062f:<\/p>\n<pre><code><span>ERROR:\n<\/span><span> Code: InvalidArgument\n<\/span><span> Message: certificate: same version sent\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u062a\u0646\u0638\u06cc\u0645<code>forceOverwrite\": true<\/code>\u062f\u0631 \u0647\u0631 \u067e\u06cc\u0627\u0645 \u063a\u06cc\u0631 \u0646\u0647\u0627\u06cc\u06cc (non-finalize) \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u062a\u0627 \u0647\u0645\u0627\u0646<code>\u0646\u0633\u062e\u0647<\/code>\u0628\u062f\u0648\u0646 \u062a\u063a\u06cc\u06cc\u0631 \u0645\u0642\u062f\u0627\u0631 \u062f\u0648\u0628\u0627\u0631\u0647 \u067e\u062e\u0634 (replay) \u0634\u0648\u062f \u2014 \u06a9\u0647 \u0647\u0646\u06af\u0627\u0645 \u062a\u0644\u0627\u0634 \u0645\u062c\u062f\u062f \u067e\u0633 \u0627\u0632 \u06cc\u06a9 \u062e\u0637\u0627\u06cc \u06af\u0630\u0631\u0627 (transient error) \u062f\u0631 \u0637\u0648\u0644 \u0628\u0631\u0631\u0633\u06cc \u0622\u0632\u0645\u0627\u06cc\u0634\u06af\u0627\u0647\u06cc \u0628\u0633\u06cc\u0627\u0631 \u06a9\u0627\u0631\u0628\u0631\u062f\u06cc \u0627\u0633\u062a.<\/p>\n<hr>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc \u0627\u0632 IOS XR<\/h2>\n<table class=\"english-numbers\" style=\"direction: rtl; text-align: right\">\n<thead>\n<tr>\n<th>\u0646\u0633\u062e\u0647 (Release)<\/th>\n<th>\u062a\u063a\u06cc\u06cc\u0631\u0627\u062a<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong style=\"color: rgb(26, 26, 26)\">7.8.1<\/strong><\/td>\n<td>\u0632\u06cc\u0631\u0633\u0627\u062e\u062a \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 SSL \u0628\u0631\u0627\u06cc Certz \u0645\u0639\u0631\u0641\u06cc \u0634\u062f.<\/td>\n<\/tr>\n<tr>\n<td><strong style=\"color: rgb(26, 26, 26)\">24.1.1<\/strong><\/td>\n<td>\u0686\u0631\u062e\u0634 RPC\u060c<code>\u0633\u0631\u0648\u06cc\u0633 grpc gnsi \u0628\u0627 \u0634\u0646\u0627\u0633\u0647 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 SSL (ssl-profile-id)<\/code>\u0631\u0627\u0628\u0637 \u062e\u0637 \u0641\u0631\u0645\u0627\u0646 (CLI)\u060c \u0642\u0627\u0628\u0644\u06cc\u062a \u062a\u0646\u0638\u06cc\u0645 \u0646\u0627\u0645 \u062f\u0627\u0645\u0646\u0647 (CN) \u0628\u0631\u0627\u06cc \u062a\u0645\u0627\u0633 \u0648\u0631\u0648\u062f\u06cc (dial-in).<\/td>\n<\/tr>\n<tr>\n<td><strong style=\"color: rgb(26, 26, 26)\">24.4.1<\/strong><\/td>\n<td>\u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc \u0627\u0632 TLS 1.3.<\/td>\n<\/tr>\n<tr>\n<td><strong style=\"color: rgb(26, 26, 26)\">25.4.1<\/strong><\/td>\n<td>\u0646\u0633\u062e\u0647 \u0642\u062f\u06cc\u0645\u06cc (Legacy)<code>\/misc\/config\/grpc<\/code>\u0645\u0633\u06cc\u0631\u0647\u0627\u06cc PEM \u0645\u0646\u0633\u0648\u062e \u0634\u062f\u0646\u062f \u2014 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc SSL \u0645\u0633\u06cc\u0631 \u0622\u06cc\u0646\u062f\u0647 \u0647\u0633\u062a\u0646\u062f.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p style=\"direction: rtl; text-align: right\">\u067e\u0644\u062a\u0641\u0631\u0645\u200c\u0647\u0627: \u062e\u0627\u0646\u0648\u0627\u062f\u0647\u200c\u0647\u0627\u06cc Cisco 8000\u060c NCS 5500 \u0648 ASR 9000. \u0634\u0645\u0627\u0631\u0647 \u0642\u0637\u0639\u0647 (SKU) \u062f\u0642\u06cc\u0642 \u0648 PI\/SMU \u0631\u0627 \u062f\u0631 \u06cc\u0627\u062f\u062f\u0627\u0634\u062a\u200c\u0647\u0627\u06cc \u0627\u0646\u062a\u0634\u0627\u0631 (Release Notes) \u062a\u0623\u06cc\u06cc\u062f \u06a9\u0646\u06cc\u062f.<\/p>\n<hr>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u0645\u0631\u062c\u0639 \u0631\u0627\u0628\u0637 \u062e\u0637 \u0641\u0631\u0645\u0627\u0646 (CLI) \u0628\u0631\u0627\u06cc IOS XR<\/h2>\n<table class=\"english-numbers\" style=\"direction: rtl; text-align: right\">\n<thead>\n<tr>\n<th>\u062f\u0633\u062a\u0648\u0631 \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc (Configuration command)<\/th>\n<th>\u0639\u0645\u0644\u06a9\u0631\u062f \u062f\u0633\u062a\u0648\u0631<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><code>grpc gnsi service certz ssl-profile-id <\/code><\/td>\n<td>\u0627\u062a\u0635\u0627\u0644 \u0633\u0631\u0648\u0631 gRPC \u0628\u0647 \u06cc\u06a9 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 SSL Certz<\/td>\n<\/tr>\n<tr>\n<td><code>no grpc gnsi service certz ssl-profile-id<\/code><\/td>\n<td>\u0644\u063a\u0648 \u0627\u062a\u0635\u0627\u0644 Certz\u061b \u0628\u0627\u0632\u06af\u0634\u062a \u0628\u0647 \u062d\u0627\u0644\u062a \u067e\u06cc\u0634\u200c\u0641\u0631\u0636 gNOI<code>cert.proto<\/code>\u06cc\u0627 \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc PEM \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 trustpoint \u0642\u062f\u06cc\u0645\u06cc<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<table class=\"english-numbers\" style=\"direction: rtl; text-align: right\">\n<thead>\n<tr>\n<th>\u062f\u0633\u062a\u0648\u0631 Show \/ exec<\/th>\n<th>\u0622\u0646\u0686\u0647 \u0646\u0645\u0627\u06cc\u0634 \u0645\u06cc\u200c\u062f\u0647\u062f<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><code>show grpc certificate<\/code><\/td>\n<td>\u0645\u0648\u0636\u0648\u0639 \u06af\u0648\u0627\u0647\u06cc \u0641\u0639\u0627\u0644 (Active Certificate)\u060c \u0635\u0627\u062f\u0631\u06a9\u0646\u0646\u062f\u0647\u060c \u062a\u0627\u0631\u06cc\u062e\u200c\u0647\u0627\u06cc \u0627\u0639\u062a\u0628\u0627\u0631 \u0648 \u0632\u0646\u062c\u06cc\u0631\u0647 \u06af\u0648\u0627\u0647\u06cc<\/td>\n<\/tr>\n<tr>\n<td><code>show gnsi state<\/code><\/td>\n<td>\u0648\u0636\u0639\u06cc\u062a \u0632\u06cc\u0631\u0633\u06cc\u0633\u062a\u0645 gNSI (\u0631\u0634\u062a\u0647\u200c\u0647\u0627\u06cc Certz\u060c Acctz \u0648 \u0648\u0636\u0639\u06cc\u062a RDSFS)<\/td>\n<\/tr>\n<tr>\n<td><code>show tech-support gnsi<\/code><\/td>\n<td>\u0628\u0633\u062a\u0647 \u06a9\u0627\u0645\u0644 \u0639\u06cc\u0628\u200c\u06cc\u0627\u0628\u06cc gNSI (\u062a\u0645\u0627\u0645\u06cc \u0633\u0631\u0648\u06cc\u0633\u200c\u0647\u0627)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u0631\u0627\u0647\u200c\u0627\u0646\u062f\u0627\u0632\u06cc \u0639\u0645\u0644\u06cc (Hands-on Setup)<\/h2>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u067e\u06cc\u0634\u200c\u0646\u06cc\u0627\u0632\u0647\u0627<\/h3>\n<ul style=\"direction: rtl; text-align: right\">\n<li>\u0631\u0648\u062a\u0631 IOS XR \u0628\u0627 \u0642\u0627\u0628\u0644\u06cc\u062a gRPC \u0641\u0639\u0627\u0644 (\u0646\u0633\u062e\u0647 24.1.1 \u06cc\u0627 \u0628\u0627\u0644\u0627\u062a\u0631 \u0628\u0631\u0627\u06cc Certz)<\/li>\n<li><a href=\"https:\/\/github.com\/fullstorydev\/grpcurl\" style=\"color: rgb(0, 102, 204)\">grpcurl<\/a>, <a href=\"https:\/\/jqlang.github.io\/jq\/\" style=\"color: rgb(0, 102, 204)\">jq<\/a>\u060c \u0648 <a href=\"https:\/\/www.openssl.org\/\" style=\"color: rgb(0, 102, 204)\">OpenSSL<\/a> \u0646\u0635\u0628 \u0634\u062f\u0647<\/li>\n<li>\u067e\u0631\u0648\u062a\u06a9\u0644\u200c\u0647\u0627\u06cc OpenConfig gNSI \u0634\u0628\u06cc\u0647\u200c\u0633\u0627\u0632\u06cc (Clone) \u0648 \u0686\u06cc\u062f\u0645\u0627\u0646 \u0634\u062f\u0647\u200c\u0627\u0646\u062f \u0628\u0647 \u0637\u0648\u0631\u06cc \u06a9\u0647<code>$GNSI_IMPORT\/certz\/certz.proto<\/code>\u062d\u0644 (Resolve) \u0645\u06cc\u200c\u0634\u0648\u062f:<\/li>\n<\/ul>\n<pre><code><span><span>git<\/span> clone https:\/\/github.com\/openconfig\/gnsi.git \/tmp\/gnsi\n<\/span><span><span>mkdir<\/span> <span>-p<\/span>.\/certz-import\/certz\n<\/span><span><span>cp<\/span> \/tmp\/gnsi\/certz\/certz.proto.\/certz-import\/certz\/certz.proto\n<\/span><span><span>export<\/span> <span>GNSI_IMPORT<\/span><span>=<\/span><span>\"<span>$PWD<\/span>\/certz-import\"<\/span>\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\"><code>certz.proto<\/code>\u0641\u0642\u0637 import\u0647\u0627<code>google\/protobuf\/any.proto<\/code>\u060c \u06a9\u0647<code>grpcurl<\/code>\u0628\u0647 \u0635\u0648\u0631\u062a \u062f\u0627\u062e\u0644\u06cc \u0627\u0631\u0627\u0626\u0647 \u0645\u06cc\u200c\u062f\u0647\u062f \u2014 \u0646\u06cc\u0627\u0632\u06cc \u0628\u0647 \u0622\u0645\u0627\u062f\u0647\u200c\u0633\u0627\u0632\u06cc \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u062f\u06cc\u06af\u0631 \u0646\u06cc\u0633\u062a.<\/p>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u0645\u062d\u06cc\u0637 (Environment)<\/h3>\n<pre><code><span><span>export<\/span> <span>GNSI_IMPORT<\/span><span>=<\/span><span>\"<span>${GNSI_IMPORT<span>:-<\/span>$PWD<span>\/<\/span>certz-import}<\/span>\"<\/span>\n<\/span><span><span>export<\/span> <span>XR<\/span><span>=<\/span><span>\"<span>${XR<span>:-<\/span>198.51.100.1<span>:<\/span>57400}<\/span>\"<\/span>\n<\/span><span><span>export<\/span> <span>XR_USER<\/span><span>=<\/span><span>\"<span>${XR_USER<span>:-<\/span>cisco}<\/span>\"<\/span>\n<\/span><span><span>export<\/span> <span>XR_PASS<\/span><span>=<\/span><span>\"<span>${XR_PASS<span>:?<\/span>set XR_PASS for the IOS XR account}<\/span>\"<\/span>\n<\/span><span><span>GRPC_MD<\/span><span>=<\/span><span>(<\/span>-H <span>\"username:<span>${XR_USER}<\/span>\"<\/span> <span>-H<\/span> <span>\"password:<span>${XR_PASS}<\/span>\"<\/span><span>)<\/span>\n<\/span><span><span>PROTO_CERTZ<\/span><span>=<\/span><span>\"certz\/certz.proto\"<\/span>\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\"><code>${XR_PASS:?\u2026}<\/code>\u0627\u06af\u0631 \u0645\u062a\u063a\u06cc\u0631<code>XR_PASS<\/code>\u0635\u0627\u062f\u0631 (Export) \u0646\u0634\u062f\u0647 \u0628\u0627\u0634\u062f\u060c \u0634\u0644 (Shell) \u0631\u0627 \u0628\u0627 \u06cc\u06a9 \u062e\u0637\u0627\u06cc \u0648\u0627\u0636\u062d \u0645\u062a\u0648\u0642\u0641 \u0645\u06cc\u200c\u06a9\u0646\u062f \u062a\u0627 \u06a9\u0627\u0631\u0628\u0631 \u0628\u0647\u200c\u0637\u0648\u0631 \u062a\u0635\u0627\u062f\u0641\u06cc \u0631\u0645\u0632 \u0639\u0628\u0648\u0631 \u062e\u0627\u0644\u06cc \u0628\u0647 \u062f\u0633\u062a\u06af\u0627\u0647 \u0627\u0631\u0633\u0627\u0644 \u0646\u06a9\u0646\u062f.<\/p>\n<blockquote style=\"direction: rtl; text-align: right\">\n<p><strong style=\"color: rgb(26, 26, 26)\">\u0641\u0642\u0637 \u0628\u0631\u0627\u06cc \u0645\u062d\u06cc\u0637 \u0622\u0632\u0645\u0627\u06cc\u0634\u06af\u0627\u0647\u06cc:<\/strong>\u0645\u062b\u0627\u0644\u200c\u0647\u0627\u06cc \u0632\u06cc\u0631 \u0627\u0632<code>-plaintext<\/code>\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u0632\u06cc\u0631\u0627 \u0647\u062f\u0641 \u0622\u0646\u200c\u0647\u0627 \u06cc\u06a9 \u0633\u0631\u0648\u0631 gRPC \u0627\u0633\u062a \u06a9\u0647 \u0647\u0646\u0648\u0632 \u0647\u06cc\u0686 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 \u06af\u0648\u0627\u0647\u06cc (Certz Profile) \u0628\u0647 \u0622\u0646 \u0645\u062a\u0635\u0644 \u0646\u0634\u062f\u0647 \u0627\u0633\u062a. \u0647\u0646\u06af\u0627\u0645\u06cc \u06a9\u0647 \u06cc\u06a9 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 \u0641\u0639\u0627\u0644 \u0648 \u0628\u0647 \u0633\u0631\u0648\u0631 gRPC \u0645\u062a\u0635\u0644 \u0634\u062f (<code>grpc gnsi service certz ssl-profile-id <\/code>)\u060c \u062c\u0627\u06cc\u06af\u0632\u06cc\u0646 \u06a9\u0646\u06cc\u062f<code>-plaintext<\/code>\u0628\u0631\u0627\u06cc<code>-cacert<\/code>\u060c \u0648 \u0627\u0636\u0627\u0641\u0647 \u06a9\u0646\u06cc\u062f<code>-cert<\/code>\/<code>-key<\/code>\u0627\u06af\u0631 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a \u062f\u0648\u0637\u0631\u0641\u0647 TLS \u0641\u0639\u0627\u0644 \u0628\u0627\u0634\u062f.<\/p>\n<\/blockquote>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u0622\u0646\u0686\u0647 \u062f\u0631 \u0627\u06cc\u0646 \u062f\u0648\u0631\u0647 \u0639\u0645\u0644\u06cc \u067e\u0648\u0634\u0634 \u062f\u0627\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f (\u0648 \u0622\u0646\u0686\u0647 \u067e\u0648\u0634\u0634 \u062f\u0627\u062f\u0647 \u0646\u0645\u06cc\u200c\u0634\u0648\u062f)<\/h3>\n<p style=\"direction: rtl; text-align: right\">\u0647\u0631 \u0631\u062f\u06cc\u0641 \u062f\u0631 \u0632\u06cc\u0631 \u0645\u0634\u062e\u0635 \u0645\u06cc\u200c\u06a9\u0646\u062f \u06a9\u0647 \u0622\u06cc\u0627 \u06cc\u06a9 \u0628\u062e\u0634 \u0627\u0632 \u0627\u06cc\u0646 \u062a\u0645\u0631\u06cc\u0646 \u0639\u0645\u0644\u06cc \u062a\u0646\u0647\u0627 \u0628\u0627<code>grpcurl<\/code>\u062a\u06a9\u0645\u06cc\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f \u06cc\u0627 \u0628\u0647 \u06cc\u06a9 \u06a9\u0644\u0627\u06cc\u0646\u062a \u067e\u06cc\u0634\u0631\u0641\u062a\u0647\u200c\u062a\u0631 \/ \u0645\u0631\u062d\u0644\u0647 \u062e\u0627\u0631\u062c \u0627\u0632 \u0628\u0627\u0646\u062f (out-of-band) \u0646\u06cc\u0627\u0632 \u062f\u0627\u0631\u062f:<\/p>\n<table class=\"english-numbers\" style=\"direction: rtl; text-align: right\">\n<thead>\n<tr>\n<th>\u0628\u062e\u0634<\/th>\n<th>\u0622\u06cc\u0627 \u0628\u0627 grpcurl \u0628\u0647 \u0635\u0648\u0631\u062a \u0633\u0631\u062a\u0627\u0633\u0631\u06cc (End-to-End) \u06a9\u0627\u0631 \u0645\u06cc\u200c\u06a9\u0646\u062f\u061f<\/th>\n<th>\u06cc\u0627\u062f\u062f\u0627\u0634\u062a\u200c\u0647\u0627<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u0644\u06cc\u0633\u062a \u0628\u0627\u0632\u062a\u0627\u0628 (Reflection list)<\/td>\n<td>\u0628\u0644\u0647<\/td>\n<td>\u0647\u0631 \u0634\u0634 RPC \u0628\u0627 \u0645\u0648\u0641\u0642\u06cc\u062a \u067e\u0627\u0633\u062e \u062f\u0627\u062f\u0646\u062f<\/td>\n<\/tr>\n<tr>\n<td><code>GetProfileList<\/code>, <code>AddProfile<\/code>, <code>DeleteProfile<\/code><\/td>\n<td>\u0628\u0644\u0647<\/td>\n<td>\u067e\u0627\u0633\u062e\u200c\u0647\u0627\u06cc \u062e\u0627\u0644\u06cc \u0648 \u067e\u0631 \u0647\u0631 \u062f\u0648 \u0646\u0645\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u0634\u062f\u0646\u062f<\/td>\n<\/tr>\n<tr>\n<td><code>CanGenerateCSR<\/code><\/td>\n<td>\u0628\u0644\u0647<\/td>\n<td>\u0645\u0648\u0641\u0642\u06cc\u062a \u0648<code>\u0641\u0642\u062f\u0627\u0646 CN<\/code>\u0634\u06a9\u0633\u062a \u0647\u0631 \u062f\u0648 \u0646\u0645\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u0634\u062f\u0646\u062f<\/td>\n<\/tr>\n<tr>\n<td><code>GetIntegrityManifest<\/code><\/td>\n<td>No<\/td>\n<td>\u0633\u0631\u0648\u0631 \u0628\u0627\u0632\u0645\u06cc\u200c\u06af\u0631\u062f\u0627\u0646\u062f<code>Unimplemented<\/code>\u062f\u0631 IOS XR 24.4.x \u2014 \u0645\u0633\u062a\u0646\u062f \u0634\u062f\u0647 \u0627\u0633\u062a<\/td>\n<\/tr>\n<tr>\n<td>\u0622\u0632\u0645\u0627\u06cc\u0634\u06af\u0627\u0647 CA + \u06af\u0648\u0627\u0647\u06cc \u0628\u0631\u06af (Leaf) \u0627\u0645\u0636\u0627 \u0634\u062f\u0647 (OpenSSL)<\/td>\n<td>\u0628\u0644\u0647<\/td>\n<td>CA \u062f\u0648 \u0644\u0627\u06cc\u0647\u060c \u06af\u0648\u0627\u0647\u06cc \u0628\u0631\u06af \u0628\u0647 \u0635\u0648\u0631\u062a \u0645\u062d\u0644\u06cc \u0627\u0645\u0636\u0627 \u0634\u062f\u0647<\/td>\n<\/tr>\n<tr>\n<td><strong style=\"color: rgb(26, 26, 26)\">\u062c\u0631\u06cc\u0627\u0646 B<\/strong>\u2014 \u06a9\u0644\u06cc\u062f \u062a\u0648\u0644\u06cc\u062f \u0634\u062f\u0647 \u062a\u0648\u0633\u0637 \u06a9\u0644\u0627\u06cc\u0646\u062a + \u0632\u0646\u062c\u06cc\u0631\u0647 \u062a\u0648 \u062f\u0631 \u062a\u0648<code>Rotate<\/code><\/td>\n<td><strong style=\"color: rgb(26, 26, 26)\">\u0628\u0644\u0647<\/strong><\/td>\n<td>\u0632\u0646\u062c\u06cc\u0631\u0647 \u06a9\u0627\u0645\u0644 + \u0646\u0647\u0627\u06cc\u06cc\u200c\u0633\u0627\u0632\u06cc\u060c \u0628\u0647 \u0647\u0645\u0631\u0627\u0647 \u0645\u0648\u062c\u0648\u062f\u06cc\u062a \u0627\u062e\u062a\u06cc\u0627\u0631\u06cc Trust Bundle<\/td>\n<\/tr>\n<tr>\n<td><strong style=\"color: rgb(26, 26, 26)\">\u062c\u0631\u06cc\u0627\u0646 A<\/strong>\u2014 CSR \u062a\u0648\u0644\u06cc\u062f \u0634\u062f\u0647 \u062a\u0648\u0633\u0637 \u0647\u062f\u0641 (Target)<\/td>\n<td><strong style=\"color: rgb(26, 26, 26)\">\u0645\u0631\u062d\u0644\u0647 CSR \u0628\u0644\u0647\u060c Rotate \u06a9\u0627\u0645\u0644 \u062e\u06cc\u0631<\/strong><\/td>\n<td>\u0646\u0645\u0627\u06cc\u0634 \u06cc\u06a9 \u0645\u062d\u062f\u0648\u062f\u06cc\u062a \u0645\u0633\u062a\u0646\u062f \u0634\u062f\u0647 \u062f\u0631<code>grpcurl<\/code>\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u062f\u0631 \u0645\u062d\u06cc\u0637 \u0639\u0645\u0644\u06cc\u0627\u062a\u06cc (Production) \u0646\u06cc\u0627\u0632\u0645\u0646\u062f \u06a9\u0644\u0627\u06cc\u0646\u062a Python\/Go \u0627\u0633\u062a<\/td>\n<\/tr>\n<tr>\n<td>Rollback (\u0628\u0633\u062a\u0646 \u0627\u0633\u062a\u0631\u06cc\u0645 \u0642\u0628\u0644 \u0627\u0632 \u0646\u0647\u0627\u06cc\u06cc\u200c\u0633\u0627\u0632\u06cc)<\/td>\n<td>\u0628\u0644\u0647<\/td>\n<td><code>\u06a9\u062f: Unknown \/ EOF<\/code>\u0633\u06cc\u06af\u0646\u0627\u0644 \u0628\u0627\u0632\u06af\u0634\u062a (Rollback) \u0627\u0633\u062a<\/td>\n<\/tr>\n<tr>\n<td><code>forceOverwrite<\/code>\u0645\u0639\u0646\u0627\u0634\u0646\u0627\u0633\u06cc (Semantics)<\/td>\n<td>\u0628\u0644\u0647<\/td>\n<td>\u06cc\u06a9\u0633\u0627\u0646<code>\u0646\u0633\u062e\u0647<\/code>\u0628\u0627 \u0645\u0648\u0641\u0642\u06cc\u062a \u062f\u0648\u0628\u0627\u0631\u0647 \u062a\u0644\u0627\u0634 \u0634\u062f<\/td>\n<\/tr>\n<tr>\n<td>\u062a\u0623\u06cc\u06cc\u062f gNMI (\u067e\u0633 \u0627\u0632 \u0627\u062a\u0635\u0627\u0644)<\/td>\n<td>\u062c\u0632\u0626\u06cc<\/td>\n<td>\u0634\u0645\u0627\u0631\u0646\u062f\u0647\u200c\u0647\u0627\u06cc Authz \u0647\u0645\u06cc\u0634\u0647 \u067e\u0631 \u0647\u0633\u062a\u0646\u062f\u061b \u0632\u06cc\u0631\u062f\u0631\u062e\u062a \u0648\u0636\u0639\u06cc\u062a Certz \u0641\u0642\u0637 \u067e\u0633 \u0627\u0632 \u0627\u062a\u0635\u0627\u0644 CLI<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u0648\u0627\u0698\u06af\u0627\u0646 PEM\u060c Base64 \u0648 CSR<\/h3>\n<p style=\"direction: rtl; text-align: right\">PEM \u06cc\u06a9 \u067e\u0627\u06a9\u062a \u0645\u062a\u0646\u06cc (text envelope) \u0627\u0633\u062a \u06a9\u0647<code>-----BEGIN \u2026-----<\/code>\u062f\u0631 \u0627\u0637\u0631\u0627\u0641 \u06cc\u06a9 DER blob \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u06af\u06cc\u0631\u062f. \u062f\u0631<code>certz.proto<\/code>\u0641\u06cc\u0644\u062f\u0647\u0627\u06cc Certificate \u0648 CSR \u0627\u0632 \u0646\u0648\u0639<code>bytes<\/code>\u0647\u0633\u062a\u0646\u062f\u061b grpcurl \u0627\u06cc\u0646 \u0645\u0648\u0627\u0631\u062f \u0631\u0627<code>bytes<\/code>\u0628\u0647 \u0639\u0646\u0648\u0627\u0646 Base64 \u0627\u0633\u062a\u0627\u0646\u062f\u0627\u0631\u062f \u0628\u0631 \u0631\u0648\u06cc \u0628\u0627\u06cc\u062a\u200c\u0647\u0627\u06cc \u0641\u0627\u06cc\u0644 PEM \u0646\u0645\u0627\u06cc\u0634 \u0645\u06cc\u200c\u062f\u0647\u062f.<\/p>\n<p style=\"direction: rtl; text-align: right\">\u062f\u0648 \u0627\u0644\u06af\u0648\u06cc CSR \u062f\u0631 \u0633\u0631\u0627\u0633\u0631 \u0622\u0646 \u0645\u0634\u0627\u0647\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f:<\/p>\n<ul style=\"direction: rtl; text-align: right\">\n<li><strong style=\"color: rgb(26, 26, 26)\">CSR \u062a\u0648\u0644\u06cc\u062f \u0634\u062f\u0647 \u062a\u0648\u0633\u0637 \u0647\u062f\u0641 (Target-generated CSR)<\/strong>\u2014 \u0631\u0648\u062a\u0631 \u062c\u0641\u062a\u200c\u06a9\u0644\u06cc\u062f (Key Pair) \u0648 CSR \u0631\u0627 \u0627\u06cc\u062c\u0627\u062f \u0645\u06cc\u200c\u06a9\u0646\u062f. CSR \u0631\u0627 \u0628\u0627 \u06cc\u06a9 CA \u0627\u0645\u0636\u0627 \u06a9\u0646\u06cc\u062f\u060c \u0633\u067e\u0633 \u0641\u0642\u0637 \u06af\u0648\u0627\u0647\u06cc (Certificate) \u0627\u0645\u0636\u0627 \u0634\u062f\u0647 \u0631\u0627 \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc \u06a9\u0646\u06cc\u062f. \u06a9\u0644\u06cc\u062f \u062e\u0635\u0648\u0635\u06cc (Private Key) \u0631\u0648\u06cc \u0631\u0648\u062a\u0631 \u0628\u0627\u0642\u06cc \u0645\u06cc\u200c\u0645\u0627\u0646\u062f.<\/li>\n<li><strong style=\"color: rgb(26, 26, 26)\">CSR \u062a\u0648\u0644\u06cc\u062f \u0634\u062f\u0647 \u062a\u0648\u0633\u0637 \u06a9\u0644\u0627\u06cc\u0646\u062a (Client-generated CSR)<\/strong>\u2014 \u06a9\u0644\u06cc\u062f \u0648 CSR \u0631\u0627 \u0631\u0648\u06cc \u06cc\u06a9 \u0627\u06cc\u0633\u062a\u06af\u0627\u0647 \u06a9\u0627\u0631\u06cc \u0627\u06cc\u062c\u0627\u062f \u06a9\u0646\u06cc\u062f\u060c \u0628\u0627 \u06cc\u06a9 CA \u0627\u0645\u0636\u0627 \u06a9\u0646\u06cc\u062f\u060c \u0633\u067e\u0633 \u0647\u0645 \u06af\u0648\u0627\u0647\u06cc \u0627\u0645\u0636\u0627 \u0634\u062f\u0647 \u0648 \u0647\u0645 \u06a9\u0644\u06cc\u062f \u062e\u0635\u0648\u0635\u06cc \u0631\u0627 \u0627\u0632 \u0637\u0631\u06cc\u0642 UploadRequest \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc \u06a9\u0646\u06cc\u062f.<code>\u062f\u0631\u062e\u0648\u0627\u0633\u062a \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc (UploadRequest)<\/code>.<\/li>\n<\/ul>\n<hr>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u0639\u0645\u0644\u06cc: \u0641\u0647\u0631\u0633\u062a \u06a9\u0631\u062f\u0646 RPC\u0647\u0627<\/h2>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u0641\u0647\u0631\u0633\u062a \u0633\u0631\u0648\u06cc\u0633\u200c\u0647\u0627\u06cc \u0635\u0627\u062f\u0631 \u0634\u062f\u0647 (Reflection)<\/h3>\n<pre><code><span>grpcurl <span>-plaintext<\/span> -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>-proto<\/span> <span>\"<span>$PROTO_CERTZ<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${GRPC_MD<span>[<\/span>@<span>]<\/span>}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${XR}<\/span>\"<\/span> list gnsi.certz.v1.Certz\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u0644\u0637\u0641\u0627\u064b \u0645\u062a\u0646 \u0648\u0631\u0648\u062f\u06cc \u062e\u0648\u062f \u0631\u0627 \u0628\u0631\u0627\u06cc \u062a\u0631\u062c\u0645\u0647 \u0627\u0631\u0633\u0627\u0644 \u06a9\u0646\u06cc\u062f \u062a\u0627 \u0637\u0628\u0642 \u0642\u0648\u0627\u0646\u06cc\u0646 \u0648 \u062f\u0633\u062a\u0648\u0631\u0627\u0644\u0639\u0645\u0644\u200c\u0647\u0627\u06cc \u062a\u0639\u06cc\u06cc\u0646\u200c\u0634\u062f\u0647\u060c \u062a\u0631\u062c\u0645\u0647 \u0622\u0646 \u0631\u0627 \u0627\u0646\u062c\u0627\u0645 \u062f\u0647\u0645.<\/p>\n<pre><code><span>gnsi.certz.v1.Certz.AddProfile\n<\/span><span>gnsi.certz.v1.Certz.CanGenerateCSR\n<\/span><span>gnsi.certz.v1.Certz.DeleteProfile\n<\/span><span>gnsi.certz.v1.Certz.GetIntegrityManifest\n<\/span><span>gnsi.certz.v1.Certz.GetProfileList\n<\/span><span>gnsi.certz.v1.Certz.Rotate\n<\/span><\/code><\/pre>\n<hr>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u0641\u0631\u0627\u062e\u0648\u0627\u0646\u06cc\u200c\u0647\u0627\u06cc \u0631\u0648\u06cc\u0647\u200c\u0627\u06cc \u0627\u0632 \u0631\u0627\u0647 \u062f\u0648\u0631 (RPCs) \u06cc\u06a9\u200c\u0637\u0631\u0641\u0647: \u067e\u0631\u0648\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u060c \u0628\u0631\u0631\u0633\u06cc\u200c\u0647\u0627\u06cc CSR \u0648 \u067e\u0627\u06a9\u200c\u0633\u0627\u0632\u06cc<\/h2>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u062f\u0631\u06cc\u0627\u0641\u062a \u0644\u06cc\u0633\u062a \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 (GetProfileList)<\/h3>\n<p style=\"direction: rtl; text-align: right\">\u062a\u0645\u0627\u0645 \u0634\u0646\u0627\u0633\u0647\u200c\u0647\u0627\u06cc \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 (Profile ID) \u0645\u0648\u062c\u0648\u062f \u0628\u0631 \u0631\u0648\u06cc \u062f\u0633\u062a\u06af\u0627\u0647 \u0631\u0627 \u0628\u0627\u0632\u0645\u06cc\u200c\u06af\u0631\u062f\u0627\u0646\u062f:<\/p>\n<pre><code><span>grpcurl <span>-plaintext<\/span> -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>-proto<\/span> <span>\"<span>$PROTO_CERTZ<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${GRPC_MD<span>[<\/span>@<span>]<\/span>}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-d<\/span> <span>'{}'<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${XR}<\/span>\"<\/span> gnsi.certz.v1.Certz.GetProfileList\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u0647\u0646\u06af\u0627\u0645\u06cc \u06a9\u0647 \u0647\u0646\u0648\u0632 \u0647\u06cc\u0686 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644\u06cc (Profiles) \u0627\u06cc\u062c\u0627\u062f \u0646\u0634\u062f\u0647 \u0628\u0627\u0634\u062f\u060c \u067e\u0627\u0633\u062e \u06cc\u06a9 \u0634\u06cc\u0621 \u062e\u0627\u0644\u06cc \u0627\u0633\u062a. \u062f\u0631 \u0628\u0631\u062e\u06cc \u0627\u0632 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u060c \u0627\u06cc\u0646 \u0641\u0631\u0627\u062e\u0648\u0627\u0646\u06cc \u062a\u0627 \u0632\u0645\u0627\u0646\u06cc \u06a9\u0647 \u062f\u0631\u062e\u062a<code>ssl_profiles<\/code>\u0631\u0648\u06cc \u062f\u06cc\u0633\u06a9 \u0627\u06cc\u062c\u0627\u062f \u0646\u0634\u0648\u062f \u0628\u0627 \u062e\u0637\u0627 \u0645\u0648\u0627\u062c\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f\u061b \u0627\u06af\u0631 \u062e\u0637\u0627\u06cc \u062f\u0627\u062e\u0644\u06cc \u0645\u0628\u0646\u06cc \u0628\u0631 \u0646\u0628\u0648\u062f \u0645\u0633\u06cc\u0631 (Path) \u0638\u0627\u0647\u0631 \u0634\u062f\u060c \u0627\u0628\u062a\u062f\u0627 \u062f\u0633\u062a\u0648\u0631<code>AddProfile<\/code>\u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0631\u062f\u0647 \u0648 \u062f\u0648\u0628\u0627\u0631\u0647 \u062a\u0644\u0627\u0634 \u06a9\u0646\u06cc\u062f.<\/p>\n<p style=\"direction: rtl; text-align: right\">\u067e\u0627\u0633\u062e \u0631\u0648\u062a\u0631 (\u0647\u0646\u0648\u0632 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644\u06cc \u0648\u062c\u0648\u062f \u0646\u062f\u0627\u0631\u062f):<\/p>\n<pre><code><span><span>{<\/span><span>}<\/span>\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u067e\u0633 \u0627\u0632 \u0686\u0646\u062f<code>AddProfile<\/code>\u0641\u0631\u0627\u062e\u0648\u0627\u0646\u06cc (\u062f\u0631 \u0627\u062f\u0627\u0645\u0647 \u0628\u0628\u06cc\u0646\u06cc\u062f)\u060c \u0647\u0645\u0627\u0646 RPC \u0644\u06cc\u0633\u062a \u062a\u06a9\u0645\u06cc\u0644\u200c\u0634\u062f\u0647 \u0631\u0627 \u0628\u0627\u0632\u0645\u06cc\u200c\u06af\u0631\u062f\u0627\u0646\u062f:<\/p>\n<pre><code><span><span>{<\/span>\n<\/span><span> <span>\"sslProfileIds\"<\/span><span>:<\/span> <span>[<\/span>\n<\/span><span> <span>\"lab-profile-1\"<\/span><span>,<\/span>\n<\/span><span> <span>\"lab-temp\"<\/span>\n<\/span><span> <span>]<\/span>\n<\/span><span><span>}<\/span>\n<\/span><\/code><\/pre>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u0627\u0641\u0632\u0648\u062f\u0646 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 (AddProfile)<\/h3>\n<p style=\"direction: rtl; text-align: right\">\u06cc\u06a9 \u067e\u0648\u0633\u062a\u0647 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 (Profile) \u062e\u0627\u0644\u06cc \u0627\u06cc\u062c\u0627\u062f \u0645\u06cc\u200c\u06a9\u0646\u062f. \u06cc\u06a9 \u0634\u0646\u0627\u0633\u0647 (ID) \u0645\u0646\u0627\u0633\u0628 \u0628\u0631\u0627\u06cc \u0645\u062f\u06cc\u0631 \u0634\u0628\u06a9\u0647 \u0627\u0646\u062a\u062e\u0627\u0628 \u06a9\u0646\u06cc\u062f:<\/p>\n<pre><code><span>grpcurl <span>-plaintext<\/span> -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>-proto<\/span> <span>\"<span>$PROTO_CERTZ<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${GRPC_MD<span>[<\/span>@<span>]<\/span>}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-d<\/span> <span>'{\"sslProfileId\":\"lab-profile-1\"}'<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${XR}<\/span>\"<\/span> gnsi.certz.v1.Certz.AddProfile\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u067e\u0627\u0633\u062e \u0631\u0648\u062a\u0631 (\u0645\u0648\u0641\u0642\u06cc\u062a \u06cc\u06a9 \u0634\u06cc\u0621 JSON \u062e\u0627\u0644\u06cc \u0628\u0631\u0645\u06cc\u200c\u06af\u0631\u062f\u0627\u0646\u062f):<\/p>\n<pre><code><span><span>{<\/span><span>}<\/span>\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u0627\u062c\u0631\u0627\u06cc \u0645\u062c\u062f\u062f<code>\u0627\u0641\u0632\u0648\u062f\u0646 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 (AddProfile)<\/code>\u0628\u0631\u0627\u06cc \u0647\u0645\u0627\u0646 \u0634\u0646\u0627\u0633\u0647 (ID) \u0646\u062a\u06cc\u062c\u0647 \u0632\u06cc\u0631 \u0631\u0627 \u0628\u0631\u0645\u06cc\u200c\u06af\u0631\u062f\u0627\u0646\u062f:<\/p>\n<pre><code><span>ERROR:\n<\/span><span> Code: InvalidArgument\n<\/span><span> Message: Profile:lab-profile-1 already exists\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u0628\u06cc\u0634\u062a\u0631 \u0627\u0633\u06a9\u0631\u06cc\u067e\u062a\u200c\u0647\u0627\u06cc \u0622\u0632\u0645\u0627\u06cc\u0634\u06af\u0627\u0647\u06cc (Lab scripts) \u062f\u0633\u062a\u0648\u0631<code>AddProfile<\/code>\u0631\u0627 \u0628\u0627<code>|| true<\/code>\u067e\u0648\u0634\u0634 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f \u062a\u0627 \u062e\u0637\u0627\u06cc \u062a\u06a9\u0631\u0627\u0631\u06cc \u0628\u0627\u0639\u062b \u062a\u0648\u0642\u0641 \u0627\u062f\u0627\u0645\u0647 \u06af\u0631\u062f\u0634 \u06a9\u0627\u0631 (Workflow) \u0646\u0634\u0648\u062f.<\/p>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u0627\u0645\u06a9\u0627\u0646 \u062a\u0648\u0644\u06cc\u062f \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u0627\u0645\u0636\u0627\u06cc \u06af\u0648\u0627\u0647\u06cc (CSR)<\/h3>\n<p style=\"direction: rtl; text-align: right\">\u067e\u06cc\u0634 \u0627\u0632 \u0622\u0646\u06a9\u0647 \u0628\u0631\u0627\u06cc \u0635\u062f\u0648\u0631 CSR \u062f\u0631 \u062f\u0627\u062e\u0644 Rotate \u0628\u0647 \u0631\u0648\u062a\u0631 \u062a\u06a9\u06cc\u0647 \u06a9\u0646\u06cc\u062f\u060c \u0628\u0631\u0631\u0633\u06cc\u200c\u0647\u0627\u06cc \u0644\u0627\u0632\u0645 \u0631\u0627 \u0627\u0646\u062c\u0627\u0645 \u062f\u0647\u06cc\u062f. \u0627\u06cc\u0646 \u06a9\u0627\u0631 \u0627\u0632 \u0628\u0627\u0632 \u06a9\u0631\u062f\u0646 \u06cc\u06a9 \u062c\u0631\u06cc\u0627\u0646 (Stream) \u06a9\u0647 \u062f\u0631 \u0646\u0647\u0627\u06cc\u062a \u0645\u0634\u062e\u0635 \u0634\u0648\u062f \u0645\u062c\u0645\u0648\u0639\u0647 (Suite) \u0622\u0646 \u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc \u0646\u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u0628\u0647\u200c\u0635\u0631\u0641\u0647\u200c\u062a\u0631 \u0627\u0633\u062a. \u062a\u0648\u062c\u0647 \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u06cc\u062f:<code>commonName<\/code>\u0627\u062c\u0628\u0627\u0631\u06cc \u0627\u0633\u062a \u2014 \u062d\u0630\u0641 \u0622\u0646 \u0645\u0646\u062c\u0631 \u0628\u0647 \u0628\u0627\u0632\u06af\u0634\u062a \u062e\u0637\u0627\u06cc<code>InvalidArgument<\/code>.<\/p>\n<pre><code><span>grpcurl <span>-plaintext<\/span> -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>-proto<\/span> <span>\"<span>$PROTO_CERTZ<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${GRPC_MD<span>[<\/span>@<span>]<\/span>}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-d<\/span> <span>'{\n<\/span><\/span><span><span> \"params\": {\n<\/span><\/span><span><span> \"csrSuite\": \"CSRSUITE_X509_KEY_TYPE_ECDSA_PRIME256V1_SIGNATURE_ALGORITHM_SHA_2_256\",\n<\/span><\/span><span><span> \"commonName\": \"router.example.com\",\n<\/span><\/span><span><span> \"organization\": \"Lab\",\n<\/span><\/span><span><span> \"country\": \"US\"\n<\/span><\/span><span><span>}\n<\/span><\/span><span><span>}'<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${XR}<\/span>\"<\/span> gnsi.certz.v1.Certz.CanGenerateCSR\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u067e\u0627\u0633\u062e \u0631\u0648\u062a\u0631 (Router response)<\/p>\n<pre><code><span><span>{<\/span>\n<\/span><span> <span>\"canGenerate\"<\/span><span>:<\/span> <span>true<\/span>\n<\/span><span><span>}<\/span>\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\"><code>RSA-2048 \/ SHA-256<\/code>\u0647\u0645\u0627\u0646 \u0645\u0642\u062f\u0627\u0631 \u0631\u0627 \u0628\u0631\u0645\u06cc\u200c\u06af\u0631\u062f\u0627\u0646\u062f<code>canGenerate: true<\/code>\u062f\u0631 IOS XR 24.4.x. \u0628\u0627 \u062d\u0630\u0641<code>\u0646\u0627\u0645 \u0639\u0645\u0648\u0645\u06cc (commonName)<\/code>\u062e\u0631\u0648\u062c\u06cc\u200c\u0647\u0627:<\/p>\n<pre><code><span>ERROR:\n<\/span><span> Code: InvalidArgument\n<\/span><span> Message: CSR parameters does not have common name\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u0647\u0646\u06af\u0627\u0645\u06cc \u06a9\u0647<code>canGenerate<\/code> is <code>false<\/code>\u060c \u0627\u0632 \u0645\u0633\u06cc\u0631 \u062a\u0648\u0644\u06cc\u062f \u0634\u062f\u0647 \u062a\u0648\u0633\u0637 \u06a9\u0644\u0627\u06cc\u0646\u062a \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u06cc\u062f: \u06a9\u0644\u06cc\u062f (Key) \u0648 CSR \u0631\u0627 \u0631\u0648\u06cc \u06cc\u06a9 \u0627\u06cc\u0633\u062a\u06af\u0627\u0647 \u06a9\u0627\u0631\u06cc \u0628\u0633\u0627\u0632\u06cc\u062f \u0648 \u0627\u0632 \u0637\u0631\u06cc\u0642 \u0622\u0646 \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc \u06a9\u0646\u06cc\u062f<code>\u0686\u0631\u062e\u0634 (Rotate)<\/code>.<\/p>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700\">GetIntegrityManifest<\/h3>\n<pre><code><span>grpcurl <span>-plaintext<\/span> -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>-proto<\/span> <span>\"<span>$PROTO_CERTZ<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${GRPC_MD<span>[<\/span>@<span>]<\/span>}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-d<\/span> <span>'{}'<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${XR}<\/span>\"<\/span> gnsi.certz.v1.Certz.GetIntegrityManifest\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u0686\u0646\u062f\u06cc\u0646 \u0646\u0633\u062e\u0647 IOS XR \u0628\u0627\u0632\u0645\u06cc\u200c\u06af\u0631\u062f\u0627\u0646\u0646\u062f<code>\u067e\u06cc\u0627\u062f\u0647\u200c\u0633\u0627\u0632\u06cc \u0646\u0634\u062f\u0647 (Unimplemented)<\/code>\u062f\u0631 \u0627\u06cc\u0646\u062c\u0627\u060c \u0628\u0627 \u0648\u062c\u0648\u062f \u0627\u06cc\u0646\u06a9\u0647 Reflection \u0644\u06cc\u0633\u062a RPC \u0631\u0627 \u0646\u0645\u0627\u06cc\u0634 \u0645\u06cc\u200c\u062f\u0647\u062f. \u062f\u0631 \u0646\u0633\u062e\u0647 24.4.x\u060c \u067e\u0627\u0633\u062e \u062f\u0642\u06cc\u0642 \u0628\u0647 \u0627\u06cc\u0646 \u0635\u0648\u0631\u062a \u0627\u0633\u062a:<\/p>\n<pre><code><span>ERROR:\n<\/span><span> Code: Unimplemented\n<\/span><span> Message: unknown method GetIntegrityManifest for service gnsi.certz.v1.Certz\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u0627\u06cc\u0646 \u06cc\u06a9 \u0634\u06a9\u0627\u0641 (Gap) \u062f\u0631 \u0633\u0645\u062a \u0633\u0631\u0648\u0631 \u0627\u0633\u062a\u060c \u0646\u0647<code>grpcurl<\/code>\u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0646\u0627\u062f\u0631\u0633\u062a (Misconfiguration).<\/p>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u062d\u0630\u0641 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644<\/h3>\n<p style=\"direction: rtl; text-align: right\">\u067e\u0631\u0648\u0641\u0627\u06cc\u0644\u06cc \u0631\u0627 \u062d\u0630\u0641 \u0645\u06cc\u200c\u06a9\u0646\u062f \u06a9\u0647<strong style=\"color: rgb(26, 26, 26)\">\u0628\u0647<\/strong>\u0633\u0631\u0648\u0631 \u0641\u0639\u0627\u0644 gRPC \u0645\u062a\u0635\u0644 \u0646\u06cc\u0633\u062a:<\/p>\n<pre><code><span>grpcurl <span>-plaintext<\/span> -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>-proto<\/span> <span>\"<span>$PROTO_CERTZ<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${GRPC_MD<span>[<\/span>@<span>]<\/span>}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-d<\/span> <span>'{\"sslProfileId\":\"lab-temp\"}'<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${XR}<\/span>\"<\/span> gnsi.certz.v1.Certz.DeleteProfile\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u067e\u0627\u0633\u062e \u0631\u0648\u062a\u0631 \u062f\u0631 \u0635\u0648\u0631\u062a \u0645\u0648\u0641\u0642\u06cc\u062a:<\/p>\n<pre><code><span><span>{<\/span><span>}<\/span>\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u067e\u0627\u0633\u062e\u200c\u0647\u0627\u06cc \u062e\u0637\u0627\u06cc \u0631\u0627\u06cc\u062c \u062f\u0631 IOS XR 24.4.x:<\/p>\n<pre><code><span>ERROR:\n<\/span><span> Code: InvalidArgument\n<\/span><span> Message: Profile: nonexistent-xyz does not exist: &lt;nil&gt;\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u0634\u0646\u0627\u0633\u0647 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 \u067e\u06cc\u0634\u200c\u0641\u0631\u0636 (Default Profile ID)<code>gNxI<\/code>\u062a\u0646\u0647\u0627 \u0632\u0645\u0627\u0646\u06cc \u06a9\u0647 Certz \u0648\u0627\u0642\u0639\u0627\u064b \u0628\u0647 \u0633\u0631\u0648\u0631 gRPC \u0645\u062a\u0635\u0644 (Bound) \u0634\u062f\u0647 \u0628\u0627\u0634\u062f\u060c \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0645\u06cc\u200c\u0634\u0648\u062f\u061b \u062a\u0627 \u067e\u06cc\u0634 \u0627\u0632 \u0622\u0646\u060c \u062d\u0630\u0641 \u06a9\u0631\u062f\u0646 \u0622\u0646 \u0647\u0645\u0627\u0646 \u062e\u0637\u0627\u06cc &#8220;does not exist&#8221; \u0631\u0627 \u0628\u0631\u0645\u06cc\u200c\u06af\u0631\u062f\u0627\u0646\u062f\u060c \u0628\u0647 \u062c\u0627\u06cc \u0627\u06cc\u0646\u06a9\u0647 \u067e\u06cc\u0627\u0645 \u062a\u0648\u0635\u06cc\u0641\u06cc\u200c\u062a\u0631 &#8220;bound to active server&#8221; \u0631\u0627 \u0646\u0645\u0627\u06cc\u0634 \u062f\u0647\u062f.<code>\u0648\u062c\u0648\u062f \u0646\u062f\u0627\u0631\u062f<\/code>\u062e\u0637\u0627 \u0628\u0647 \u062c\u0627\u06cc \u067e\u06cc\u0627\u0645 \u062a\u0648\u0635\u06cc\u0641\u06cc\u200c\u062a\u0631 &#8220;bound to active server&#8221;.<\/p>\n<hr>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u06a9\u0627\u0631 \u0639\u0645\u0644\u06cc: \u0686\u0631\u062e\u0634 \u0633\u0631\u062a\u0627\u0633\u0631\u06cc (End to End)<\/h2>\n<p style=\"direction: rtl; text-align: right\">\u0627\u062f\u0627\u0645\u0647 \u0627\u0632 \u0645\u062d\u06cc\u0637 <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/gnsi-certz-tls-certificate-lifecycle-on-cisco-ios-xr#hands-on-setup\" style=\"color: rgb(0, 102, 204)\">\u0631\u0627\u0647\u200c\u0627\u0646\u062f\u0627\u0632\u06cc \u0639\u0645\u0644\u06cc (Hands-on Setup)<\/a> \u062f\u0631 \u0645\u062d\u06cc\u0637 \u0628\u0627\u0644\u0627. \u0628\u062e\u0634\u200c\u0647\u0627\u06cc \u0632\u06cc\u0631 \u0634\u0645\u0627 \u0631\u0627 \u0628\u0627 \u0645\u0637\u0627\u0644\u0628 \u0648\u0627\u0642\u0639\u06cc \u06af\u0648\u0627\u0647\u06cc\u200c\u0646\u0627\u0645\u0647 (Certificate) \u0622\u0634\u0646\u0627 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f. \u0628\u0627 \u06cc\u06a9 \u0622\u0632\u0645\u0627\u06cc\u0634\u06af\u0627\u0647 \u06a9\u0648\u0686\u06a9 PKI \u0634\u0631\u0648\u0639 \u06a9\u0646\u06cc\u062f \u062a\u0627 \u0628\u062a\u0648\u0627\u0646\u06cc\u062f CSR\u0647\u0627 \u0631\u0627 \u0628\u062f\u0648\u0646 \u062f\u0631\u06af\u06cc\u0631 \u06a9\u0631\u062f\u0646 \u06cc\u06a9 CA \u0639\u0645\u0644\u06cc\u0627\u062a\u06cc \u0627\u0645\u0636\u0627 \u06a9\u0646\u06cc\u062f\u060c \u0633\u067e\u0633 \u0647\u0631 \u062f\u0648 \u0633\u0628\u06a9 \u0686\u0631\u062e\u0634 (Rotation) \u0631\u0627 \u0627\u0645\u062a\u062d\u0627\u0646 \u06a9\u0646\u06cc\u062f.<\/p>\n<blockquote style=\"direction: rtl; text-align: right\">\n<p><strong style=\"color: rgb(26, 26, 26)\">\u0628\u0627 \u06a9\u062f\u0627\u0645 \u062c\u0631\u06cc\u0627\u0646 (Flow) \u0634\u0631\u0648\u0639 \u06a9\u0646\u06cc\u0645:<\/strong>\u0628\u06cc\u0634\u062a\u0631 \u0627\u067e\u0631\u0627\u062a\u0648\u0631\u0647\u0627 \u06a9\u0644\u06cc\u062f\u0647\u0627 \u0631\u0627 \u0631\u0648\u06cc \u06cc\u06a9 \u0627\u06cc\u0633\u062a\u06af\u0627\u0647 \u06a9\u0627\u0631\u06cc \u062a\u0648\u0644\u06cc\u062f \u06a9\u0631\u062f\u0647 \u0648 \u0622\u0646\u200c\u0647\u0627 \u0631\u0627 \u0627\u0632 \u0637\u0631\u06cc\u0642 Certz \u0627\u0631\u0633\u0627\u0644 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u2014 \u06a9\u0647 \u0627\u06cc\u0646 \u0647\u0645\u0627\u0646<strong style=\"color: rgb(26, 26, 26)\">\u062c\u0631\u06cc\u0627\u0646 B<\/strong>\u062f\u0631 \u0632\u06cc\u0631 \u0627\u0633\u062a.<strong style=\"color: rgb(26, 26, 26)\">\u062c\u0631\u06cc\u0627\u0646 A<\/strong>(\u062f\u0631\u062e\u0648\u0627\u0633\u062a \u0627\u0645\u0636\u0627\u06cc \u06af\u0648\u0627\u0647\u06cc \u06cc\u0627 CSR \u062a\u0648\u0644\u06cc\u062f \u0634\u062f\u0647 \u062a\u0648\u0633\u0637 \u0647\u062f\u0641) \u0632\u0645\u0627\u0646\u06cc \u0645\u0641\u06cc\u062f \u0627\u0633\u062a \u06a9\u0647 \u06a9\u0644\u06cc\u062f \u062e\u0635\u0648\u0635\u06cc (Private Key) \u0647\u0631\u06af\u0632 \u0646\u0628\u0627\u06cc\u062f \u0627\u0632 \u0631\u0648\u062a\u0631 \u062e\u0627\u0631\u062c \u0634\u0648\u062f\u060c \u0627\u0645\u0627<code>grpcurl<\/code>\u0646\u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062c\u0631\u06cc\u0627\u0646 \u0686\u0646\u062f \u0645\u0631\u062d\u0644\u0647\u200c\u0627\u06cc \u06a9\u0627\u0645\u0644 \u0631\u0627 \u0628\u0647 \u0635\u0648\u0631\u062a \u062a\u0639\u0627\u0645\u0644\u06cc \u062a\u06a9\u0645\u06cc\u0644 \u06a9\u0646\u062f \u2014 \u0628\u0631\u0627\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0639\u0645\u0644\u06cc\u0627\u062a\u06cc \u0627\u0632 \u0622\u0646 \u062c\u0631\u06cc\u0627\u0646\u060c \u0628\u0647 \u06cc\u06a9 \u06a9\u0644\u0627\u06cc\u0646\u062a \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0646\u0648\u06cc\u0633\u06cc \u0634\u062f\u0647 (Python, Go) \u0646\u06cc\u0627\u0632 \u0627\u0633\u062a.<\/p>\n<\/blockquote>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u062c\u0631\u06cc\u0627\u0646 \u067e\u06cc\u0627\u0645 \u0686\u0631\u062e\u0634\u06cc (Rotate Message Flow)<\/h3>\n<table class=\"english-numbers\" style=\"direction: rtl; text-align: right\">\n<thead>\n<tr>\n<th>\u0645\u0631\u062d\u0644\u0647<\/th>\n<th>\u0641\u06cc\u0644\u062f \u067e\u06cc\u0627\u0645 (<code>\u06cc\u06a9\u06cc \u0627\u0632 rotate_request<\/code>)<\/th>\n<th>\u0639\u0645\u0644\u06a9\u0631\u062f<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>1 (\u0627\u062e\u062a\u06cc\u0627\u0631\u06cc)<\/td>\n<td><strong style=\"color: rgb(26, 26, 26)\"><code>generate_csr<\/code><\/strong><\/td>\n<td>\u0647\u062f\u0641 \u062a\u0648\u0644\u06cc\u062f \u0645\u06cc\u200c\u06a9\u0646\u062f<strong style=\"color: rgb(26, 26, 26)\">\u06a9\u0644\u06cc\u062f + CSR<\/strong>; PEM CSR \u062f\u0631 \u062c\u0631\u06cc\u0627\u0646 \u067e\u0627\u0633\u062e \u0628\u0627\u0632\u06af\u0631\u062f\u0627\u0646\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f<\/td>\n<\/tr>\n<tr>\n<td>2<\/td>\n<td><strong style=\"color: rgb(26, 26, 26)\"><code>\u06af\u0648\u0627\u0647\u06cc\u200c\u0647\u0627<\/code><\/strong><\/td>\n<td><strong style=\"color: rgb(26, 26, 26)\"><code>\u062f\u0631\u062e\u0648\u0627\u0633\u062a \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc (UploadRequest)<\/code><\/strong>: \u06cc\u06a9 \u06cc\u0627 \u0686\u0646\u062f \u0645\u0648\u0631\u062f<strong style=\"color: rgb(26, 26, 26)\"><code>\u0645\u0648\u062c\u0648\u062f\u06cc\u062a (Entity)<\/code><\/strong>\u0645\u0642\u0627\u062f\u06cc\u0631 (\u0628\u0631\u06af \u06af\u0648\u0627\u0647\u06cc\u060c \u0628\u0633\u062a\u0647 \u0627\u0639\u062a\u0645\u0627\u062f\u060c CRL\u060c&#8230;)<\/td>\n<\/tr>\n<tr>\n<td>\u0622\u062e\u0631\u06cc\u0646<\/td>\n<td><strong style=\"color: rgb(26, 26, 26)\"><code>\u0646\u0647\u0627\u06cc\u06cc\u200c\u0633\u0627\u0632\u06cc \u0686\u0631\u062e\u0634 (finalize_rotation)<\/code><\/strong><\/td>\n<td>\u062a\u0627\u06cc\u06cc\u062f (Commit). \u062d\u0630\u0641 \u06cc\u0627 \u0644\u063a\u0648 \u06a9\u0631\u062f\u0646 \u0628\u0627\u0639\u062b \u0628\u0627\u0632\u06af\u0634\u062a \u0628\u0647 \u062d\u0627\u0644\u062a \u0642\u0628\u0644 (Rollback) \u0645\u06cc\u200c\u0634\u0648\u062f<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p style=\"direction: rtl; text-align: right\">\u0647\u0631 \u06a9\u062f\u0627\u0645<code>\u0645\u0648\u062c\u0648\u062f\u06cc\u062a<\/code>\u0634\u0627\u0645\u0644:<\/p>\n<ul style=\"direction: rtl; text-align: right\">\n<li><code>\u0646\u0633\u062e\u0647<\/code>\u2014 \u0631\u0634\u062a\u0647 \u0645\u0628\u0647\u0645 (Opaque string) \u0646\u0645\u0627\u06cc\u0634 \u062f\u0627\u062f\u0647 \u0634\u062f\u0647 \u062f\u0631 \u062a\u0644\u0647\u200c\u0645\u062a\u0631\u06cc (Telemetry)<\/li>\n<li><code>\u062a\u0627\u0631\u06cc\u062e \u0627\u06cc\u062c\u0627\u062f<\/code>\u2014 \u062b\u0627\u0646\u06cc\u0647\u200c\u0647\u0627\u06cc \u0633\u067e\u0631\u06cc \u0634\u062f\u0647 \u0627\u0632 \u0645\u0628\u062f\u0623 \u06cc\u0648\u0646\u06cc\u06a9\u0633 (Unix epoch seconds)<\/li>\n<li>\u062f\u0642\u06cc\u0642\u0627\u064b \u06cc\u06a9 \u0634\u0627\u062e\u0647 \u0627\u0632 \u0645\u0648\u062c\u0648\u062f\u06cc\u062a<code>\u06cc\u06a9\u06cc \u0627\u0632 (oneof)<\/code> (<code>\u0632\u0646\u062c\u06cc\u0631\u0647 \u06af\u0648\u0627\u0647\u06cc (certificateChain)<\/code>, <code>\u0628\u0633\u062a\u0647 \u0627\u0639\u062a\u0645\u0627\u062f (trustBundle)<\/code>\u0648 \u063a\u06cc\u0631\u0647)<\/li>\n<\/ul>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u0627\u06cc\u062c\u0627\u062f \u06cc\u06a9 Lab CA \u062f\u0648 \u0644\u0627\u06cc\u0647 (\u06cc\u06a9\u200c\u0628\u0627\u0631 \u0628\u0631\u0627\u06cc OpenSSL)<\/h3>\n<p style=\"direction: rtl; text-align: right\">\u0634\u0628\u06a9\u0647\u200c\u0647\u0627\u06cc \u0633\u0627\u0632\u0645\u0627\u0646\u06cc (Enterprise networks) \u062a\u0642\u0631\u06cc\u0628\u0627\u064b \u0647\u0631\u06af\u0632 \u06af\u0648\u0627\u0647\u06cc\u200c\u0647\u0627\u06cc (Certificates) \u0631\u0648\u062a\u0631 \u0631\u0627 \u0645\u0633\u062a\u0642\u06cc\u0645\u0627\u064b \u0628\u0627 \u06cc\u06a9 \u0631\u06cc\u0634\u0647 (Root) \u0628\u0627 \u0637\u0648\u0644 \u0639\u0645\u0631 \u0628\u0627\u0644\u0627 \u0627\u0645\u0636\u0627 \u0646\u0645\u06cc\u200c\u06a9\u0646\u0646\u062f. \u0622\u0646\u200c\u0647\u0627 \u06cc\u06a9 \u06af\u0648\u0627\u0647\u06cc \u0645\u06cc\u0627\u0646\u06cc (Intermediate) \u0635\u0627\u062f\u0631 \u06a9\u0631\u062f\u0647\u060c \u0631\u06cc\u0634\u0647 (Root) \u0631\u0627 \u0622\u0641\u0644\u0627\u06cc\u0646 \u0646\u06af\u0647 \u0645\u06cc\u200c\u062f\u0627\u0631\u0646\u062f \u0648 \u0627\u062c\u0627\u0632\u0647 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f \u06af\u0648\u0627\u0647\u06cc \u0645\u06cc\u0627\u0646\u06cc (Intermediate) \u062f\u0631\u062e\u0648\u0627\u0633\u062a\u200c\u0647\u0627\u06cc \u0627\u0645\u0636\u0627\u06cc \u06af\u0648\u0627\u0647\u06cc (CSRs) \u0631\u0648\u0632\u0645\u0631\u0647 \u0631\u0627 \u0627\u0645\u0636\u0627 \u06a9\u0646\u062f. \u0627\u06cc\u0646 \u0622\u0632\u0645\u0627\u06cc\u0634\u06af\u0627\u0647 \u0647\u0645\u0627\u0646 \u0627\u0644\u06af\u0648 \u0631\u0627 \u0634\u0628\u06cc\u0647\u200c\u0633\u0627\u0632\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n<p style=\"direction: rtl; text-align: right\"><strong style=\"color: rgb(26, 26, 26)\">1 \u2014 \u0645\u0631\u062c\u0639 \u0635\u062f\u0648\u0631 \u06af\u0648\u0627\u0647\u06cc \u0631\u06cc\u0634\u0647 (Root CA) (\u0644\u0646\u06af\u0631 \u0627\u0639\u062a\u0645\u0627\u062f (Trust Anchor)\u060c \u062e\u0648\u062f-\u0627\u0645\u0636\u0627 (self-signed))<\/strong><\/p>\n<pre><code><span><span>mkdir<\/span> <span>-p<\/span> lab-pki\/root lab-pki\/intermediate\n<\/span><span>openssl genrsa <span>-out<\/span> lab-pki\/root\/root.key <span>4096<\/span>\n<\/span><span>openssl req <span>-new<\/span> <span>-x509<\/span> <span>-key<\/span> lab-pki\/root\/root.key <span>-sha256<\/span> <span>-days<\/span> <span>3650<\/span> <span>\\<\/span>\n<\/span><span> <span>-out<\/span> lab-pki\/root\/root.crt <span>\\<\/span>\n<\/span><span> <span>-subj<\/span> <span>\"\/CN=Lab Root CA\/O=Lab\/C=US\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-addext<\/span> <span>\"basicConstraints=critical,CA:TRUE\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-addext<\/span> <span>\"keyUsage=critical,keyCertSign,cRLSign\"<\/span>\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\"><strong style=\"color: rgb(26, 26, 26)\">2 \u2014 \u06af\u0648\u0627\u0647\u06cc \u0645\u06cc\u0627\u0646\u06cc (Intermediate CA) (\u0627\u0645\u0636\u0627 \u0634\u062f\u0647 \u062a\u0648\u0633\u0637 \u0631\u06cc\u0634\u0647 (Root))<\/strong><\/p>\n<pre><code><span>openssl genrsa <span>-out<\/span> lab-pki\/intermediate\/intermediate.key <span>4096<\/span>\n<\/span><span>openssl req <span>-new<\/span> <span>-key<\/span> lab-pki\/intermediate\/intermediate.key <span>\\<\/span>\n<\/span><span> <span>-out<\/span> lab-pki\/intermediate\/intermediate.csr <span>\\<\/span>\n<\/span><span> <span>-subj<\/span> <span>\"\/CN=Lab Issuing CA\/O=Lab\/C=US\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-addext<\/span> <span>\"basicConstraints=critical,CA:TRUE,pathlen:0\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-addext<\/span> <span>\"keyUsage=critical,keyCertSign,cRLSign\"<\/span>\n<\/span><span>openssl x509 <span>-req<\/span> <span>-in<\/span> lab-pki\/intermediate\/intermediate.csr <span>\\<\/span>\n<\/span><span> <span>-CA<\/span> lab-pki\/root\/root.crt <span>-CAkey<\/span> lab-pki\/root\/root.key <span>-CAcreateserial<\/span> <span>\\<\/span>\n<\/span><span> <span>-out<\/span> lab-pki\/intermediate\/intermediate.crt <span>-days<\/span> <span>1825<\/span> <span>-sha256<\/span> <span>\\<\/span>\n<\/span><span> <span>-copy_extensions<\/span> copy\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\"><strong style=\"color: rgb(26, 26, 26)\">3 \u2014 \u062a\u0623\u06cc\u06cc\u062f \u0632\u0646\u062c\u06cc\u0631\u0647\u200c\u0647\u0627\u06cc \u0645\u06cc\u0627\u0646\u06cc (Intermediate chains) \u0628\u0647 \u0633\u0645\u062a \u0631\u06cc\u0634\u0647 (Root)<\/strong><\/p>\n<pre><code><span>openssl verify <span>-CAfile<\/span> lab-pki\/root\/root.crt lab-pki\/intermediate\/intermediate.crt\n<\/span><\/code><\/pre>\n<ul style=\"direction: rtl; text-align: right\">\n<li><code>lab-pki\/root\/root.key<\/code>\u0628\u0647 \u0627\u0646\u062f\u0627\u0632\u0647 \u0647\u0631 \u06a9\u0644\u06cc\u062f \u0627\u0645\u0636\u0627\u06cc \u0631\u06cc\u0634\u0647 (Root signing Key) \u062d\u0633\u0627\u0633 \u0627\u0633\u062a \u2014 \u0628\u0627 \u0622\u0646 \u0645\u0637\u0627\u0628\u0642 \u0628\u0627 \u062d\u0633\u0627\u0633\u06cc\u062a\u0634 \u0631\u0641\u062a\u0627\u0631 \u06a9\u0646\u06cc\u062f.<\/li>\n<li><code>lab-pki\/intermediate\/intermediate.key<\/code>\u0627\u0645\u0636\u0627\u06a9\u0646\u0646\u062f\u0647 \u00ab\u0622\u0646\u0644\u0627\u06cc\u0646\u00bb \u0627\u0633\u062a\u061b \u0628\u0627 \u0627\u06cc\u0646 \u062d\u0627\u0644 \u0647\u0645\u0686\u0646\u0627\u0646 \u0628\u0647 \u062f\u0642\u062a \u0627\u0632 \u0622\u0646 \u0645\u062d\u0627\u0641\u0638\u062a \u06a9\u0646\u06cc\u062f.<\/li>\n<li><code>lab-pki\/root\/root.crt<\/code>\u0644\u0646\u06af\u0631 \u0627\u0639\u062a\u0645\u0627\u062f (Trust Anchor) \u0627\u0633\u062a \u06a9\u0647 \u0628\u0647<code>openssl verify<\/code>.<\/li>\n<\/ul>\n<hr>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u062c\u0631\u06cc\u0627\u0646 A \u2014 CSR \u062a\u0648\u0644\u06cc\u062f \u0634\u062f\u0647 \u062a\u0648\u0633\u0637 \u0647\u062f\u0641 (\u0646\u0634\u0627\u0646\u200c\u062f\u0647\u0646\u062f\u0647 \u06cc\u06a9 \u0645\u062d\u062f\u0648\u062f\u06cc\u062a \u062f\u0631 grpcurl)<code>grpcurl<\/code>\u0645\u062d\u062f\u0648\u062f\u06cc\u062a (limitation)<\/h3>\n<blockquote style=\"direction: rtl; text-align: right\">\n<p><strong style=\"color: rgb(26, 26, 26)\">\u0622\u0646\u0686\u0647 \u0627\u06cc\u0646 \u0628\u062e\u0634 \u062f\u0631 \u0648\u0627\u0642\u0639 \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f:<\/strong>\u0645\u0631\u0627\u062d\u0644 1 \u062a\u0627 3 \u0628\u0647 \u062f\u0631\u0633\u062a\u06cc \u06a9\u0627\u0631 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u2014<code>grpcurl<\/code>\u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0631\u0648\u062a\u0631 \u0631\u0627 \u0648\u0627\u062f\u0627\u0631 \u0628\u0647 \u062a\u0648\u0644\u06cc\u062f \u06cc\u06a9 CSR \u06a9\u0646\u062f \u0648 OpenSSL \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0622\u0646 \u0631\u0627 \u0627\u0645\u0636\u0627 \u0646\u0645\u0627\u06cc\u062f. \u0633\u067e\u0633 \u0645\u0631\u062d\u0644\u0647 5 \u0628\u0627 \u06cc\u06a9 \u062e\u0637\u0627\u06cc \u062e\u0627\u0635 \u0648 \u0642\u0627\u0628\u0644 \u067e\u06cc\u0634\u200c\u0628\u06cc\u0646\u06cc \u0634\u06a9\u0633\u062a \u0645\u06cc\u200c\u062e\u0648\u0631\u062f\u060c \u0632\u06cc\u0631\u0627<code>grpcurl<\/code>\u0646\u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u06cc\u06a9 \u062c\u0631\u06cc\u0627\u0646 \u0686\u0631\u062e\u0634 (Rotate stream) \u0631\u0627 \u062f\u0631 \u0637\u0648\u0644 \u0648\u0642\u0641\u0647 \u0627\u0645\u0636\u0627\u06cc \u062e\u0627\u0631\u062c\u06cc \u06a9\u0647 \u0627\u06cc\u0646 \u0641\u0631\u0622\u06cc\u0646\u062f \u0628\u0647 \u0622\u0646 \u0646\u06cc\u0627\u0632 \u062f\u0627\u0631\u062f\u060c \u0628\u0627\u0632 \u0646\u06af\u0647 \u062f\u0627\u0631\u062f. \u0631\u0627\u0647\u0646\u0645\u0627\u06cc \u06a9\u0627\u0645\u0644 \u06af\u0646\u062c\u0627\u0646\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a \u062a\u0627 \u0627\u067e\u0631\u0627\u062a\u0648\u0631\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u00ab\u062c\u0631\u06cc\u0627\u0646 A\u00bb (Flow A) \u0631\u0627 \u062f\u0631 \u0646\u0638\u0631 \u062f\u0627\u0631\u0646\u062f\u060c \u062f\u0642\u06cc\u0642\u0627\u064b \u0628\u0628\u06cc\u0646\u0646\u062f<strong style=\"color: rgb(26, 26, 26)\">\u0686\u0647 \u0686\u06cc\u0632\u06cc \u06a9\u0627\u0631 \u0645\u06cc\u200c\u06a9\u0646\u062f<\/strong>, <strong style=\"color: rgb(26, 26, 26)\">\u06a9\u062c\u0627 \u0634\u06a9\u0633\u062a \u0645\u06cc\u200c\u062e\u0648\u0631\u062f<\/strong>\u060c \u0648<strong style=\"color: rgb(26, 26, 26)\">\u0686\u0631\u0627<\/strong>. \u062e\u0648\u0627\u0646\u0646\u062f\u06af\u0627\u0646\u06cc \u06a9\u0647 \u0641\u0642\u0637 \u0628\u0647 \u062f\u0646\u0628\u0627\u0644 \u06cc\u06a9 \u0686\u0631\u062e\u0634 (Rotation) \u0639\u0645\u0644\u06cc\u0627\u062a\u06cc \u0647\u0633\u062a\u0646\u062f\u060c \u0628\u0627\u06cc\u062f \u0628\u0647 \u0633\u0631\u0627\u063a <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/gnsi-certz-tls-certificate-lifecycle-on-cisco-ios-xr#flow-b--client-generated-key-and-csr-full-chain-upload\" style=\"color: rgb(0, 102, 204)\">\u062c\u0631\u06cc\u0627\u0646 B (Flow B) \u2014 \u06a9\u0644\u06cc\u062f \u0648 CSR \u062a\u0648\u0644\u06cc\u062f \u0634\u062f\u0647 \u062a\u0648\u0633\u0637 \u06a9\u0644\u0627\u06cc\u0646\u062a \u0628\u0631\u0648\u0646\u062f<\/a>.<\/p>\n<div style=\"display: flex\" title=\"\u0627\u0646\u062a\u062e\u0627\u0628 \u06a9\u0644 \u0627\u06cc\u0646 \u0628\u062e\u0634\">&nbsp;<\/div>\n<\/blockquote>\n<p style=\"direction: rtl; text-align: right\">\u0631\u0648\u062a\u0631 \u062f\u0627\u0631\u0627\u06cc \u06a9\u0644\u06cc\u062f \u062e\u0635\u0648\u0635\u06cc (Private Key) \u0627\u0633\u062a. \u0627\u0632 \u0622\u0646 \u06cc\u06a9 CSR \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u0646\u06cc\u062f\u060c CSR \u0631\u0627 \u0628\u0627 Intermediate CA \u0627\u0645\u0636\u0627 \u06a9\u0646\u06cc\u062f\u060c \u0641\u0642\u0637 \u06af\u0648\u0627\u0647\u06cc \u0627\u0645\u0636\u0627 \u0634\u062f\u0647 \u0646\u0647\u0627\u06cc\u06cc (Leaf) \u0631\u0627 \u0622\u067e\u0644\u0648\u062f \u06a9\u0646\u06cc\u062f (\u0628\u062f\u0648\u0646 \u06a9\u0644\u06cc\u062f \u062e\u0635\u0648\u0635\u06cc \u062f\u0631<code>UploadRequest<\/code>) \u0648 \u0646\u0647\u0627\u06cc\u06cc\u200c\u0633\u0627\u0632\u06cc (Finalize) \u0631\u0627 \u0627\u0646\u062c\u0627\u0645 \u062f\u0647\u06cc\u062f.<\/p>\n<h4 style=\"color: rgb(26, 26, 26); font-weight: 700\">\u0645\u0631\u062d\u0644\u0647 1 \u2014 \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u062d\u0627\u0635\u0644 \u06a9\u0646\u06cc\u062f \u06a9\u0647 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f<\/h4>\n<pre><code><span>grpcurl <span>-plaintext<\/span> -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>-proto<\/span> <span>\"<span>$PROTO_CERTZ<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${GRPC_MD<span>[<\/span>@<span>]<\/span>}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-d<\/span> <span>'{\"sslProfileId\":\"lab-profile-1\"}'<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${XR}<\/span>\"<\/span> gnsi.certz.v1.Certz.AddProfile <span>||<\/span> <span>true<\/span>\n<\/span><\/code><\/pre>\n<h4 style=\"color: rgb(26, 26, 26); font-weight: 700\">\u0645\u0631\u062d\u0644\u0647 2 \u2014 \u062f\u0631\u062e\u0648\u0627\u0633\u062a CSR \u0648 \u062f\u0631\u06cc\u0627\u0641\u062a PEM<\/h4>\n<blockquote style=\"direction: rtl; text-align: right\">\n<p><strong style=\"color: rgb(26, 26, 26)\">\u0645\u062d\u062f\u0648\u062f\u06cc\u062a grpcurl:<\/strong>\u062f\u0631 \u06cc\u06a9 \u06af\u0631\u062f\u0634 \u06a9\u0627\u0631 \u0639\u0645\u0644\u06cc\u0627\u062a\u06cc (Production Workflow)\u060c \u0645\u0631\u0627\u062d\u0644 2 \u062a\u0627 5 \u062f\u0631 \u06cc\u06a9 \u062c\u0631\u06cc\u0627\u0646 (Stream) \u0648\u0627\u062d\u062f Rotate \u0631\u062e \u0645\u06cc\u200c\u062f\u0647\u0646\u062f\u061b \u06a9\u0644\u0627\u06cc\u0646\u062a \u062f\u0633\u062a\u0648\u0631<code>generateCsr<\/code>\u0631\u0627 \u0627\u0631\u0633\u0627\u0644 \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c CSR \u0631\u0627 \u062f\u0631\u06cc\u0627\u0641\u062a \u06a9\u0631\u062f\u0647\u060c \u0622\u0646 \u0631\u0627 \u0627\u0645\u0636\u0627 \u0645\u06cc\u200c\u06a9\u0646\u062f\u060c \u06af\u0648\u0627\u0647\u06cc \u0628\u0631\u06af (Leaf) \u0627\u0645\u0636\u0627 \u0634\u062f\u0647 \u0631\u0627 \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc \u06a9\u0631\u062f\u0647 \u0648 \u0628\u062f\u0648\u0646 \u0628\u0633\u062a\u0646 \u0627\u062a\u0635\u0627\u0644\u060c \u0641\u0631\u0622\u06cc\u0646\u062f \u0631\u0627 \u0646\u0647\u0627\u06cc\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f.<code>\u0627\u0628\u0632\u0627\u0631 grpcurl<\/code>\u0646\u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u062f\u0631 \u0645\u06cc\u0627\u0646 \u062c\u0631\u06cc\u0627\u0646 \u0628\u0631\u0627\u06cc \u0627\u0645\u0636\u0627\u06cc \u062e\u0627\u0631\u062c\u06cc \u0645\u062a\u0648\u0642\u0641 \u0634\u0648\u062f\u060c \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u067e\u0633 \u0627\u0632 \u0628\u0627\u0632\u06af\u0634\u062a CSR\u060c \u062c\u0631\u06cc\u0627\u0646 \u0628\u0633\u062a\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f. \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0632\u06cc\u0631 \u0628\u0627 \u0627\u062c\u0631\u0627\u06cc \u062f\u0648 \u0641\u0631\u0627\u062e\u0648\u0627\u0646\u06cc \u0645\u062c\u0632\u0627\u06cc Rotate\u060c \u0627\u06cc\u0646 \u0645\u062d\u062f\u0648\u062f\u06cc\u062a \u0631\u0627 \u062f\u0648\u0631 \u0645\u06cc\u200c\u0632\u0646\u0646\u062f. \u06cc\u06a9 \u06a9\u0644\u0627\u06cc\u0646\u062a \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0646\u0648\u06cc\u0633\u06cc \u0634\u062f\u0647 (\u0645\u0627\u0646\u0646\u062f Python \u06cc\u0627 Go) \u06a9\u0644 \u0627\u06cc\u0646 \u0641\u0631\u0622\u06cc\u0646\u062f \u0631\u0627 \u062f\u0631 \u06cc\u06a9 \u062c\u0631\u06cc\u0627\u0646 \u0648\u0627\u062d\u062f \u0645\u062f\u06cc\u0631\u06cc\u062a \u0645\u06cc\u200c\u06a9\u0646\u062f.<\/p>\n<\/blockquote>\n<pre><code><span>grpcurl <span>-plaintext<\/span> -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>-proto<\/span> <span>\"<span>$PROTO_CERTZ<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${GRPC_MD<span>[<\/span>@<span>]<\/span>}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-d<\/span> <span>'@'<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${XR}<\/span>\"<\/span> gnsi.certz.v1.Certz.Rotate <span>&lt;&lt;<\/span><span>'EOF'\n<\/span><\/span><span><span>{\n<\/span><\/span><span><span> \"sslProfileId\": \"lab-profile-1\",\n<\/span><\/span><span><span> \"forceOverwrite\": true,\n<\/span><\/span><span><span> \"generateCsr\": {\n<\/span><\/span><span><span> \"params\": {\n<\/span><\/span><span><span> \"csrSuite\": \"CSRSUITE_X509_KEY_TYPE_ECDSA_PRIME256V1_SIGNATURE_ALGORITHM_SHA_2_256\",\n<\/span><\/span><span><span> \"commonName\": \"router.example.com\",\n<\/span><\/span><span><span> \"san\": { \"dns\": [\"router.example.com\"]}\n<\/span><\/span><span><span>}\n<\/span><\/span><span><span>}\n<\/span><\/span><span><span>}\n<\/span><\/span><span><span>{\"sslProfileId\": \"lab-profile-1\", \"finalizeRotation\": {}}\n<\/span><\/span><span><span>EOF<\/span>\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u067e\u0627\u0633\u062e \u0631\u0648\u062a\u0631 \u2014 \u0645\u0642\u062f\u0627\u0631 CSR \u0628\u0647 \u0635\u0648\u0631\u062a PEM \u0628\u0627 \u06a9\u062f\u06af\u0630\u0627\u0631\u06cc Base64 \u062f\u0631 \u062f\u0627\u062e\u0644 \u0628\u0627\u0632\u06af\u0631\u062f\u0627\u0646\u062f\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f<code>generatedCsr<\/code>. \u0645\u0642\u062f\u0627\u0631<code>certificateSigningRequest<\/code>\u0631\u0627 \u062f\u0631<code>CSR_B64<\/code>:<\/p>\n<pre><code><span><span>{<\/span>\n<\/span><span> <span>\"generatedCsr\"<\/span><span>:<\/span> <span>{<\/span>\n<\/span><span> <span>\"certificateSigningRequest\"<\/span><span>:<\/span> <span>{<\/span>\n<\/span><span> <span>\"type\"<\/span><span>:<\/span> <span>\"CERTIFICATE_TYPE_X509\"<\/span><span>,<\/span>\n<\/span><span> <span>\"encoding\"<\/span><span>:<\/span> <span>\"CERTIFICATE_ENCODING_PEM\"<\/span><span>,<\/span>\n<\/span><span> <span>\"certificateSigningRequest\"<\/span><span>:<\/span> <span>\"LS0tLS1CRUdJTi...\"<\/span>\n<\/span><span> <span>}<\/span>\n<\/span><span> <span>}<\/span>\n<\/span><span><span>}<\/span>\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u0631\u0645\u0632\u06af\u0634\u0627\u06cc\u06cc \u0648 \u0628\u0627\u0632\u0631\u0633\u06cc (Decode and inspect)<\/p>\n<pre><code><span><span>printf<\/span> <span>'%s'<\/span> <span>\"<span>$CSR_B64<\/span>\"<\/span> <span>|<\/span> base64 <span>-d<\/span> <span>&gt;<\/span> router.csr.pem\n<\/span><span>openssl req <span>-in<\/span> router.csr.pem <span>-noout<\/span> <span>-text<\/span>\n<\/span><\/code><\/pre>\n<h4 style=\"color: rgb(26, 26, 26); font-weight: 700\">\u0645\u0631\u062d\u0644\u0647 3 \u2014 \u0627\u0645\u0636\u0627\u06cc CSR \u062a\u0648\u0633\u0637 \u0645\u0631\u062c\u0639 \u06af\u0648\u0627\u0647\u06cc \u0645\u06cc\u0627\u0646\u06cc (Intermediate CA)<\/h4>\n<pre><code><span>openssl x509 <span>-req<\/span> <span>-in<\/span> router.csr.pem <span>\\<\/span>\n<\/span><span> <span>-CA<\/span> lab-pki\/intermediate\/intermediate.crt <span>\\<\/span>\n<\/span><span> <span>-CAkey<\/span> lab-pki\/intermediate\/intermediate.key <span>\\<\/span>\n<\/span><span> <span>-CAcreateserial<\/span> <span>\\<\/span>\n<\/span><span> <span>-out<\/span> router.crt <span>-days<\/span> <span>825<\/span> <span>-sha256<\/span>\n<\/span><\/code><\/pre>\n<h4 style=\"color: rgb(26, 26, 26); font-weight: 700\">\u0645\u0631\u062d\u0644\u0647 4 \u2014 \u062a\u0628\u062f\u06cc\u0644 PEM \u0628\u0631\u06af\u0650 \u0627\u0645\u0636\u0627\u0634\u062f\u0647 \u0628\u0647 \u0641\u0631\u0645\u062a Base64<\/h4>\n<pre><code><span><span>LEAF_B64<\/span><span>=<\/span><span><span>$(<\/span>base64 <span>&lt;<\/span> router.crt <span>|<\/span> <span>tr<\/span> <span>-d<\/span> <span>'\\n'<\/span><span>)<\/span><\/span>\n<\/span><\/code><\/pre>\n<h4 style=\"color: rgb(26, 26, 26); font-weight: 700\">\u0645\u0631\u062d\u0644\u0647 5 \u2014 \u0686\u0631\u062e\u0634: \u0628\u0631\u06af\u0647 \u0627\u0645\u0636\u0627\u0634\u062f\u0647 \u0631\u0627 \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc \u06a9\u0646\u06cc\u062f\u060c \u0633\u067e\u0633 \u0646\u0647\u0627\u06cc\u06cc \u0646\u0645\u0627\u06cc\u06cc\u062f<\/h4>\n<p style=\"direction: rtl; text-align: right\">\u062f\u0631 \u06cc\u06a9 \u06a9\u0644\u0627\u06cc\u0646\u062a \u062a\u06a9\u200c\u062c\u0631\u06cc\u0627\u0646\u06cc (single-stream)\u060c \u0622\u067e\u0644\u0648\u062f \u0628\u0631\u06af (leaf upload) \u0631\u0648\u06cc \u0647\u0645\u0627\u0646 \u0627\u062a\u0635\u0627\u0644\u06cc \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u06af\u06cc\u0631\u062f \u06a9\u0647 \u0628\u0647\u200c\u062a\u0627\u0632\u06af\u06cc CSR \u0631\u0627 \u062a\u0648\u0644\u06cc\u062f \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a\u061b \u0631\u0648\u062a\u0631 \u0647\u0645\u0686\u0646\u0627\u0646 \u06a9\u0644\u06cc\u062f \u06a9\u0627\u0646\u062f\u06cc\u062f (candidate Key) \u0631\u0627 \u062f\u0631 \u062d\u0627\u0641\u0638\u0647 \u062f\u0627\u0631\u062f \u0648 \u0641\u0642\u0637 \u0628\u0631\u06af (leaf-only) \u0631\u0627 \u0645\u06cc\u200c\u067e\u0630\u06cc\u0631\u062f<code>certificateChain<\/code>. \u0627\u0632 \u0622\u0646\u062c\u0627\u06cc\u06cc \u06a9\u0647<code>grpcurl<\/code>\u0645\u062c\u0628\u0648\u0631 \u0634\u062f \u062c\u0631\u06cc\u0627\u0646 (stream) \u0631\u0627 \u067e\u0633 \u0627\u0632 \u0645\u0631\u062d\u0644\u0647 2 \u0628\u0628\u0646\u062f\u062f\u060c \u06a9\u0644\u06cc\u062f \u06a9\u0627\u0646\u062f\u06cc\u062f (candidate Key) \u0628\u0647 \u0647\u0645\u0631\u0627\u0647 \u062a\u0631\u0627\u06a9\u0646\u0634 \u0628\u0627\u0632\u06af\u0631\u062f\u0627\u0646\u06cc\u200c\u0634\u062f\u0647 (rolled-back transaction) \u062d\u0630\u0641 \u0634\u062f. \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646\u060c \u0622\u067e\u0644\u0648\u062f \u0645\u062c\u062f\u062f \u0628\u0631\u06af \u0627\u0645\u0636\u0627 \u0634\u062f\u0647 \u062f\u0631 \u0641\u0631\u0627\u062e\u0648\u0627\u0646\u06cc (invocation) \u062f\u0648\u0645 \u0628\u0627 \u0634\u06a9\u0633\u062a \u0645\u0648\u0627\u062c\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f:<code>grpcurl<\/code>\u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u0641\u0631\u0627\u062e\u0648\u0627\u0646\u06cc (Invocation) \u0628\u0627 \u0634\u06a9\u0633\u062a \u0645\u0648\u0627\u062c\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f:<\/p>\n<pre><code><span><span>VER<\/span><span>=<\/span><span>\"lab-rotate-<span><span>$(<\/span><span>date<\/span> +%s<span>)<\/span><\/span>\"<\/span>\n<\/span><span><span>CREATED<\/span><span>=<\/span><span>\"<span><span>$(<\/span><span>date<\/span> +%s<span>)<\/span><\/span>\"<\/span>\n<\/span><span>grpcurl <span>-plaintext<\/span> -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>-proto<\/span> <span>\"<span>$PROTO_CERTZ<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${GRPC_MD<span>[<\/span>@<span>]<\/span>}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-d<\/span> <span>'@'<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${XR}<\/span>\"<\/span> gnsi.certz.v1.Certz.Rotate <span>&lt;&lt;<\/span><span>EOF\n<\/span><\/span><span><span>{\n<\/span><\/span><span><span> \"sslProfileId\": \"lab-profile-1\",\n<\/span><\/span><span><span> \"forceOverwrite\": true,\n<\/span><\/span><span><span> \"certificates\": {\n<\/span><\/span><span><span> \"entities\": [{\n<\/span><\/span><span><span> \"version\": \"<span>${VER}<\/span>\",\n<\/span><\/span><span><span> \"createdOn\": <span>${CREATED}<\/span>,\n<\/span><\/span><span><span> \"certificateChain\": {\n<\/span><\/span><span><span> \"certificate\": {\n<\/span><\/span><span><span> \"type\": \"CERTIFICATE_TYPE_X509\",\n<\/span><\/span><span><span> \"encoding\": \"CERTIFICATE_ENCODING_PEM\",\n<\/span><\/span><span><span> \"rawCertificate\": \"<span>${LEAF_B64}<\/span>\"\n<\/span><\/span><span><span>}\n<\/span><\/span><span><span>}\n<\/span><\/span><span><span>}]\n<\/span><\/span><span><span>}\n<\/span><\/span><span><span>}\n<\/span><\/span><span><span>{\"sslProfileId\": \"lab-profile-1\", \"finalizeRotation\": {}}\n<\/span><\/span><span><span>EOF<\/span>\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u067e\u0627\u0633\u062e \u0631\u0648\u062a\u0631 (Router) \u062f\u0631 \u0646\u0633\u062e\u0647 IOS XR 24.4.x:<\/p>\n<pre><code><span>ERROR:\n<\/span><span> Code: InvalidArgument\n<\/span><span> Message: No private key found for leaf cert\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u0627\u0641\u0632\u0648\u062f\u0646<code>keySource\": \"KEY_SOURCE_GENERATED<\/code>\u0628\u0647 \u06af\u0648\u0627\u0647\u06cc (certificate)<code>\u0628\u0631\u06af<\/code>\u0645\u0634\u06a9\u0644 \u062c\u0631\u06cc\u0627\u0646 (flow) \u0631\u0627 \u062d\u0644 \u0646\u0645\u06cc\u200c\u06a9\u0646\u062f \u2014 \u06a9\u0644\u06cc\u062f \u06a9\u0627\u0646\u062f\u06cc\u062f \u0627\u0632 \u0628\u06cc\u0646 \u0631\u0641\u062a\u0647 \u0627\u0633\u062a\u060c \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 \u0631\u0648\u062a\u0631 \u0647\u0645\u0686\u0646\u0627\u0646 \u0622\u067e\u0644\u0648\u062f \u0631\u0627 \u0628\u0627 \u0647\u0645\u0627\u0646 \u062e\u0637\u0627 \u0631\u062f \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0627\u06cc\u0646 \u062f\u0644\u06cc\u0644 \u0639\u0645\u0644\u06cc \u0627\u0633\u062a \u06a9\u0647 \u0686\u0631\u0627 \u0627\u06a9\u062b\u0631 \u0627\u067e\u0631\u0627\u062a\u0648\u0631\u0647\u0627 \u0647\u0646\u06af\u0627\u0645 \u06a9\u0627\u0631 \u0628\u0627<strong style=\"color: rgb(26, 26, 26)\">grpcurl<\/strong>\u0627\u0632 \u062c\u0631\u06cc\u0627\u0646<strong style=\"color: rgb(26, 26, 26)\">\u062a\u0648\u0644\u06cc\u062f \u0634\u062f\u0647 \u062a\u0648\u0633\u0637 \u06a9\u0644\u0627\u06cc\u0646\u062a (client-generated)<\/strong>(\u062c\u0631\u06cc\u0627\u0646 B \u062f\u0631 \u0632\u06cc\u0631) \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f. \u062c\u0631\u06cc\u0627\u0646 A \u062a\u0646\u0647\u0627 \u0632\u0645\u0627\u0646\u06cc \u0628\u0647 \u0635\u0648\u0631\u062a \u0633\u0631\u062a\u0627\u0633\u0631\u06cc (end-to-end) \u062a\u06a9\u0645\u06cc\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f \u06a9\u0647 \u0627\u0632 \u06cc\u06a9 \u06a9\u0644\u0627\u06cc\u0646\u062a \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0646\u0648\u06cc\u0633\u06cc \u0634\u062f\u0647 (Python, Go) \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u0648\u062f \u06a9\u0647 \u06cc\u06a9 \u0627\u0633\u062a\u0631\u06cc\u0645<code>Rotate<\/code>\u0631\u0627 \u062f\u0631 \u0637\u0648\u0644 \u0645\u0631\u0627\u062d\u0644 CSR \/ \u0627\u0645\u0636\u0627 \/ \u0622\u067e\u0644\u0648\u062f \/ \u0646\u0647\u0627\u06cc\u06cc\u200c\u0633\u0627\u0632\u06cc \u0628\u0627\u0632 \u0646\u06af\u0647 \u0645\u06cc\u200c\u062f\u0627\u0631\u062f.<code>\u0686\u0631\u062e\u0634 (Rotate)<\/code>\u062c\u0631\u06cc\u0627\u0646 (Stream) \u0628\u0627\u0632 \u062f\u0631 \u0645\u0631\u0627\u062d\u0644 CSR \/ \u0627\u0645\u0636\u0627 \/ \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc \/ \u0646\u0647\u0627\u06cc\u06cc\u200c\u0633\u0627\u0632\u06cc.<\/p>\n<p style=\"direction: rtl; text-align: right\">\u0628\u0631\u0627\u06cc \u0627\u0644\u06af\u0648\u06cc Trust Bundle (\u0645\u0628\u062a\u0646\u06cc \u0628\u0631 mutual TLS)\u060c \u0645\u0634\u0627\u0647\u062f\u0647 \u06a9\u0646\u06cc\u062f <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/gnsi-certz-tls-certificate-lifecycle-on-cisco-ios-xr#step-4b--optional-add-a-trust-bundle-entity\" style=\"color: rgb(0, 102, 204)\">\u06af\u0627\u0645 4b \u062f\u0631 Flow B<\/a> \u2014 \u0647\u0645\u0627\u0646 \u0686\u06cc\u062f\u0645\u0627\u0646 \u062a\u0648 \u062f\u0631 \u062a\u0648 (nested layout) \u0628\u0647 \u0635\u0648\u0631\u062a \u0633\u0631\u062a\u0627\u0633\u0631\u06cc \u0627\u0632<code>grpcurl<\/code>.<\/p>\n<h4 style=\"color: rgb(26, 26, 26); font-weight: 700\">Step 6 \u2014 Where to go from here<\/h4>\n<ul style=\"direction: rtl; text-align: right\">\n<li>\u0628\u0631\u0627\u06cc \u06cc\u06a9 \u0639\u0645\u0644\u06a9\u0631\u062f<code>grpcurl<\/code>\u0631\u0627\u0647\u0646\u0645\u0627\u060c \u0628\u0647 <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/gnsi-certz-tls-certificate-lifecycle-on-cisco-ios-xr#flow-b--client-generated-key-and-csr-full-chain-upload\" style=\"color: rgb(0, 102, 204)\">Flow B<\/a> \u062f\u0631 \u0632\u06cc\u0631 \u0645\u0631\u0627\u062c\u0639\u0647 \u06a9\u0646\u06cc\u062f.<\/li>\n<li>\u0628\u0631\u0627\u06cc \u067e\u06cc\u0627\u062f\u0647\u200c\u0633\u0627\u0632\u06cc \u0639\u0645\u0644\u06cc\u0627\u062a\u06cc Flow A\u060c \u0627\u0632 \u06cc\u06a9 \u06a9\u0644\u0627\u06cc\u0646\u062a \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0646\u0648\u06cc\u0633\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u06cc\u062f. \u0645\u062e\u0632\u0646 OpenConfig gNSI \u0634\u0627\u0645\u0644 \u06cc\u06a9 <a href=\"https:\/\/github.com\/openconfig\/gnsi\/tree\/main\/certz\/client\" style=\"color: rgb(0, 102, 204)\">\u06a9\u0644\u0627\u06cc\u0646\u062a \u0645\u0631\u062c\u0639 Go<\/a> \u0627\u0633\u062a \u06a9\u0647 \u062c\u0631\u06cc\u0627\u0646 Rotate \u0631\u0627 \u062f\u0631 \u0637\u0648\u0644 \u0628\u0627\u0632\u06cc\u0627\u0628\u06cc CSR\u060c \u0627\u0645\u0636\u0627\u06cc \u062e\u0627\u0631\u062c\u06cc\u060c \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc leaf \u0648 \u0646\u0647\u0627\u06cc\u06cc\u200c\u0633\u0627\u0632\u06cc \u0628\u0627\u0632 \u0646\u06af\u0647 \u0645\u06cc\u200c\u062f\u0627\u0631\u062f.<\/li>\n<\/ul>\n<hr>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u062c\u0631\u06cc\u0627\u0646 B \u2014 \u06a9\u0644\u06cc\u062f \u0648 CSR \u062a\u0648\u0644\u06cc\u062f \u0634\u062f\u0647 \u062a\u0648\u0633\u0637 \u06a9\u0644\u0627\u06cc\u0646\u062a (\u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc \u0632\u0646\u062c\u06cc\u0631\u0647 \u06a9\u0627\u0645\u0644)<\/h3>\n<p style=\"direction: rtl; text-align: right\">\u0627\u06cc\u0646 \u062c\u0631\u06cc\u0627\u0646 \u0628\u0627 \u0622\u0646\u0686\u0647 \u0628\u0633\u06cc\u0627\u0631\u06cc \u0627\u0632 \u0627\u067e\u0631\u0627\u062a\u0648\u0631\u0647\u0627 \u062f\u0631 \u062d\u0627\u0644 \u062d\u0627\u0636\u0631 \u0628\u0627 OpenSSL \u0627\u0646\u062c\u0627\u0645 \u0645\u06cc\u200c\u062f\u0647\u0646\u062f \u0645\u0637\u0627\u0628\u0642\u062a \u062f\u0627\u0631\u062f: \u0627\u06cc\u062c\u0627\u062f<code>server.key<\/code>\u060c \u0633\u0627\u062e\u062a \u06cc\u06a9 CSR\u060c \u0627\u0645\u0636\u0627\u06cc \u0622\u0646 \u0628\u0627 Intermediate CA\u060c \u0633\u067e\u0633 \u0627\u0631\u0633\u0627\u0644 leaf\u060c Key \u0648 \u0632\u0646\u062c\u06cc\u0631\u0647 \u0635\u0627\u062f\u0631\u06a9\u0646\u0646\u062f\u0647 (issuer chain) \u0627\u0632 \u0637\u0631\u06cc\u0642 Certz \u062f\u0631 \u06cc\u06a9<code>certificateChain<\/code>\u062a\u0648\u062f\u0631\u062a\u0648. \u067e\u0633 \u0627\u0632 \u0646\u0647\u0627\u06cc\u06cc\u200c\u0633\u0627\u0632\u06cc\u060c \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 \u0631\u0627 \u0628\u0627 \u062f\u0633\u062a\u0648\u0631 CLI \u062f\u0631 IOS XR \u0645\u062a\u0635\u0644 \u06a9\u0631\u062f\u0647 \u0648 \u0628\u0627 \u062f\u0633\u062a\u0648\u0631<code>show grpc certificate<\/code>.<\/p>\n<p style=\"direction: rtl; text-align: right\">In <code>certz.proto<\/code>, <code>certificateChain.certificate<\/code>\u0634\u0627\u0645\u0644 \u06af\u0648\u0627\u0647\u06cc PEM \u0628\u0631\u06af (leaf) \u0628\u0647 \u0647\u0645\u0631\u0627\u0647<code>rawPrivateKey<\/code>\u0628\u0631\u0627\u06cc \u0645\u062a\u0631\u06cc\u0627\u0644 \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a (Authentication) \u0633\u0631\u0648\u0631. \u0647\u0631 \u0635\u0627\u062f\u0631\u06a9\u0646\u0646\u062f\u0647 (issuer) \u062f\u0631 \u0632\u06cc\u0631\u0645\u062c\u0645\u0648\u0639\u0647<code>parent<\/code>\u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u06af\u06cc\u0631\u062f\u060c \u062a\u0627 \u0631\u0633\u06cc\u062f\u0646 \u0628\u0647 \u0631\u06cc\u0634\u0647 (Root) \u06a9\u0647 \u0641\u0627\u0642\u062f<code>parent<\/code>\u0627\u0633\u062a. \u0627\u062e\u062a\u06cc\u0627\u0631\u06cc<code>trustBundle<\/code>\u0645\u0648\u062c\u0648\u062f\u06cc\u062a\u200c\u0647\u0627 \u0627\u0632 \u0647\u0645\u0627\u0646 \u0633\u0627\u062e\u062a\u0627\u0631 \u062a\u0648 \u062f\u0631 \u062a\u0648 \u0628\u0631\u0627\u06cc \u0627\u0646\u062a\u0634\u0627\u0631 \u0645\u062a\u0631\u06cc\u0627\u0644 CA \u062c\u0647\u062a \u0627\u0639\u062a\u0628\u0627\u0631\u0633\u0646\u062c\u06cc \u06a9\u0644\u0627\u06cc\u0646\u062a\u200c\u0647\u0627\u06cc \u0645\u062a\u0635\u0644 (mutual TLS) \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u062c\u062f\u062f \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.<\/p>\n<blockquote style=\"direction: rtl; text-align: right\">\n<p><strong style=\"color: rgb(26, 26, 26)\">\u062a\u0648\u062c\u0647:<\/strong>\u062f\u0631 \u0645\u062d\u06cc\u0637 \u0639\u0645\u0644\u06cc\u0627\u062a\u06cc (Production)\u060c \u06a9\u0644\u06cc\u062f \u0631\u06cc\u0634\u0647 (Root Key) \u0628\u0647 \u0635\u0648\u0631\u062a \u0622\u0641\u0644\u0627\u06cc\u0646 \u0628\u0627\u0642\u06cc \u0645\u06cc\u200c\u0645\u0627\u0646\u062f\u061b \u062a\u0646\u0647\u0627 \u06a9\u0644\u06cc\u062f \u0645\u06cc\u0627\u0646\u06cc (Intermediate) \u0628\u0627\u06cc\u062f \u06af\u0648\u0627\u0647\u06cc\u200c\u0647\u0627\u06cc \u0646\u0647\u0627\u06cc\u06cc (Leaf Certificates) \u0631\u0648\u0632\u0645\u0631\u0647 \u0631\u0627 \u0627\u0645\u0636\u0627 \u06a9\u0646\u062f.<\/p>\n<\/blockquote>\n<h4 style=\"color: rgb(26, 26, 26); font-weight: 700\">\u0645\u0631\u062d\u0644\u0647 0 \u2014 \u062a\u0639\u06cc\u06cc\u0646 \u0646\u0627\u0645 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644<\/h4>\n<p style=\"direction: rtl; text-align: right\">\u0627\u06af\u0631 <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/gnsi-certz-tls-certificate-lifecycle-on-cisco-ios-xr#environment\" style=\"color: rgb(0, 102, 204)\">\u0645\u062d\u06cc\u0637 (Environment)<\/a> \u0628\u0644\u0648\u06a9 \u0627\u0632 \u0642\u0628\u0644 \u0635\u0627\u062f\u0631 (Export) \u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u0641\u0642\u0637 \u0646\u0627\u0645 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 (Profile name) \u0631\u0627 \u0627\u0636\u0627\u0641\u0647 \u06a9\u0646\u06cc\u062f:<\/p>\n<pre><code><span><span>export<\/span> <span>SSL_PROFILE_ID<\/span><span>=<\/span><span>\"<span>${SSL_PROFILE_ID<span>:-<\/span>lab-profile-1}<\/span>\"<\/span>\n<\/span><\/code><\/pre>\n<h4 style=\"color: rgb(26, 26, 26); font-weight: 700\">\u0645\u0631\u062d\u0644\u0647 1 \u2014 \u0627\u06cc\u062c\u0627\u062f \u06cc\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u062c\u062f\u062f \u0627\u0632 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 SSL<\/h4>\n<pre><code><span>grpcurl <span>-plaintext<\/span> -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>-proto<\/span> <span>\"<span>$PROTO_CERTZ<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${GRPC_MD<span>[<\/span>@<span>]<\/span>}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-d<\/span> <span>\"{<span title=\"\\&quot;\">\\\"<\/span>sslProfileId<span title=\"\\&quot;\">\\\"<\/span>:<span title=\"\\&quot;\">\\\"<\/span><span>${SSL_PROFILE_ID}<\/span><span title=\"\\&quot;\">\\\"<\/span>}\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${XR}<\/span>\"<\/span> gnsi.certz.v1.Certz.AddProfile <span>||<\/span> <span>true<\/span>\n<\/span><\/code><\/pre>\n<h4 style=\"color: rgb(26, 26, 26); font-weight: 700\">\u0645\u0631\u062d\u0644\u0647 2 \u2014 \u06a9\u0644\u06cc\u062f\u060c CSR \u0648 \u06af\u0648\u0627\u0647\u06cc \u0627\u0645\u0636\u0627\u0634\u062f\u0647 \u0631\u0648\u06cc \u0627\u06cc\u0633\u062a\u06af\u0627\u0647 \u06a9\u0627\u0631\u06cc<\/h4>\n<p style=\"direction: rtl; text-align: right\">\u0627\u0628\u062a\u062f\u0627 \u0628\u062e\u0634 PKI \u0622\u0632\u0645\u0627\u06cc\u0634\u06af\u0627\u0647 \u0631\u0627 \u062a\u06a9\u0645\u06cc\u0644 \u06a9\u0646\u06cc\u062f \u062a\u0627<code>lab-pki\/intermediate\/<\/code>\u0648<code>lab-pki\/root\/<\/code>\u0645\u0648\u062c\u0648\u062f \u0628\u0627\u0634\u0646\u062f:<\/p>\n<pre><code><span>openssl genrsa <span>-out<\/span> server.key <span>2048<\/span>\n<\/span><span>openssl req <span>-new<\/span> <span>-key<\/span> server.key <span>-out<\/span> server.csr <span>\\<\/span>\n<\/span><span> <span>-subj<\/span> <span>\"\/CN=router.example.com\/O=Lab\/C=US\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-addext<\/span> <span>\"subjectAltName=DNS:router.example.com\"<\/span>\n<\/span><span>openssl x509 <span>-req<\/span> <span>-in<\/span> server.csr <span>\\<\/span>\n<\/span><span> <span>-CA<\/span> lab-pki\/intermediate\/intermediate.crt <span>\\<\/span>\n<\/span><span> <span>-CAkey<\/span> lab-pki\/intermediate\/intermediate.key <span>\\<\/span>\n<\/span><span> <span>-CAcreateserial<\/span> <span>\\<\/span>\n<\/span><span> <span>-out<\/span> server.crt <span>-days<\/span> <span>825<\/span> <span>-sha256<\/span> <span>-copy_extensions<\/span> copy\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u062a\u0623\u06cc\u06cc\u062f \u0635\u062d\u062a leaf \u062f\u0631 \u0628\u0631\u0627\u0628\u0631 \u0632\u0646\u062c\u06cc\u0631\u0647 (chain):<\/p>\n<pre><code><span>openssl verify <span>-CAfile<\/span> lab-pki\/root\/root.crt <span>\\<\/span>\n<\/span><span> <span>-untrusted<\/span> lab-pki\/intermediate\/intermediate.crt <span>\\<\/span>\n<\/span><span> server.crt\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">If <code>-copy_extensions copy<\/code>\u062f\u0631 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0642\u062f\u06cc\u0645\u06cc\u200c\u062a\u0631 OpenSSL \u062f\u0631 \u062f\u0633\u062a\u0631\u0633 \u0646\u06cc\u0633\u062a\u060c \u0627\u0632<code>-extfile<\/code>\u0628\u0647 \u0647\u0645\u0631\u0627\u0647 \u06cc\u06a9 \u0642\u0637\u0639\u0647 SAN \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u06cc\u062f.<\/p>\n<h4 style=\"color: rgb(26, 26, 26); font-weight: 700\">\u0645\u0631\u062d\u0644\u0647 3 \u2014 \u062a\u0628\u062f\u06cc\u0644 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc PEM \u0628\u0647 \u0641\u0631\u0645\u062a Base64 \u0628\u0631\u0627\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u062f\u0631 JSON<\/h4>\n<pre><code><span><span>CERT_B64<\/span><span>=<\/span><span><span>$(<\/span>base64 <span>&lt;<\/span> server.crt <span>|<\/span> <span>tr<\/span> <span>-d<\/span> <span>'\\n'<\/span><span>)<\/span><\/span>\n<\/span><span><span>KEY_B64<\/span><span>=<\/span><span><span>$(<\/span>base64 <span>&lt;<\/span> server.key <span>|<\/span> <span>tr<\/span> <span>-d<\/span> <span>'\\n'<\/span><span>)<\/span><\/span>\n<\/span><span><span>INT_B64<\/span><span>=<\/span><span><span>$(<\/span>base64 <span>&lt;<\/span> lab-pki\/intermediate\/intermediate.crt <span>|<\/span> <span>tr<\/span> <span>-d<\/span> <span>'\\n'<\/span><span>)<\/span><\/span>\n<\/span><span><span>ROOT_B64<\/span><span>=<\/span><span><span>$(<\/span>base64 <span>&lt;<\/span> lab-pki\/root\/root.crt <span>|<\/span> <span>tr<\/span> <span>-d<\/span> <span>'\\n'<\/span><span>)<\/span><\/span>\n<\/span><span><span>VER<\/span><span>=<\/span><span>\"lab-chain-<span><span>$(<\/span><span>date<\/span> +%s<span>)<\/span><\/span>\"<\/span>\n<\/span><span><span>CREATED<\/span><span>=<\/span><span>\"<span><span>$(<\/span><span>date<\/span> +%s<span>)<\/span><\/span>\"<\/span>\n<\/span><span><span>VER_TRUST<\/span><span>=<\/span><span>\"<span>${VER}<\/span>-trust\"<\/span>\n<\/span><\/code><\/pre>\n<h4 style=\"color: rgb(26, 26, 26); font-weight: 700\">\u0645\u0631\u062d\u0644\u0647 4 \u2014 \u0686\u0631\u062e\u0634: \u0632\u0646\u062c\u06cc\u0631\u0647 \u062a\u0648 \u062f\u0631 \u062a\u0648 \u0631\u0627 \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc \u06a9\u0646\u06cc\u062f\u060c \u0633\u067e\u0633 \u0646\u0647\u0627\u06cc\u06cc\u200c\u0633\u0627\u0632\u06cc \u0646\u0645\u0627\u06cc\u06cc\u062f<\/h4>\n<p style=\"direction: rtl; text-align: right\">\u062f\u0648 \u0634\u06cc\u0621 JSON \u0627\u0632 \u0637\u0631\u06cc\u0642 grpcurl \u0628\u0627<code>-d '@<\/code>: \u0627\u0648\u0644\u06cc \u062d\u0627\u0645\u0644<code>\u06af\u0648\u0627\u0647\u06cc\u200c\u0647\u0627 (certificates)<\/code>\u0628\u0627 \u06cc\u06a9<code>\u0632\u0646\u062c\u06cc\u0631\u0647 \u06af\u0648\u0627\u0647\u06cc (certificateChain) \u062a\u0648 \u062f\u0631 \u062a\u0648<\/code>\u060c \u062f\u0648\u0645\u06cc \u0646\u0647\u0627\u06cc\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f. \u062a\u06a9\u0631\u0627\u0631 \u06a9\u0646\u06cc\u062f<code>\u0634\u0646\u0627\u0633\u0647 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 \u0627\u0633\u200c\u0627\u0633\u200c\u0627\u0644 (sslProfileId)<\/code>\u0631\u0648\u06cc \u0647\u0631 \u062f\u0648 \u0634\u06cc\u0621 \u0628\u0631\u0627\u06cc \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc IOS XR \u06a9\u0647 \u0622\u0646 \u0631\u0627 \u0627\u0639\u0645\u0627\u0644 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f.<\/p>\n<p style=\"direction: rtl; text-align: right\">Intermediate \u0627\u0648\u0644\u06cc\u0646 \u0645\u0648\u0631\u062f \u0627\u0633\u062a<code>\u0648\u0627\u0644\u062f (parent)<\/code>\u062f\u0631 \u0632\u06cc\u0631 leaf \u0642\u0631\u0627\u0631 \u062f\u0627\u0631\u062f\u061b Root \u0647\u0645\u0627\u0646<code>\u0648\u0627\u0644\u062f (parent)<\/code>\u0622\u0646 Intermediate \u0627\u0633\u062a. \u062a\u0646\u0647\u0627 \u0634\u06cc\u0621 leaf \u0634\u0627\u0645\u0644<code>rawPrivateKey \u0627\u0633\u062a<\/code>.<\/p>\n<pre><code><span>grpcurl <span>-plaintext<\/span> -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>-proto<\/span> <span>\"<span>$PROTO_CERTZ<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${GRPC_MD<span>[<\/span>@<span>]<\/span>}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-format<\/span> json <span>-d<\/span> <span>'@'<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${XR}<\/span>\"<\/span> gnsi.certz.v1.Certz.Rotate <span>&lt;&lt;<\/span><span>EOF\n<\/span><\/span><span><span>{\n<\/span><\/span><span><span> \"sslProfileId\": \"<span>${SSL_PROFILE_ID}<\/span>\",\n<\/span><\/span><span><span> \"forceOverwrite\": true,\n<\/span><\/span><span><span> \"certificates\": {\n<\/span><\/span><span><span> \"entities\": [{\n<\/span><\/span><span><span> \"version\": \"<span>${VER}<\/span>\",\n<\/span><\/span><span><span> \"createdOn\": <span>${CREATED}<\/span>,\n<\/span><\/span><span><span> \"certificateChain\": {\n<\/span><\/span><span><span> \"certificate\": {\n<\/span><\/span><span><span> \"type\": \"CERTIFICATE_TYPE_X509\",\n<\/span><\/span><span><span> \"encoding\": \"CERTIFICATE_ENCODING_PEM\",\n<\/span><\/span><span><span> \"rawCertificate\": \"<span>${CERT_B64}<\/span>\",\n<\/span><\/span><span><span> \"rawPrivateKey\": \"<span>${KEY_B64}<\/span>\"\n<\/span><\/span><span><span>},\n<\/span><\/span><span><span> \"parent\": {\n<\/span><\/span><span><span> \"certificate\": {\n<\/span><\/span><span><span> \"type\": \"CERTIFICATE_TYPE_X509\",\n<\/span><\/span><span><span> \"encoding\": \"CERTIFICATE_ENCODING_PEM\",\n<\/span><\/span><span><span> \"rawCertificate\": \"<span>${INT_B64}<\/span>\"\n<\/span><\/span><span><span>},\n<\/span><\/span><span><span> \"parent\": {\n<\/span><\/span><span><span> \"certificate\": {\n<\/span><\/span><span><span> \"type\": \"CERTIFICATE_TYPE_X509\",\n<\/span><\/span><span><span> \"encoding\": \"CERTIFICATE_ENCODING_PEM\",\n<\/span><\/span><span><span> \"rawCertificate\": \"<span>${ROOT_B64}<\/span>\"\n<\/span><\/span><span><span>}\n<\/span><\/span><span><span>}\n<\/span><\/span><span><span>}\n<\/span><\/span><span><span>}\n<\/span><\/span><span><span>}]\n<\/span><\/span><span><span>}\n<\/span><\/span><span><span>}\n<\/span><\/span><span><span>{\"sslProfileId\": \"<span>${SSL_PROFILE_ID}<\/span>\", \"finalizeRotation\": {}}\n<\/span><\/span><span><span>EOF<\/span>\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u067e\u0627\u0633\u062e \u0631\u0648\u062a\u0631 (Router response)<\/p>\n<pre><code><span><span>{<\/span>\n<\/span><span> <span>\"certificates\"<\/span><span>:<\/span> <span>{<\/span><span>}<\/span>\n<\/span><span><span>}<\/span>\n<\/span><span><span>{<\/span><span>}<\/span>\n<\/span><\/code><\/pre>\n<h4 style=\"color: rgb(26, 26, 26); font-weight: 700\">\u0645\u0631\u062d\u0644\u0647 4\u0628 \u2014 \u0627\u062e\u062a\u06cc\u0627\u0631\u06cc: \u0627\u0641\u0632\u0648\u062f\u0646 \u06cc\u06a9 \u0645\u0648\u062c\u0648\u062f\u06cc\u062a \u0645\u062c\u0645\u0648\u0639\u0647 \u0627\u0639\u062a\u0645\u0627\u062f (Trust Bundle Entity)<\/h4>\n<p style=\"direction: rtl; text-align: right\">\u0627\u06cc\u0646 \u0645\u0648\u0631\u062f \u0631\u0627 \u0632\u0645\u0627\u0646\u06cc \u0627\u0636\u0627\u0641\u0647 \u06a9\u0646\u06cc\u062f \u06a9\u0647 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 \u0628\u0627\u06cc\u062f \u0628\u0631\u0627\u06cc \u0627\u0639\u062a\u0628\u0627\u0631\u0633\u0646\u062c\u06cc \u06a9\u0644\u0627\u06cc\u0646\u062a\u200c\u0647\u0627\u06cc \u0645\u062a\u0635\u0644\u060c \u0645\u062d\u062a\u0648\u0627\u06cc CA \u0631\u0627 \u0646\u06cc\u0632 \u0645\u0646\u062a\u0634\u0631 \u06a9\u0646\u062f.<code>VER_TRUST<\/code>\u062f\u0631 \u0645\u0631\u062d\u0644\u0647 3 \u0622\u0645\u0627\u062f\u0647 \u0634\u062f. \u0622\u0631\u0627\u06cc\u0647<code>entities<\/code>\u0628\u0647 \u062f\u0648 \u0639\u0646\u0635\u0631 \u062a\u0628\u062f\u06cc\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f:<\/p>\n<pre><code><span>grpcurl <span>-plaintext<\/span> -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>-proto<\/span> <span>\"<span>$PROTO_CERTZ<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${GRPC_MD<span>[<\/span>@<span>]<\/span>}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-format<\/span> json <span>-d<\/span> <span>'@'<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${XR}<\/span>\"<\/span> gnsi.certz.v1.Certz.Rotate <span>&lt;&lt;<\/span><span>EOF\n<\/span><\/span><span><span>{\n<\/span><\/span><span><span> \"sslProfileId\": \"<span>${SSL_PROFILE_ID}<\/span>\",\n<\/span><\/span><span><span> \"forceOverwrite\": true,\n<\/span><\/span><span><span> \"certificates\": {\n<\/span><\/span><span><span> \"entities\": [\n<\/span><\/span><span><span> {\n<\/span><\/span><span><span> \"version\": \"<span>${VER}<\/span>\",\n<\/span><\/span><span><span> \"createdOn\": <span>${CREATED}<\/span>,\n<\/span><\/span><span><span> \"certificateChain\": {\n<\/span><\/span><span><span> \"certificate\": {\n<\/span><\/span><span><span> \"type\": \"CERTIFICATE_TYPE_X509\",\n<\/span><\/span><span><span> \"encoding\": \"CERTIFICATE_ENCODING_PEM\",\n<\/span><\/span><span><span> \"rawCertificate\": \"<span>${CERT_B64}<\/span>\",\n<\/span><\/span><span><span> \"rawPrivateKey\": \"<span>${KEY_B64}<\/span>\"\n<\/span><\/span><span><span>},\n<\/span><\/span><span><span> \"parent\": {\n<\/span><\/span><span><span> \"certificate\": {\n<\/span><\/span><span><span> \"type\": \"CERTIFICATE_TYPE_X509\",\n<\/span><\/span><span><span> \"encoding\": \"CERTIFICATE_ENCODING_PEM\",\n<\/span><\/span><span><span> \"rawCertificate\": \"<span>${INT_B64}<\/span>\"\n<\/span><\/span><span><span>},\n<\/span><\/span><span><span> \"parent\": {\n<\/span><\/span><span><span> \"certificate\": {\n<\/span><\/span><span><span> \"type\": \"CERTIFICATE_TYPE_X509\",\n<\/span><\/span><span><span> \"encoding\": \"CERTIFICATE_ENCODING_PEM\",\n<\/span><\/span><span><span> \"rawCertificate\": \"<span>${ROOT_B64}<\/span>\"\n<\/span><\/span><span><span>}\n<\/span><\/span><span><span>}\n<\/span><\/span><span><span>}\n<\/span><\/span><span><span>}\n<\/span><\/span><span><span>},\n<\/span><\/span><span><span> {\n<\/span><\/span><span><span> \"version\": \"<span>${VER_TRUST}<\/span>\",\n<\/span><\/span><span><span> \"createdOn\": <span>${CREATED}<\/span>,\n<\/span><\/span><span><span> \"trustBundle\": {\n<\/span><\/span><span><span> \"certificate\": {\n<\/span><\/span><span><span> \"type\": \"CERTIFICATE_TYPE_X509\",\n<\/span><\/span><span><span> \"encoding\": \"CERTIFICATE_ENCODING_PEM\",\n<\/span><\/span><span><span> \"rawCertificate\": \"<span>${INT_B64}<\/span>\"\n<\/span><\/span><span><span>},\n<\/span><\/span><span><span> \"parent\": {\n<\/span><\/span><span><span> \"certificate\": {\n<\/span><\/span><span><span> \"type\": \"CERTIFICATE_TYPE_X509\",\n<\/span><\/span><span><span> \"encoding\": \"CERTIFICATE_ENCODING_PEM\",\n<\/span><\/span><span><span> \"rawCertificate\": \"<span>${ROOT_B64}<\/span>\"\n<\/span><\/span><span><span>}\n<\/span><\/span><span><span>}\n<\/span><\/span><span><span>}\n<\/span><\/span><span><span>}\n<\/span><\/span><span><span>]\n<\/span><\/span><span><span>}\n<\/span><\/span><span><span>}\n<\/span><\/span><span><span>{\"sslProfileId\": \"<span>${SSL_PROFILE_ID}<\/span>\", \"finalizeRotation\": {}}\n<\/span><\/span><span><span>EOF<\/span>\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u067e\u0627\u0633\u062e \u0631\u0648\u062a\u0631 (Router response)<\/p>\n<pre><code><span><span>{<\/span>\n<\/span><span> <span>\"certificates\"<\/span><span>:<\/span> <span>{<\/span><span>}<\/span>\n<\/span><span><span>}<\/span>\n<\/span><span><span>{<\/span><span>}<\/span>\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u0627\u06af\u0631 \u062e\u0637\u0627\u0647\u0627\u06cc \u062a\u0648 \u062f\u0631 \u062a\u0648 (Nesting errors) \u0647\u0645\u0686\u0646\u0627\u0646 \u0628\u0627\u0642\u06cc \u0645\u0627\u0646\u062f\u060c \u062f\u0633\u062a\u0648\u0631 \u0632\u06cc\u0631 \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u06cc\u062f:<code>grpcurl -import-path \"$GNSI_IMPORT\" -proto \"$PROTO_CERTZ\" -msg-template describe gnsi.certz.v1.CertificateChain<\/code>\u0648 \u0646\u0627\u0645 \u0641\u06cc\u0644\u062f\u0647\u0627 \u0631\u0627 \u0628\u0627\u0632\u062a\u0627\u0628 \u062f\u0647\u06cc\u062f. \u0627\u06cc\u0646 \u0642\u0627\u0644\u0628 \u0646\u0627\u0645\u200c\u0647\u0627\u06cc \u0645\u0646\u0633\u0648\u062e\u200c\u0634\u062f\u0647 \u067e\u0631\u0648\u062a\u0648 (Proto) \u0631\u0627 \u0686\u0627\u067e \u0645\u06cc\u200c\u06a9\u0646\u062f (<code>certificate<\/code>, <code>privateKey<\/code>)\u061b \u0646\u0627\u0645\u200c\u0647\u0627\u06cc \u0633\u0627\u0632\u06af\u0627\u0631 \u0628\u0627 \u0633\u06cc\u0645 (Wire-compatible) \u06a9\u0647 \u062f\u0631 \u0628\u0627\u0644\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u062f\u0647\u200c\u0627\u0646\u062f (<code>rawCertificate<\/code>, <code>rawPrivateKey<\/code>) \u0645\u062a\u0639\u0644\u0642 \u0628\u0647 \u0627\u0646\u0648\u0627\u0639 \u0645\u062f\u0631\u0646 oneof \u0647\u0633\u062a\u0646\u062f \u0648 \u0647\u0645\u0627\u0646 \u0686\u06cc\u0632\u06cc \u0647\u0633\u062a\u0646\u062f \u06a9\u0647 \u062a\u0645\u0627\u0645 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0627\u062e\u06cc\u0631 IOS XR \u0645\u06cc\u200c\u067e\u0630\u06cc\u0631\u0646\u062f.<\/p>\n<h4 style=\"color: rgb(26, 26, 26); font-weight: 700\">\u0645\u0631\u062d\u0644\u0647 5 \u2014 \u0641\u0639\u0627\u0644\u200c\u0633\u0627\u0632\u06cc \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 (IOS XR CLI)<\/h4>\n<pre><code><span>configure\n<\/span><span> grpc gnsi service certz ssl-profile-id lab-profile-1\n<\/span><span> commit\n<\/span><span>end\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u062c\u0627\u06cc\u06af\u0632\u06cc\u0646\u06cc<code>lab-profile-1<\/code>\u0628\u0631\u0627\u06cc<code>${SSL_PROFILE_ID}<\/code>\u0627\u06af\u0631 \u0646\u0627\u0645 \u0645\u062a\u0641\u0627\u0648\u062a\u06cc \u0635\u0627\u062f\u0631 \u0634\u062f\u0647 \u0628\u0627\u0634\u062f.<\/p>\n<h4 style=\"color: rgb(26, 26, 26); font-weight: 700\">\u0645\u0631\u062d\u0644\u0647 6 \u2014 \u062a\u0623\u06cc\u06cc\u062f \u0632\u0646\u062c\u06cc\u0631\u0647 \u0648 \u0645\u0633\u062a\u0646\u062f\u0627\u062a \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a<\/h4>\n<pre><code><span>show grpc certificate\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u062a\u0623\u06cc\u06cc\u062f \u0645\u0648\u0636\u0648\u0639 (Subject)\u060c \u0635\u0627\u062f\u0631\u06a9\u0646\u0646\u062f\u0647 (Issuer)\u060c \u062a\u0627\u0631\u06cc\u062e\u200c\u0647\u0627\u06cc \u0627\u0639\u062a\u0628\u0627\u0631 (Validity dates) \u0648 \u0627\u0637\u0645\u06cc\u0646\u0627\u0646 \u0627\u0632 \u0627\u06cc\u0646\u06a9\u0647 \u0632\u0646\u062c\u06cc\u0631\u0647 \u06af\u0648\u0627\u0647\u06cc\u060c Intermediate \u0631\u0627 \u0628\u0647 \u0639\u0646\u0648\u0627\u0646 \u0635\u0627\u062f\u0631\u06a9\u0646\u0646\u062f\u0647 \u0628\u0631\u06af (Leaf issuer) \u0648 Root \u0631\u0627 \u062f\u0631 \u0644\u0646\u06af\u0631 \u0627\u0639\u062a\u0645\u0627\u062f (Trust Anchor) \u0646\u0634\u0627\u0646 \u0645\u06cc\u200c\u062f\u0647\u062f. \u062e\u0631\u0648\u062c\u06cc \u0646\u0645\u0648\u0646\u0647:<\/p>\n<pre><code><span>RP\/0\/RP0\/CPU0:router# show grpc certificate\n<\/span><span>Tue Apr 22 18:40:11.218 UTC\n<\/span><span>SSL Profile: lab-profile-1\n<\/span><span> Certificate:\n<\/span><span> Subject: CN=router.example.com, O=Lab, C=US\n<\/span><span> Issuer: CN=Lab Issuing CA, O=Lab, C=US\n<\/span><span> Validity:\n<\/span><span> Not Before: Apr 22 18:32:01 2026 GMT\n<\/span><span> Not After: Jul 26 18:32:01 2028 GMT\n<\/span><span> CA chain:\n<\/span><span> Subject: CN=Lab Issuing CA, O=Lab, C=US\n<\/span><span> Issuer: CN=Lab Root CA, O=Lab, C=US\n<\/span><span> Subject: CN=Lab Root CA, O=Lab, C=US\n<\/span><span> Issuer: CN=Lab Root CA, O=Lab, C=US\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u0647\u0646\u06af\u0627\u0645\u06cc \u06a9\u0647 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 (Profile) \u0645\u062a\u0635\u0644 (Bound) \u0634\u062f\u060c \u0632\u06cc\u0631\u062f\u0631\u062e\u062a \u0648\u0636\u0639\u06cc\u062a (State subtree) \u062f\u0631 gNMI \u0646\u06cc\u0632 \u0645\u0642\u062f\u0627\u0631\u062f\u0647\u06cc \u0645\u06cc\u200c\u0634\u0648\u062f:<\/p>\n<pre><code><span>gnmic <span>-a<\/span> <span>\"<span>${XR}<\/span>\"<\/span> <span>--insecure<\/span> <span>-u<\/span> <span>\"<span>${XR_USER}<\/span>\"<\/span> <span>-p<\/span> <span>\"<span>${XR_PASS}<\/span>\"<\/span> <span>-e<\/span> json_ietf <span>\\<\/span>\n<\/span><span> get <span>--path<\/span> <span>\"\/system\/grpc-servers\/grpc-server[name=DEFAULT]\/state\/ssl-profile-id\"<\/span> <span>\\<\/span>\n<\/span><span> <span>--path<\/span> <span>\"\/system\/grpc-servers\/grpc-server[name=DEFAULT]\/state\/certificate-version\"<\/span>\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u067e\u0627\u0633\u062e \u0627\u06a9\u0646\u0648\u0646 \u0634\u0646\u0627\u0633\u0647 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 (Profile ID) \u0645\u062a\u0635\u0644 \u0634\u062f\u0647 \u0648<code>\u0646\u0633\u062e\u0647<\/code>\u0631\u0634\u062a\u0647 (string) \u062d\u0627\u0635\u0644 \u0627\u0632 \u0622\u062e\u0631\u06cc\u0646 \u0639\u0645\u0644\u06cc\u0627\u062a \u0645\u0648\u0641\u0642 Rotate \u0631\u0627 \u0628\u0627\u0632\u0645\u06cc\u200c\u06af\u0631\u062f\u0627\u0646\u062f.<\/p>\n<h4 style=\"color: rgb(26, 26, 26); font-weight: 700\">\u0645\u0631\u062d\u0644\u0647 7 \u2014 \u067e\u0627\u06a9\u200c\u0633\u0627\u0632\u06cc \u0627\u062e\u062a\u06cc\u0627\u0631\u06cc \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 DeleteProfile<\/h4>\n<pre><code><span>grpcurl <span>-plaintext<\/span> -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>-proto<\/span> <span>\"<span>$PROTO_CERTZ<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${GRPC_MD<span>[<\/span>@<span>]<\/span>}<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> <span>-d<\/span> <span>\"{<span title=\"\\&quot;\">\\\"<\/span>sslProfileId<span title=\"\\&quot;\">\\\"<\/span>:<span title=\"\\&quot;\">\\\"<\/span><span>${SSL_PROFILE_ID}<\/span><span title=\"\\&quot;\">\\\"<\/span>}\"<\/span> <span>\\<\/span>\n<\/span><span> <span>\"<span>${XR}<\/span>\"<\/span> gnsi.certz.v1.Certz.DeleteProfile\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u0641\u0642\u0637 \u0632\u0645\u0627\u0646\u06cc \u0639\u0645\u0644\u06cc\u0627\u062a \u067e\u0627\u06a9\u200c\u0633\u0627\u0632\u06cc (Cleanup) \u0631\u0627 \u0627\u062c\u0631\u0627 \u06a9\u0646\u06cc\u062f \u06a9\u0647 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 (Profile) \u0628\u0647 \u0633\u0631\u0648\u0631 \u0632\u0646\u062f\u0647 gRPC \u0645\u062a\u0635\u0644 \u0646\u0628\u0627\u0634\u062f.<\/p>\n<h4 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u0646\u0633\u062e\u0647 \u062d\u062f\u0627\u0642\u0644\u06cc (\u0628\u0631\u06af + \u0641\u0642\u0637 \u06a9\u0644\u06cc\u062f) \u2014 \u062f\u0631 \u0627\u06cc\u0646 \u0622\u0632\u0645\u0627\u06cc\u0634\u06af\u0627\u0647 \u0627\u0639\u062a\u0628\u0627\u0631\u0633\u0646\u062c\u06cc \u0646\u0634\u062f\u0647 \u0627\u0633\u062a<\/h4>\n<p style=\"direction: rtl; text-align: right\">\u0627\u06af\u0631 \u062a\u0645\u0627\u0645\u06cc \u0647\u0645\u062a\u0627\u06cc\u0627\u0646 (Peers) \u0627\u0632 \u0642\u0628\u0644 \u0628\u0647 \u0635\u0627\u062f\u0631\u06a9\u0646\u0646\u062f\u06af\u0627\u0646 \u062e\u0627\u0631\u062c \u0627\u0632 \u0628\u0627\u0646\u062f (Out of Band) \u0627\u0639\u062a\u0645\u0627\u062f \u062f\u0627\u0631\u0646\u062f\u060c \u0628\u0627\u0631\u06af\u0630\u0627\u0631\u06cc \u062a\u0646\u0647\u0627 \u06af\u0631\u0647 \u0628\u0631\u06af (Leaf) \u0648 \u06a9\u0644\u06cc\u062f (Key) \u062f\u0631\u0648\u0646<code>\u0632\u0646\u062c\u06cc\u0631\u0647 \u06af\u0648\u0627\u0647\u06cc (certificateChain)<\/code>\u0628\u062f\u0648\u0646 \u0647\u06cc\u0686<code>\u06af\u0631\u0647 (Node)<\/code>\u0648\u0627\u0644\u062f (Parent) \u062a\u0648\u0633\u0637 \u067e\u0631\u0648\u062a\u0648 (Proto) \u0645\u062c\u0627\u0632 \u0627\u0633\u062a. \u0627\u06cc\u0646 \u0645\u0642\u0627\u0644\u0647 \u0628\u0647 \u0635\u0648\u0631\u062a \u0633\u0631\u062a\u0627\u0633\u0631\u06cc (End-to-End) \u0628\u0627 \u0686\u06cc\u062f\u0645\u0627\u0646 \u062a\u0648 \u062f\u0631 \u062a\u0648 (Nested) \u0627\u0632 \u0645\u0631\u062d\u0644\u0647 4 \u0627\u0639\u062a\u0628\u0627\u0631\u0633\u0646\u062c\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a\u061b \u0627\u06af\u0631 \u062f\u0631 \u0645\u062d\u06cc\u0637 \u0639\u0645\u0644\u06cc\u0627\u062a\u06cc (Production) \u0628\u0647 \u0646\u0633\u062e\u0647 \u062d\u062f\u0627\u0642\u0644\u06cc \u0646\u06cc\u0627\u0632 \u062f\u0627\u0631\u06cc\u062f\u060c \u067e\u06cc\u0634 \u0627\u0632 \u062a\u06a9\u06cc\u0647 \u0628\u0631 \u0622\u0646\u060c \u0631\u0641\u062a\u0627\u0631 \u062f\u0642\u06cc\u0642 \u0631\u0627 \u062f\u0631 \u0646\u0633\u062e\u0647 IOS XR \u0647\u062f\u0641 \u062a\u0623\u06cc\u06cc\u062f \u06a9\u0646\u06cc\u062f.<code>\u06af\u0631\u0647 (Node)<\/code>\u0637\u0631\u062d\u200c\u0628\u0646\u062f\u06cc (Layout) \u0627\u0632 \u0645\u0631\u062d\u0644\u0647 4\u061b \u0627\u06af\u0631 \u062f\u0631 \u0645\u062d\u06cc\u0637 \u0639\u0645\u0644\u06cc\u0627\u062a\u06cc (Production) \u0628\u0647 \u0646\u0633\u062e\u0647 \u062d\u062f\u0627\u0642\u0644\u06cc \u0646\u06cc\u0627\u0632 \u062f\u0627\u0631\u06cc\u062f\u060c \u067e\u06cc\u0634 \u0627\u0632 \u0627\u0633\u062a\u0641\u0627\u062f\u0647\u060c \u0631\u0641\u062a\u0627\u0631 \u062f\u0642\u06cc\u0642 \u0622\u0646 \u0631\u0627 \u062f\u0631 \u0646\u0633\u062e\u0647 IOS XR \u0645\u0642\u0635\u062f \u062a\u0623\u06cc\u06cc\u062f \u06a9\u0646\u06cc\u062f.<\/p>\n<hr>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u0627\u0628\u0632\u0627\u0631\u0647\u0627\u06cc \u0639\u06cc\u0628\u200c\u06cc\u0627\u0628\u06cc (Debugging) \u0628\u0627 grpcurl<\/h3>\n<p style=\"direction: rtl; text-align: right\">The<code>-msg-template<\/code>\u067e\u0631\u0686\u0645 (flag) \u062a\u0631\u06a9\u06cc\u0628\u06cc \u0628\u0627<code>describe<\/code>\u0634\u06a9\u0644 \u0627\u0633\u062a\u0627\u0646\u062f\u0627\u0631\u062f JSON \u0631\u0627 \u0628\u0631\u0627\u06cc \u0647\u0631 \u067e\u06cc\u0627\u0645 \u0686\u0627\u067e \u0645\u06cc\u200c\u06a9\u0646\u062f \u2014 \u06a9\u0647 \u0647\u0646\u06af\u0627\u0645 \u0631\u062f\u06cc\u0627\u0628\u06cc \u062e\u0637\u0627\u0647\u0627\u06cc \u062a\u0648 \u062f\u0631 \u062a\u0648 (nesting errors) \u0628\u0633\u06cc\u0627\u0631 \u06a9\u0627\u0631\u0628\u0631\u062f\u06cc \u0627\u0633\u062a:<\/p>\n<pre><code><span>grpcurl -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>-proto<\/span> <span>\"<span>$PROTO_CERTZ<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> -msg-template describe gnsi.certz.v1.RotateCertificateRequest\n<\/span><span>grpcurl -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>-proto<\/span> <span>\"<span>$PROTO_CERTZ<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> -msg-template describe gnsi.certz.v1.UploadRequest\n<\/span><span>grpcurl -import-path <span>\"<span>$GNSI_IMPORT<\/span>\"<\/span> <span>-proto<\/span> <span>\"<span>$PROTO_CERTZ<\/span>\"<\/span> <span>\\<\/span>\n<\/span><span> -msg-template describe gnsi.certz.v1.CertificateChain\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u0627\u06cc\u0646 \u0642\u0627\u0644\u0628 \u0627\u0632 \u0646\u0627\u0645\u200c\u0647\u0627\u06cc \u0641\u06cc\u0644\u062f \u0645\u0646\u0633\u0648\u062e\u200c\u0634\u062f\u0647 (deprecated) \u062f\u0631 proto \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc\u200c\u06a9\u0646\u062f (<code>\u06af\u0648\u0627\u0647\u06cc (certificate)<\/code>, <code>\u06a9\u0644\u06cc\u062f \u062e\u0635\u0648\u0635\u06cc (privateKey)<\/code>); \u0634\u0627\u062e\u0647\u200c\u0647\u0627\u06cc \u0645\u062f\u0631\u0646 oneof \u06cc\u0639\u0646\u06cc<code>\u06af\u0648\u0627\u0647\u06cc \u062e\u0627\u0645 (rawCertificate)<\/code>\u0648<code>\u06a9\u0644\u06cc\u062f \u062e\u0635\u0648\u0635\u06cc \u062e\u0627\u0645 (rawPrivateKey)<\/code>\u0647\u0645\u0627\u0646 \u0645\u0648\u0627\u0631\u062f\u06cc \u0647\u0633\u062a\u0646\u062f \u06a9\u0647 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0645\u062f\u0631\u0646 IOS XR \u062f\u0631 \u0634\u0628\u06a9\u0647 \u0645\u06cc\u200c\u067e\u0630\u06cc\u0631\u0646\u062f \u2014 \u0627\u06cc\u0646 \u0647\u0645\u0627\u0646 \u0642\u0627\u0644\u0628\u06cc \u0627\u0633\u062a \u06a9\u0647 \u062f\u0631 \u0633\u0631\u0627\u0633\u0631 \u0627\u06cc\u0646 \u0645\u0642\u0627\u0644\u0647 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u062f\u0647 \u0627\u0633\u062a.<\/p>\n<hr>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u062a\u0646\u0638\u06cc\u0645 gRPC \u0631\u0648\u06cc \u06cc\u06a9 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 Certz (\u062f\u0631 IOS XR CLI)<\/h2>\n<p style=\"direction: rtl; text-align: right\">\u0627\u0632 \u0646\u0633\u062e\u0647 IOS XR 24.1.1 \u0628\u0647 \u0628\u0639\u062f\u060c \u0633\u0631\u0648\u0631 gRPC \u0631\u0627 \u0628\u0647 \u06cc\u06a9 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 \u06af\u0648\u0627\u0647\u06cc (Certz Profile) \u0645\u062a\u0635\u0644 \u06a9\u0646\u06cc\u062f:<\/p>\n<pre><code><span>grpc gnsi service certz ssl-profile-id &lt;ssl-profile-name&gt;\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u0627\u0648\u0644\u0648\u06cc\u062a \u0627\u0647\u0645\u06cc\u062a \u062f\u0627\u0631\u062f: \u0632\u0645\u0627\u0646\u06cc \u06a9\u0647 Certz \u0641\u0639\u0627\u0644 \u0646\u06cc\u0633\u062a\u060c IOS XR \u0628\u0647 gNOI \u0628\u0627\u0632\u0645\u06cc\u200c\u06af\u0631\u062f\u062f<code>cert.proto<\/code>\u061b \u0632\u0645\u0627\u0646\u06cc \u06a9\u0647 \u0647\u06cc\u0686\u200c\u06a9\u062f\u0627\u0645 \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0646\u0634\u062f\u0647 \u0628\u0627\u0634\u0646\u062f\u060c \u062f\u0627\u062f\u0647\u200c\u0647\u0627\u06cc trustpoint \u0642\u062f\u06cc\u0645\u06cc TLS \u0627\u0639\u0645\u0627\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f. \u062c\u0632\u0626\u06cc\u0627\u062a \u06a9\u0627\u0645\u0644 \u062f\u0631 <a href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/iosxr\/cisco8000\/programmability\/b-programmability-configuration-guide-cisco8000\/m-grpc-authentication.html#concept_C66C0E5371BF46E8937AB14F7D25EE11\" style=\"color: rgb(0, 102, 204)\">\u0631\u0627\u0647\u0646\u0645\u0627\u06cc \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a gRPC \u2014 \u0641\u0635\u0644 Certz<\/a>.<\/p>\n<pre><code><span>show grpc certificate\n<\/span><\/code><\/pre>\n<hr>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u067e\u0627\u06cc\u0634 (Monitoring) \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 YANG Telemetry<\/h2>\n<p style=\"direction: rtl; text-align: right\">\u0647\u0646\u06af\u0627\u0645\u06cc \u06a9\u0647 \u06cc\u06a9 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 SSL \u0645\u0633\u062a\u0642\u0631 (Deploy) \u0645\u06cc\u200c\u0634\u0648\u062f\u060c \u0645\u062f\u0644 OpenConfig YANG<strong style=\"color: rgb(26, 26, 26)\"><code>openconfig-gnsi-certz<\/code><\/strong>(\u0646\u0633\u062e\u0647 0.5.0) \u0645\u062a\u0627\u062f\u06cc\u062a\u0627\u06cc \u0627\u0639\u062a\u0628\u0627\u0631\u0646\u0627\u0645\u0647 (Credential) \u0648 \u0634\u0645\u0627\u0631\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u062f\u0633\u062a\u200c\u062f\u0647\u06cc TLS (TLS handshake Counters) \u0631\u0627 \u062f\u0631 \u0645\u0639\u0631\u0636 \u062f\u06cc\u062f \u0642\u0631\u0627\u0631 \u0645\u06cc\u200c\u062f\u0647\u062f \u06a9\u0647 \u062a\u0644\u0645\u062a\u0631\u06cc (Telemetry) \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0622\u0646\u200c\u0647\u0627 \u0631\u0627 \u0628\u0647 \u0635\u0648\u0631\u062a \u0628\u0644\u0627\u062f\u0631\u0646\u06af (Real-time) \u0627\u0633\u062a\u0631\u06cc\u0645 \u06a9\u0646\u062f.<\/p>\n<p style=\"direction: rtl; text-align: right\">\u062a\u0645\u0627\u0645 \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc YANG \u0632\u06cc\u0631 \u0646\u0633\u0628\u062a \u0628\u0647 \u0622\u062f\u0631\u0633 \u0632\u06cc\u0631 \u0647\u0633\u062a\u0646\u062f:<code>\/system\/grpc-servers\/grpc-server[name=<server>]<\/server><\/code>.<\/p>\n<p style=\"direction: rtl; text-align: right\"><strong style=\"color: rgb(26, 26, 26)\">\u0645\u062a\u0627\u062f\u06cc\u062a\u0627\u06cc \u0627\u0639\u062a\u0628\u0627\u0631\u0646\u0627\u0645\u0647 (Credential metadata)<\/strong><\/p>\n<table class=\"english-numbers\" style=\"direction: rtl; text-align: right\">\n<thead>\n<tr>\n<th>\u0645\u0633\u06cc\u0631 YANG (\u0646\u0633\u0628\u062a \u0628\u0647 \u067e\u0627\u06cc\u0647)<\/th>\n<th>\u062a\u0648\u0636\u06cc\u062d\u0627\u062a<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><code>...\/state\/certificate-version<\/code><\/td>\n<td>\u0631\u0634\u062a\u0647 \u0646\u0633\u062e\u0647 \u06af\u0648\u0627\u0647\u06cc (Certificate) \u0641\u0639\u0627\u0644<\/td>\n<\/tr>\n<tr>\n<td><code>...\/state\/certificate-created-on<\/code><\/td>\n<td>\u0632\u0645\u0627\u0646 \u0646\u0635\u0628 \u06af\u0648\u0627\u0647\u06cc \u0641\u0639\u0627\u0644 (\u0646\u0627\u0646\u0648\u062b\u0627\u0646\u06cc\u0647 \u0627\u0632 \u0632\u0645\u0627\u0646 \u0645\u0628\u062f\u0623)<\/td>\n<\/tr>\n<tr>\n<td><code>...\/state\/ca-trust-bundle-version<\/code><\/td>\n<td>\u0631\u0634\u062a\u0647 \u0646\u0633\u062e\u0647 \u0628\u0633\u062a\u0647 \u0627\u0639\u062a\u0645\u0627\u062f (Trust Bundle) \u0641\u0639\u0627\u0644<\/td>\n<\/tr>\n<tr>\n<td><code>...\/state\/ca-trust-bundle-created-on<\/code><\/td>\n<td>\u0632\u0645\u0627\u0646 \u0646\u0635\u0628 \u0628\u0633\u062a\u0647 \u0627\u0639\u062a\u0645\u0627\u062f \u0641\u0639\u0627\u0644<\/td>\n<\/tr>\n<tr>\n<td><code>...\/state\/certificate-revocation-list-bundle-version<\/code><\/td>\n<td>\u0631\u0634\u062a\u0647 \u0646\u0633\u062e\u0647 \u0628\u0633\u062a\u0647 \u0644\u06cc\u0633\u062a \u0627\u0628\u0637\u0627\u0644 \u06af\u0648\u0627\u0647\u06cc (CRL Bundle) \u0641\u0639\u0627\u0644<\/td>\n<\/tr>\n<tr>\n<td><code>...\/state\/certificate-revocation-list-bundle-created-on<\/code><\/td>\n<td>\u0632\u0645\u0627\u0646 \u0646\u0635\u0628 \u0628\u0633\u062a\u0647 \u0644\u06cc\u0633\u062a \u0627\u0628\u0637\u0627\u0644 \u06af\u0648\u0627\u0647\u06cc \u0641\u0639\u0627\u0644<\/td>\n<\/tr>\n<tr>\n<td><code>...\/state\/authentication-policy-version<\/code><\/td>\n<td>\u0646\u0633\u062e\u0647 \u062e\u0637\u200c\u0645\u0634\u06cc \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a (Authentication Policy) (\u0645\u0628\u062a\u0646\u06cc \u0628\u0631 TLS \u0645\u062a\u0642\u0627\u0628\u0644)<\/td>\n<\/tr>\n<tr>\n<td><code>...\/state\/authentication-policy-created-on<\/code><\/td>\n<td>\u0632\u0645\u0627\u0646 \u0646\u0635\u0628 \u062e\u0637\u200c\u0645\u0634\u06cc \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a<\/td>\n<\/tr>\n<tr>\n<td><code>...\/state\/ssl-profile-id<\/code><\/td>\n<td>\u0634\u0646\u0627\u0633\u0647 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 SSL (SSL Profile ID) \u0645\u0648\u0631\u062f \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u062a\u0648\u0633\u0637 \u0627\u06cc\u0646 \u0633\u0631\u0648\u0631 gRPC<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p style=\"direction: rtl; text-align: right\"><strong style=\"color: rgb(26, 26, 26)\">\u0634\u0645\u0627\u0631\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u062f\u0633\u062a\u200c\u062f\u0627\u062f\u0646 (Handshake) \u067e\u0631\u0648\u062a\u06a9\u0644 TLS:<\/strong><\/p>\n<table class=\"english-numbers\" style=\"direction: rtl; text-align: right\">\n<thead>\n<tr>\n<th>\u0645\u0633\u06cc\u0631 YANG (\u0646\u0633\u0628\u062a \u0628\u0647 \u067e\u0627\u06cc\u0647)<\/th>\n<th>\u062a\u0648\u0636\u06cc\u062d\u0627\u062a<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><code>...\/state\/certz-counters\/access-accepts<\/code><\/td>\n<td>\u0645\u062c\u0645\u0648\u0639 \u062f\u0633\u062a\u200c\u062f\u0627\u062f\u0646\u200c\u0647\u0627\u06cc (Handshake) \u0645\u0648\u0641\u0642 TLS<\/td>\n<\/tr>\n<tr>\n<td><code>...\/state\/certz-counters\/last-access-accept<\/code><\/td>\n<td>\u0645\u0647\u0631 \u0632\u0645\u0627\u0646\u06cc (Timestamp) \u0622\u062e\u0631\u06cc\u0646 \u062f\u0633\u062a\u200c\u062f\u0627\u062f\u0646 \u0645\u0648\u0641\u0642<\/td>\n<\/tr>\n<tr>\n<td><code>...\/state\/certz-counters\/access-rejects<\/code><\/td>\n<td>\u0645\u062c\u0645\u0648\u0639 \u062f\u0633\u062a\u200c\u062f\u0627\u062f\u0646\u200c\u0647\u0627\u06cc \u0646\u0627\u0645\u0648\u0641\u0642 TLS (\u06a9\u0644\u0627\u06cc\u0646\u062a \u0631\u062f \u0634\u062f\u0647)<\/td>\n<\/tr>\n<tr>\n<td><code>...\/state\/certz-counters\/last-access-reject<\/code><\/td>\n<td>\u0645\u0647\u0631 \u0632\u0645\u0627\u0646\u06cc (Timestamp) \u0622\u062e\u0631\u06cc\u0646 \u0631\u062f \u0634\u062f\u0646 TLS<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p style=\"direction: rtl; text-align: right\">\u0645\u0634\u062a\u0631\u06a9 \u0634\u0648\u06cc\u062f \u062f\u0631<code>access-rejects<\/code>\u0648<code>last-access-reject<\/code>\u0628\u0631\u0627\u06cc \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u062e\u0637\u0627\u0647\u0627\u06cc \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a (Authentication) \u062f\u0631 \u0645\u062d\u06cc\u0637 \u0639\u0645\u0644\u06cc\u0627\u062a\u06cc. \u0627\u0641\u0632\u0627\u06cc\u0634 \u0646\u0627\u06af\u0647\u0627\u0646\u06cc \u062f\u0631 \u062a\u0639\u062f\u0627\u062f \u0631\u062f \u062f\u0631\u062e\u0648\u0627\u0633\u062a\u200c\u0647\u0627 (Rejects) \u067e\u0633 \u0627\u0632 \u0639\u0645\u0644\u06cc\u0627\u062a \u0686\u0631\u062e\u0634 (Rotate)\u060c \u0645\u0639\u0645\u0648\u0644\u0627\u064b \u0628\u0647 \u0627\u06cc\u0646 \u0645\u0639\u0646\u0627\u0633\u062a \u06a9\u0647 \u06af\u0648\u0627\u0647\u06cc (Certificate) \u06cc\u0627 \u0628\u0633\u062a\u0647 \u0627\u0639\u062a\u0645\u0627\u062f (Trust Bundle) \u062c\u062f\u06cc\u062f \u062f\u0627\u0631\u0627\u06cc \u0645\u0634\u06a9\u0644 \u0627\u0633\u062a \u2014 \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f<code>certificate-version<\/code>\u0648<code>ca-trust-bundle-version<\/code>\u062a\u0627 \u0628\u0627 \u062f\u0627\u062f\u0647\u200c\u0647\u0627\u06cc\u06cc \u06a9\u0647 \u0628\u0647\u200c\u062a\u0627\u0632\u06af\u06cc \u0627\u0631\u0633\u0627\u0644 \u0634\u062f\u0647\u200c\u0627\u0646\u062f\u060c \u0645\u0637\u0627\u0628\u0642\u062a \u062f\u0627\u062f\u0647 \u0634\u0648\u062f.<\/p>\n<p style=\"direction: rtl; text-align: right\">\u0639\u0628\u0627\u0631\u062a\u200c\u0647\u0627\u06cc<code>*-version<\/code>\u0648<code>*-created-on<\/code>\u062f\u0631 \u0628\u0631\u06af\u0647\u200c\u0647\u0627 (leaves) \u062f\u0642\u06cc\u0642\u0627\u064b \u0647\u0645\u0627\u0646 \u0631\u0634\u062a\u0647\u200c\u0647\u0627\u06cc \u0627\u0631\u0633\u0627\u0644 \u0634\u062f\u0647 \u062f\u0631 \u0647\u0631<code>\u0645\u0648\u062c\u0648\u062f\u06cc\u062a (Entity)<\/code>\u062f\u0631 \u0637\u0648\u0644 \u0641\u0631\u0627\u062e\u0648\u0627\u0646\u06cc Rotate RPC \u0631\u0627 \u0645\u0646\u0639\u06a9\u0633 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f. \u0627\u06cc\u0646 \u0628\u062f\u0627\u0646 \u0645\u0639\u0646\u0627\u0633\u062a \u06a9\u0647 \u062e\u0637\u200c\u0644\u0648\u0644\u0647\u200c\u0647\u0627\u06cc \u062a\u0644\u0647\u200c\u0645\u062a\u0631\u06cc (Telemetry pipelines) \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0631\u0641\u062a\u0627\u0631 gRPC \u0631\u0627 \u0628\u0627 \u0647\u0645\u0627\u0646 \u0634\u0646\u0627\u0633\u0647\u200c\u0647\u0627\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0634\u062f\u0647 \u062f\u0631 \u0634\u0628\u06a9\u0647 (over the wire) \u0645\u0631\u062a\u0628\u0637 \u06a9\u0646\u0646\u062f \u2014 \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0628\u0627\u0632 \u06a9\u0631\u062f\u0646 \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc PEM \u0631\u0648\u06cc \u062f\u06cc\u0633\u06a9.<\/p>\n<h3 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u0628\u0631\u0631\u0633\u06cc \u0633\u0631\u06cc\u0639 \u062a\u0644\u0647\u200c\u0645\u062a\u0631\u06cc (Telemetry) \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 gnmic<\/h3>\n<blockquote style=\"direction: rtl; text-align: right\">\n<p><strong style=\"color: rgb(26, 26, 26)\">\u062f\u0631 \u0646\u0633\u062e\u0647 25.3.1:<\/strong>\u0632\u06cc\u0631\u0634\u0627\u062e\u0647 \u0648\u0636\u0639\u06cc\u062a Certz \u062a\u0646\u0647\u0627 \u067e\u0633 \u0627\u0632 \u0627\u062a\u0635\u0627\u0644 \u0633\u0631\u0648\u0631 gRPC \u0628\u0647 \u06cc\u06a9 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 (<code>grpc gnsi service certz ssl-profile-id <\/code>) \u0645\u0642\u062f\u0627\u0631\u062f\u0647\u06cc \u0645\u06cc\u200c\u0634\u0648\u062f. \u062a\u0627 \u0632\u0645\u0627\u0646\u06cc \u06a9\u0647 \u0627\u06cc\u0646 \u062f\u0633\u062a\u0648\u0631 CLI \u0627\u0639\u0645\u0627\u0644 (Commit) \u0646\u0634\u0648\u062f\u060c<code>state\/ssl-profile-id<\/code>\u0648<code>state\/certz-counters<\/code>\u0645\u0642\u062f\u0627\u0631<code>NotFound<\/code>\u0631\u0627 \u0628\u0631\u0645\u06cc\u200c\u06af\u0631\u062f\u0627\u0646\u0646\u062f \u0648 \u0633\u0631\u0648\u0631 gRPC \u0641\u0639\u0627\u0644 \u062d\u062a\u06cc \u067e\u0633 \u0627\u0632 \u06cc\u06a9 \u0639\u0645\u0644\u06cc\u0627\u062a \u0645\u0648\u0641\u0642<code>Rotate<\/code>.<\/p>\n<\/blockquote>\n<p style=\"direction: rtl; text-align: right\">\u062a\u0623\u06cc\u06cc\u062f \u0646\u0633\u062e\u0647 \u0641\u0639\u0627\u0644 \u06af\u0648\u0627\u0647\u06cc (Certificate) \u0648 \u0634\u0645\u0627\u0631\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u062f\u0633\u062a\u200c\u062f\u0647\u06cc (Handshake) \u067e\u0631\u0648\u062a\u06a9\u0644 TLS \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u06cc\u06a9 \u062f\u0633\u062a\u0648\u0631 gNMI Get (<a href=\"https:\/\/gnmic.openconfig.net\/\" style=\"color: rgb(0, 102, 204)\">gnmic<\/a>):<\/p>\n<pre><code><span>gnmic <span>-a<\/span> <span>\"<span>${XR}<\/span>\"<\/span> <span>--insecure<\/span> <span>-u<\/span> <span>\"<span>${XR_USER}<\/span>\"<\/span> <span>-p<\/span> <span>\"<span>${XR_PASS}<\/span>\"<\/span> <span>-e<\/span> json_ietf <span>\\<\/span>\n<\/span><span> get <span>--path<\/span> <span>\"\/system\/grpc-servers\/grpc-server\/state\/certificate-version\"<\/span> <span>\\<\/span>\n<\/span><span> <span>--path<\/span> <span>\"\/system\/grpc-servers\/grpc-server\/state\/ca-trust-bundle-version\"<\/span> <span>\\<\/span>\n<\/span><span> <span>--path<\/span> <span>\"\/system\/grpc-servers\/grpc-server\/state\/certz-counters\/access-rejects\"<\/span>\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u0634\u0645\u0627\u0631\u0646\u062f\u0647\u200c\u0647\u0627\u06cc AAA \u0628\u0631\u0627\u06cc \u0647\u0631 RPC \u0627\u0632 \u0645\u062f\u0644<code>openconfig-gnsi-authz<\/code>\u0628\u0647 \u0647\u0631 \u062d\u0627\u0644 \u067e\u0631 \u0645\u06cc\u200c\u0634\u0648\u0646\u062f \u0648 \u0631\u0648\u0634\u06cc \u0633\u0631\u06cc\u0639 \u0628\u0631\u0627\u06cc \u062a\u0623\u06cc\u06cc\u062f \u0627\u06cc\u0646 \u0647\u0633\u062a\u0646\u062f \u06a9\u0647 \u0622\u06cc\u0627 \u062a\u0631\u0627\u0641\u06cc\u06a9 Certz \u0627\u0635\u0644\u0627\u064b \u0628\u0647 \u0633\u0631\u0648\u0631 \u0645\u06cc\u200c\u0631\u0633\u062f \u06cc\u0627 \u062e\u06cc\u0631:<\/p>\n<pre><code><span>gnmic <span>-a<\/span> <span>\"<span>${XR}<\/span>\"<\/span> <span>--insecure<\/span> <span>-u<\/span> <span>\"<span>${XR_USER}<\/span>\"<\/span> <span>-p<\/span> <span>\"<span>${XR_PASS}<\/span>\"<\/span> <span>-e<\/span> json_ietf <span>\\<\/span>\n<\/span><span> get <span>--path<\/span> <span>'\/system\/grpc-servers\/grpc-server[name=DEFAULT]'<\/span>\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u0641\u06cc\u0644\u062a\u0631 \u06a9\u0631\u062f\u0646 \u067e\u0627\u0633\u062e \u0628\u0627<code>jq<\/code>\u0641\u0642\u0637 \u0628\u0631\u0627\u06cc Certz RPCs:<\/p>\n<pre><code><span>jq <span>'[.[0].updates[0].values.\"system\/grpc-servers\/grpc-server\"\n<\/span><\/span><span><span>.\"openconfig-gnsi-authz:authz-policy-counters\".rpcs.rpc[]\n<\/span><\/span><span><span> | select(.name | startswith(\"\/gnsi.certz.v1.Certz\/\"))]'<\/span>\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\">\u062e\u0631\u0648\u062c\u06cc \u0645\u0648\u0631\u062f \u0627\u0646\u062a\u0638\u0627\u0631 (\u0627\u0639\u062f\u0627\u062f \u0646\u0634\u0627\u0646\u200c\u062f\u0647\u0646\u062f\u0647 \u0645\u0631\u0627\u062d\u0644 \u0628\u0631\u0631\u0633\u06cc \u0622\u0632\u0645\u0627\u06cc\u0634\u06af\u0627\u0647\u06cc \u0647\u0633\u062a\u0646\u062f):<\/p>\n<pre><code><span><span>[<\/span>\n<\/span><span> <span>{<\/span> <span>\"name\"<\/span><span>:<\/span> <span>\"\/gnsi.certz.v1.Certz\/AddProfile\"<\/span><span>,<\/span> <span>\"state\"<\/span><span>:<\/span> <span>{<\/span> <span>\"access-accepts\"<\/span><span>:<\/span> <span>\"4\"<\/span><span>,<\/span>... <span>}<\/span> <span>}<\/span><span>,<\/span>\n<\/span><span> <span>{<\/span> <span>\"name\"<\/span><span>:<\/span> <span>\"\/gnsi.certz.v1.Certz\/CanGenerateCSR\"<\/span><span>,<\/span> <span>\"state\"<\/span><span>:<\/span> <span>{<\/span> <span>\"access-accepts\"<\/span><span>:<\/span> <span>\"3\"<\/span><span>,<\/span>... <span>}<\/span> <span>}<\/span><span>,<\/span>\n<\/span><span> <span>{<\/span> <span>\"name\"<\/span><span>:<\/span> <span>\"\/gnsi.certz.v1.Certz\/DeleteProfile\"<\/span><span>,<\/span> <span>\"state\"<\/span><span>:<\/span> <span>{<\/span> <span>\"access-accepts\"<\/span><span>:<\/span> <span>\"3\"<\/span><span>,<\/span>... <span>}<\/span> <span>}<\/span><span>,<\/span>\n<\/span><span> <span>{<\/span> <span>\"name\"<\/span><span>:<\/span> <span>\"\/gnsi.certz.v1.Certz\/GetProfileList\"<\/span><span>,<\/span> <span>\"state\"<\/span><span>:<\/span> <span>{<\/span> <span>\"access-accepts\"<\/span><span>:<\/span> <span>\"4\"<\/span><span>,<\/span>... <span>}<\/span> <span>}<\/span><span>,<\/span>\n<\/span><span> <span>{<\/span> <span>\"name\"<\/span><span>:<\/span> <span>\"\/gnsi.certz.v1.Certz\/Rotate\"<\/span><span>,<\/span> <span>\"state\"<\/span><span>:<\/span> <span>{<\/span> <span>\"access-accepts\"<\/span><span>:<\/span> <span>\"11\"<\/span><span>,<\/span>... <span>}<\/span> <span>}<\/span>\n<\/span><span><span>]<\/span>\n<\/span><\/code><\/pre>\n<p style=\"direction: rtl; text-align: right\"><code>GetIntegrityManifest<\/code>\u0627\u0632 \u0644\u06cc\u0633\u062a \u062d\u0630\u0641 \u0634\u062f\u0647 \u0627\u0633\u062a \u2014 IOS XR \u0628\u0627\u0632\u0645\u06cc\u200c\u06af\u0631\u062f\u0627\u0646\u062f<code>\u067e\u06cc\u0627\u062f\u0647\u200c\u0633\u0627\u0632\u06cc \u0646\u0634\u062f\u0647 (Unimplemented)<\/code>\u067e\u06cc\u0634 \u0627\u0632 \u0622\u0646\u06a9\u0647 \u0634\u0645\u0627\u0631\u0646\u062f\u0647 AAA \u0627\u0641\u0632\u0627\u06cc\u0634 \u06cc\u0627\u0628\u062f\u060c \u0628\u0646\u0627\u0628\u0631\u0627\u06cc\u0646 RPC \u0628\u0647 \u0633\u0627\u062f\u06af\u06cc \u0647\u0631\u06af\u0632 \u062f\u0631 \u062f\u0631\u062e\u062a gNMI \u0638\u0627\u0647\u0631 \u0646\u0645\u06cc\u200c\u0634\u0648\u062f.<\/p>\n<hr>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u0646\u06a9\u0627\u062a\u06cc \u06a9\u0647 \u0628\u0627\u06cc\u062f \u0628\u0647 \u0622\u0646\u200c\u0647\u0627 \u062a\u0648\u062c\u0647 \u06a9\u0631\u062f<\/h2>\n<ul style=\"direction: rtl; text-align: right\">\n<li>\u062f\u0631 \u0646\u0633\u062e\u0647 IOS XR 24.4.x\u060c \u062a\u06a9\u0631\u0627\u0631 \u06a9\u0646\u06cc\u062f<code>\u0634\u0646\u0627\u0633\u0647 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 SSL (sslProfileId)<\/code> on <strong style=\"color: rgb(26, 26, 26)\">\u0647\u0631<\/strong>\u067e\u06cc\u0627\u0645 \u0627\u0633\u062a\u0631\u06cc\u0645 (stream) \u2014 \u0634\u0627\u0645\u0644 \u0646\u0647\u0627\u06cc\u06cc\u200c\u0633\u0627\u0632\u06cc (finalize) \u2014 \u062f\u0631 \u063a\u06cc\u0631 \u0627\u06cc\u0646 \u0635\u0648\u0631\u062a \u0633\u0631\u0648\u0631 \u062f\u0631\u062e\u0648\u0627\u0633\u062a RPC \u0631\u0627 \u0628\u0627 \u0627\u06cc\u0646 \u062e\u0637\u0627 \u0631\u062f \u0645\u06cc\u200c\u06a9\u0646\u062f<code>\u0627\u0646\u062a\u0638\u0627\u0631 \u0628\u0631\u0627\u06cc RPC \u0686\u0631\u062e\u0634 (rotate) \u0628\u0631\u0627\u06cc \u0686\u0646\u062f\u06cc\u0646 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 SSL \u062f\u0631 \u06cc\u06a9 \u0627\u0633\u062a\u0631\u06cc\u0645 \u0648\u0627\u062d\u062f \u0648\u062c\u0648\u062f \u0646\u062f\u0627\u0631\u062f<\/code>.<\/li>\n<li>\u067e\u0631\u0648\u0641\u0627\u06cc\u0644 \u0645\u062a\u0635\u0644 \u0628\u0647<strong style=\"color: rgb(26, 26, 26)\">\u0633\u0631\u0648\u0631 gRPC \u0641\u0639\u0627\u0644<\/strong>\u0642\u0627\u0628\u0644 \u062d\u0630\u0641 \u0646\u06cc\u0633\u062a.<code>DeleteProfile<\/code>\u0628\u0631\u0627\u06cc \u0622\u0646 \u06cc\u06a9 \u062e\u0637\u0627 \u0628\u0631\u0645\u06cc\u200c\u06af\u0631\u062f\u0627\u0646\u062f.<\/li>\n<li><code>GetIntegrityManifest<\/code>\u0645\u0645\u06a9\u0646 \u0627\u0633\u062a<code>Unimplemented (\u067e\u06cc\u0627\u062f\u0647\u200c\u0633\u0627\u0632\u06cc \u0646\u0634\u062f\u0647)<\/code>\u0631\u0627 \u062f\u0631 \u0628\u0631\u062e\u06cc \u0627\u06cc\u0645\u06cc\u062c\u200c\u0647\u0627 \u0628\u0631\u06af\u0631\u062f\u0627\u0646\u062f. \u0647\u0645\u06cc\u0634\u0647 \u0628\u0627 \u06cc\u06a9 \u062a\u0645\u0627\u0633 \u0632\u0646\u062f\u0647 \u062a\u0633\u062a \u06a9\u0646\u06cc\u062f\u060c \u0646\u0647 \u0641\u0642\u0637 \u0628\u0627 Reflection.<\/li>\n<li>\u067e\u0633 \u0627\u0632 \u0686\u0631\u062e\u0634 (Rotate)\u060c \u06af\u0648\u0627\u0647\u06cc\u0646\u0627\u0645\u0647 \u062c\u062f\u06cc\u062f \u0628\u0631\u0627\u06cc<strong style=\"color: rgb(26, 26, 26)\">\u062c\u062f\u06cc\u062f<\/strong>\u0627\u062a\u0635\u0627\u0644\u0627\u062a \u0627\u0639\u0645\u0627\u0644 \u0645\u06cc\u200c\u0634\u0648\u062f. \u0646\u0634\u0633\u062a\u200c\u0647\u0627\u06cc (sessions) \u0645\u0648\u062c\u0648\u062f \u0642\u0637\u0639 \u0646\u0645\u06cc\u200c\u0634\u0648\u0646\u062f.<\/li>\n<li>\u0647\u0645\u06cc\u0634\u0647 \u0628\u0627 \u062f\u0633\u062a\u0648\u0631<code>show grpc certificate<\/code>\u067e\u0633 \u0627\u0632 \u0627\u062a\u0635\u0627\u0644 \u06cc\u06a9 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 \u062a\u0623\u06cc\u06cc\u062f \u06a9\u0646\u06cc\u062f \u2014 \u06cc\u06a9 \u0686\u0631\u062e\u0634 \u0645\u0648\u0641\u0642 \u062a\u0636\u0645\u06cc\u0646 \u0646\u0645\u06cc\u200c\u06a9\u0646\u062f \u06a9\u0647 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 \u0631\u0648\u06cc \u0633\u0631\u0648\u0631 gRPC \u0641\u0639\u0627\u0644 \u0628\u0627\u0634\u062f.<\/li>\n<li>\u062c\u0631\u06cc\u0627\u0646 A (CSR \u062a\u0648\u0644\u06cc\u062f \u0634\u062f\u0647 \u062a\u0648\u0633\u0637 \u0647\u062f\u0641)<strong style=\"color: rgb(26, 26, 26)\">\u0646\u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u06a9\u0627\u0645\u0644 \u0634\u0648\u062f<\/strong>\u0628\u0647 \u0635\u0648\u0631\u062a \u0633\u0631\u062a\u0627\u0633\u0631\u06cc (end-to-end) \u062f\u0631<code>grpcurl<\/code>\u2014 \u0628\u0633\u062a\u0646 \u0627\u0633\u062a\u0631\u06cc\u0645 \u067e\u0633 \u0627\u0632 \u0628\u0627\u0632\u06af\u0634\u062a CSR \u0628\u0627\u0639\u062b \u062f\u0648\u0631 \u0631\u06cc\u062e\u062a\u0646 \u06a9\u0644\u06cc\u062f \u06a9\u0627\u0646\u062f\u06cc\u062f \u0645\u06cc\u200c\u0634\u0648\u062f \u0648 \u0622\u067e\u0644\u0648\u062f \u0628\u0639\u062f\u06cc \u0628\u0627 \u062e\u0637\u0627\u06cc<code>No private key found for leaf cert (\u06a9\u0644\u06cc\u062f \u062e\u0635\u0648\u0635\u06cc \u0628\u0631\u0627\u06cc \u06af\u0648\u0627\u0647\u06cc\u0646\u0627\u0645\u0647 \u0628\u0631\u06af \u067e\u06cc\u062f\u0627 \u0646\u0634\u062f)<\/code>\u0645\u0648\u0627\u062c\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f. \u0628\u0631\u0627\u06cc \u0622\u0646 \u062c\u0631\u06cc\u0627\u0646 \u0627\u0632 \u06cc\u06a9 \u06a9\u0644\u0627\u06cc\u0646\u062a \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u0646\u0648\u06cc\u0633\u06cc\u200c\u0634\u062f\u0647 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0646\u06cc\u062f \u06cc\u0627 \u0627\u0632 \u062c\u0631\u06cc\u0627\u0646 B \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0646\u0645\u0627\u06cc\u06cc\u062f.<\/li>\n<li>IOS XR \u0628\u0631\u0645\u06cc\u200c\u06af\u0631\u062f\u0627\u0646\u062f<code>InvalidArgument: certificate: same version sent (\u0622\u0631\u06af\u0648\u0645\u0627\u0646 \u0646\u0627\u0645\u0639\u062a\u0628\u0631: \u06af\u0648\u0627\u0647\u06cc\u0646\u0627\u0645\u0647: \u0646\u0633\u062e\u0647 \u0645\u0634\u0627\u0628\u0647 \u0627\u0631\u0633\u0627\u0644 \u0634\u062f)<\/code>(\u0646\u0647 \u062e\u0637\u0627\u06cc \u0645\u0633\u062a\u0646\u062f \u0634\u062f\u0647 \u062f\u0631 \u067e\u0631\u0648\u062a\u0648 \u06cc\u0639\u0646\u06cc<code>AlreadyExists (\u0627\u0632 \u0642\u0628\u0644 \u0645\u0648\u062c\u0648\u062f \u0627\u0633\u062a)<\/code>) \u0647\u0646\u06af\u0627\u0645 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u062c\u062f\u062f \u0627\u0632 \u06cc\u06a9<code>\u0646\u0633\u062e\u0647<\/code>\u0628\u062f\u0648\u0646<code>forceOverwrite (\u0628\u0627\u0632\u0646\u0648\u06cc\u0633\u06cc \u0627\u062c\u0628\u0627\u0631\u06cc)<\/code>. \u0645\u0642\u062f\u0627\u0631<code>forceOverwrite\": true<\/code>\u0631\u0627 \u062f\u0631 \u0647\u0631 \u067e\u06cc\u0627\u0645 \u063a\u06cc\u0631 \u0646\u0647\u0627\u06cc\u06cc \u062f\u0631 \u0637\u0648\u0644 \u062a\u0644\u0627\u0634\u200c\u0647\u0627\u06cc \u0645\u062c\u062f\u062f \u062a\u0646\u0638\u06cc\u0645 \u06a9\u0646\u06cc\u062f.<\/li>\n<li>\u06cc\u06a9 \u0627\u0633\u062a\u0631\u06cc\u0645 \u0686\u0631\u062e\u0634 (Rotate) \u0646\u0647\u0627\u06cc\u06cc\u200c\u0646\u0634\u062f\u0647 \u0628\u0627<code>ERROR: Code: Unknown \/ Message: EOF<\/code>\u0627\u0632 \u062f\u06cc\u062f\u06af\u0627\u0647 \u0633\u0631\u0648\u0631 \u0628\u0633\u062a\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f. \u0627\u06cc\u0646 \u0633\u06cc\u06af\u0646\u0627\u0644 \u0628\u0627\u0632\u06af\u0634\u062a \u0628\u0647 \u062d\u0627\u0644\u062a \u0642\u0628\u0644 (rollback) \u0627\u0633\u062a\u060c \u0646\u0647 \u062e\u0637\u0627\u06cc\u06cc \u06a9\u0647 \u0646\u06cc\u0627\u0632 \u0628\u0647 \u0628\u0631\u0631\u0633\u06cc \u062f\u0627\u0634\u062a\u0647 \u0628\u0627\u0634\u062f.<\/li>\n<li>\u0632\u06cc\u0631\u062f\u0631\u062e\u062a \u0648\u0636\u0639\u06cc\u062a<code>openconfig-gnsi-certz<\/code>(<code>state\/ssl-profile-id<\/code>, <code>state\/certz-counters<\/code>) \u062a\u0646\u0647\u0627 \u067e\u0633 \u0627\u0632 \u0627\u062a\u0635\u0627\u0644 \u0633\u0631\u0648\u0631 gRPC \u0628\u0647 \u06cc\u06a9 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 Certz \u067e\u0631 \u0645\u06cc\u200c\u0634\u0648\u062f. \u062a\u0627 \u0622\u0646 \u0632\u0645\u0627\u0646\u060c \u062f\u0631\u062e\u0648\u0627\u0633\u062a\u200c\u0647\u0627\u06cc gNMI Get \u0631\u0648\u06cc \u0627\u06cc\u0646 \u0628\u0631\u06af\u200c\u0647\u0627 \u062e\u0637\u0627\u06cc<code>NotFound (\u06cc\u0627\u0641\u062a \u0646\u0634\u062f) \u0628\u0631\u0645\u06cc\u200c\u06af\u0631\u062f\u0627\u0646\u0646\u062f<\/code>.<\/li>\n<\/ul>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u0646\u062a\u06cc\u062c\u0647\u200c\u06af\u06cc\u0631\u06cc<\/h2>\n<p style=\"direction: rtl; text-align: right\">\u067e\u0630\u06cc\u0631\u0634 gNSI Certz \u062f\u0631 IOS XR\u060c \u0686\u0631\u062e\u0634 TLS \u062f\u0631 gRPC \u0631\u0627 \u0628\u0627 \u0647\u0645\u0627\u0646 \u0645\u062f\u0644 \u0645\u0631\u062d\u0644\u0647\u200c\u0628\u0646\u062f\u06cc-\u0627\u0639\u062a\u0628\u0627\u0631\u0633\u0646\u062c\u06cc-\u0646\u0647\u0627\u06cc\u06cc\u200c\u0633\u0627\u0632\u06cc (stage-validate-finalize) \u0633\u0627\u06cc\u0631 \u0633\u0631\u0648\u06cc\u0633\u200c\u0647\u0627\u06cc gNSI \u0647\u0645\u0633\u0648 \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0642\u0631\u0627\u0631\u062f\u0627\u062f Protobuf \u0628\u0647 \u0639\u0645\u062f \u06a9\u0648\u0686\u06a9 \u0637\u0631\u0627\u062d\u06cc \u0634\u062f\u0647 \u0627\u0633\u062a\u060c \u0627\u0645\u0627 \u0641\u0631\u0645\u062a \u0622\u067e\u0644\u0648\u062f \u06af\u0648\u0627\u0647\u06cc\u200c\u0647\u0627\u06cc \u062a\u0648 \u062f\u0631 \u062a\u0648 (nested Certificate) \u0627\u0632 \u0645\u0632\u0627\u06cc\u0627\u06cc \u0622\u0646 \u0628\u0647\u0631\u0647 \u0645\u06cc\u200c\u0628\u0631\u062f<code>grpcurl -msg-template<\/code>\u067e\u06cc\u0634 \u0627\u0632 \u062e\u0648\u062f\u06a9\u0627\u0631\u0633\u0627\u0632\u06cc \u062f\u0631 \u0645\u0642\u06cc\u0627\u0633 \u0628\u0632\u0631\u06af. \u062f\u0631 \u062a\u0631\u06a9\u06cc\u0628 \u0628\u0627 <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/grpc-authorization-with-authz\" style=\"color: rgb(0, 102, 204)\">Authz<\/a> \u0648 <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/securing-gnmi-with-pathz\" style=\"color: rgb(0, 102, 204)\">Pathz<\/a>\u060c \u0627\u06cc\u0646 \u067e\u0648\u0634\u0634\u060c \u0646\u0634\u0633\u062a\u200c\u0647\u0627\u06cc \u0645\u062f\u06cc\u0631\u06cc\u062a\u06cc \u0627\u0645\u0646 \u0648 \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u067e\u0630\u06cc\u0631 (programmable) \u0631\u0627 \u0628\u0647 \u0635\u0648\u0631\u062a \u0633\u0631\u062a\u0627\u0633\u0631\u06cc (end to end) \u062f\u0631 \u0628\u0631 \u0645\u06cc\u200c\u06af\u06cc\u0631\u062f.<\/p>\n<div style=\"display: flex\" title=\"\u0627\u0646\u062a\u062e\u0627\u0628 \u06a9\u0644 \u0627\u06cc\u0646 \u0628\u062e\u0634\">&nbsp;<\/div>\n<ul style=\"direction: rtl; text-align: right\">\n<li>Certz \u06af\u0631\u0648\u0647\u200c\u0647\u0627\u06cc \u0645\u0648\u0627\u062f \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a TLS\u060c \u0644\u0646\u06af\u0631\u0647\u0627\u06cc \u0627\u0639\u062a\u0645\u0627\u062f (Trust Anchors)\u060c \u0644\u06cc\u0633\u062a\u200c\u0647\u0627\u06cc \u0627\u0628\u0637\u0627\u0644 \u06af\u0648\u0627\u0647\u06cc (CRLs) \u0648 \u0633\u06cc\u0627\u0633\u062a\u200c\u0647\u0627\u06cc \u0627\u062e\u062a\u06cc\u0627\u0631\u06cc \u0631\u0627 \u062f\u0631 \u0642\u0627\u0644\u0628<strong style=\"color: rgb(26, 26, 26)\">\u067e\u0631\u0648\u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc SSL<\/strong>\u062f\u0631 \u0633\u06cc\u0633\u062a\u0645\u200c\u0639\u0627\u0645\u0644 IOS XR\u060c \u06a9\u0647 \u062a\u0648\u0633\u0637 EMSd \u062f\u0631 \u0645\u0633\u06cc\u0631<code>\/misc\/config\/grpc\/gnsi\/certz\/ssl_profiles\/<\/code>.<\/li>\n<li>\u067e\u0634\u062a\u06cc\u0628\u0627\u0646\u06cc \u0645\u06cc\u200c\u0634\u0648\u0646\u062f\u060c \u062f\u0633\u062a\u0647\u200c\u0628\u0646\u062f\u06cc \u0645\u06cc\u200c\u06a9\u0646\u062f. \u0641\u0631\u0627\u062e\u0648\u0627\u0646\u06cc\u200c\u0647\u0627\u06cc Unary RPC \u0634\u0627\u0645\u0644 \u06a9\u0634\u0641 (<code>GetProfileList<\/code>)\u060c \u0627\u06cc\u062c\u0627\u062f \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 (<code>AddProfile<\/code>)\u060c \u0628\u0631\u0631\u0633\u06cc \u0642\u0627\u0628\u0644\u06cc\u062a CSR (<code>CanGenerateCSR<\/code>) \u0648 \u062d\u0630\u0641 (<code>DeleteProfile<\/code>).<\/li>\n<li><code>) \u0647\u0633\u062a\u0646\u062f.<\/code>Rotate<code>\u06cc\u06a9 \u062a\u0631\u0627\u06a9\u0646\u0634 \u062c\u0631\u06cc\u0627\u0646\u06cc (Streamed Transaction) \u0627\u0633\u062a: \u0634\u0627\u0645\u0644 \u0645\u0648\u0627\u0631\u062f \u0627\u062e\u062a\u06cc\u0627\u0631\u06cc<\/code>generate_csr<code>\u060c \u06cc\u06a9 \u06cc\u0627 \u0686\u0646\u062f<\/code>\u06af\u0648\u0627\u0647\u06cc (Certificates)<code>\u0628\u0631\u0627\u06cc \u0622\u067e\u0644\u0648\u062f\u060c \u0648 \u0633\u067e\u0633<\/code>finalize_rotation<\/li>\n<li>\u0645\u06cc\u200c\u0628\u0627\u0634\u062f. \u0628\u0631\u0627\u06cc \u0641\u0639\u0627\u0644\u200c\u0633\u0627\u0632\u06cc \u0628\u0627\u0632\u06af\u0634\u062a \u0628\u0647 \u062d\u0627\u0644\u062a \u0642\u0628\u0644 (Rollback)\u060c \u062c\u0631\u06cc\u0627\u0646 \u0631\u0627 \u0632\u0648\u062f\u062a\u0631 \u0642\u0637\u0639 \u06a9\u0646\u06cc\u062f.<code>\u062f\u0648 \u062c\u0631\u06cc\u0627\u0646 \u0639\u0645\u0644\u06cc\u0627\u062a\u06cc \u0648\u062c\u0648\u062f \u062f\u0627\u0631\u062f: \u0627\u062c\u0627\u0632\u0647 \u062f\u0647\u06cc\u062f \u0631\u0648\u062a\u0631 \u062f\u0631 \u0632\u0645\u0627\u0646\u06cc \u06a9\u0647<\/code>canGenerate<code>\u0635\u062d\u06cc\u062d (True) \u0627\u0633\u062a CSR \u0631\u0627 \u062a\u0648\u0644\u06cc\u062f \u06a9\u0646\u062f\u060c \u06cc\u0627 \u06a9\u0644\u06cc\u062f \u0648 CSR \u0631\u0627 \u0631\u0648\u06cc \u06cc\u06a9 \u0627\u06cc\u0633\u062a\u06af\u0627\u0647 \u06a9\u0627\u0631\u06cc \u062a\u0648\u0644\u06cc\u062f \u06a9\u0631\u062f\u0647 \u0648 \u0632\u0646\u062c\u06cc\u0631\u0647 \u0627\u0645\u0636\u0627 \u0634\u062f\u0647 \u0631\u0627 \u0628\u0627<\/code>rawPrivateKey<\/li>\n<li>\u0631\u0648\u06cc \u06af\u0631\u0647 (Leaf) \u0622\u067e\u0644\u0648\u062f \u06a9\u0646\u06cc\u062f.<code>\u067e\u0633 \u0627\u0632 \u0646\u0647\u0627\u06cc\u06cc\u200c\u0633\u0627\u0632\u06cc\u060c \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 \u0631\u0627 \u0628\u0627 \u062f\u0633\u062a\u0648\u0631<\/code>grpc gnsi service certz ssl-profile-id<code>\u0645\u062a\u0635\u0644 \u06a9\u0631\u062f\u0647 \u0648 \u0628\u0627 \u062f\u0633\u062a\u0648\u0631<\/code>.<\/li>\n<li>show grpc certificate<code>\u062a\u0623\u06cc\u06cc\u062f \u06a9\u0646\u06cc\u062f.<\/code>\u062a\u0644\u0647\u200c\u0645\u062a\u0631\u06cc YANG \u0627\u0632 \u0637\u0631\u06cc\u0642<code>openconfig-gnsi-certz<\/code>\u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u06af\u0648\u0627\u0647\u06cc\u060c \u062a\u0627\u0632\u06af\u06cc \u0628\u0633\u062a\u0647 \u0627\u0639\u062a\u0645\u0627\u062f (Trust Bundle) \u0648 \u0634\u0645\u0627\u0631\u0646\u062f\u0647\u200c\u0647\u0627\u06cc \u062f\u0633\u062a\u200c\u062f\u0627\u062f\u0646 (Handshake) TLS \u0631\u0627 \u0627\u0633\u062a\u0631\u06cc\u0645 \u0645\u06cc\u200c\u06a9\u0646\u062f \u2014 \u0628\u0631\u0627\u06cc \u0634\u0646\u0627\u0633\u0627\u06cc\u06cc \u0632\u0648\u062f\u0647\u0646\u06af\u0627\u0645 \u062e\u0637\u0627\u0647\u0627\u06cc \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a\u060c \u062f\u0631<\/li>\n<\/ul>\n<p style=\"direction: rtl; text-align: right\"><strong style=\"color: rgb(26, 26, 26)\">\u06af\u0627\u0645 \u0628\u0639\u062f\u06cc:<\/strong>\u0628\u0631\u0627\u06cc \u0686\u0631\u062e\u0634 (Rotate) \u0627\u0639\u062a\u0628\u0627\u0631\u0646\u0627\u0645\u0647\u200c\u0647\u0627\u06cc SSH \u062f\u0631 \u06a9\u0646\u0627\u0631 gRPC TLS\u060c \u0627\u062f\u0627\u0645\u0647 \u062f\u0647\u06cc\u062f \u0628\u0627 <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/gnsi-credentialz-ssh-credential-rotation-on-cisco-ios-xr\" style=\"color: rgb(0, 102, 204)\">Credentialz<\/a>. \u0628\u0631\u0627\u06cc \u0627\u0641\u0632\u0648\u062f\u0646 \u0645\u062c\u0648\u0632 (Authorization) \u062f\u0631 \u0633\u0637\u062d \u0633\u0631\u0648\u06cc\u0633 gRPC\u060c \u0645\u0634\u0627\u0647\u062f\u0647 \u06a9\u0646\u06cc\u062f <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/grpc-authorization-with-authz\" style=\"color: rgb(0, 102, 204)\">Authz<\/a>.<\/p>\n<hr>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u0628\u0627\u0632\u06af\u0634\u062a \/ \u0644\u063a\u0648 (Undo)<\/h2>\n<table class=\"english-numbers\" style=\"direction: rtl; text-align: right\">\n<thead>\n<tr>\n<th>\u0648\u0636\u0639\u06cc\u062a<\/th>\n<th>\u0646\u062d\u0648\u0647 \u0628\u0627\u0632\u06af\u0634\u062a (Revert)<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong style=\"color: rgb(26, 26, 26)\">\u0644\u063a\u0648 \u06cc\u06a9 Rotate \u062f\u0631 \u0645\u06cc\u0627\u0646\u0647 \u062c\u0631\u06cc\u0627\u0646<\/strong><\/td>\n<td>\u0627\u0631\u0633\u0627\u0644 \u06cc\u06a9<code>\u06af\u0648\u0627\u0647\u06cc\u0646\u0627\u0645\u0647\u200c\u0647\u0627<\/code>\u067e\u06cc\u0627\u0645 \u0627\u0645\u0627 \u0628\u062f\u0648\u0646<code>finalizeRotation<\/code>\u060c \u0633\u067e\u0633 \u0628\u0633\u062a\u0646 \u062c\u0631\u06cc\u0627\u0646 grpcurl. \u062f\u0631 \u0646\u0633\u062e\u0647 IOS XR 24.4.x \u0633\u0631\u0648\u0631 \u0686\u0627\u067e \u0645\u06cc\u200c\u06a9\u0646\u062f<code>ERROR: Code: Unknown \/ Message: EOF<\/code>\u060c \u06a9\u0627\u0646\u062f\u06cc\u062f\u0627 (Candidate) \u06a9\u0646\u0627\u0631 \u06af\u0630\u0627\u0634\u062a\u0647 \u0645\u06cc\u200c\u0634\u0648\u062f \u0648 \u0645\u062a\u0631\u06cc\u0627\u0644 \u0642\u0628\u0644\u06cc \u0641\u0639\u0627\u0644 \u0628\u0627\u0642\u06cc \u0645\u06cc\u200c\u0645\u0627\u0646\u062f. \u0627\u062b\u0628\u0627\u062a: \u0627\u062c\u0631\u0627\u06cc \u0645\u062c\u062f\u062f \u0647\u0645\u0627\u0646 Rotate (\u0647\u0645\u0627\u0646<code>\u0646\u0633\u062e\u0647<\/code>, <strong style=\"color: rgb(26, 26, 26)\">\u0628\u062f\u0648\u0646<\/strong><code>forceOverwrite<\/code>) \u0645\u0648\u0641\u0642\u06cc\u062a\u200c\u0622\u0645\u06cc\u0632 \u0627\u0633\u062a \u2014 \u06a9\u0647 \u0627\u06af\u0631 \u06a9\u0627\u0646\u062f\u06cc\u062f\u0627 \u062d\u0641\u0638 \u0634\u062f\u0647 \u0628\u0648\u062f\u060c \u0645\u0645\u06a9\u0646 \u0646\u0628\u0648\u062f.<\/td>\n<\/tr>\n<tr>\n<td><strong style=\"color: rgb(26, 26, 26)\">\u0628\u0627\u0632\u06af\u0634\u062a \u0628\u0647 \u06cc\u06a9 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 \u0645\u062a\u0641\u0627\u0648\u062a<\/strong><\/td>\n<td>\u0627\u062c\u0631\u0627\u06cc \u0645\u062c\u062f\u062f<code>grpc gnsi service certz ssl-profile-id <\/code>\u062f\u0631 CLI \u0633\u06cc\u0633\u062a\u0645\u200c\u0639\u0627\u0645\u0644 IOS XR \u0628\u0631\u0627\u06cc \u0647\u062f\u0627\u06cc\u062a \u0645\u062c\u062f\u062f \u0633\u0631\u0648\u0631 gRPC.<\/td>\n<\/tr>\n<tr>\n<td><strong style=\"color: rgb(26, 26, 26)\">\u0628\u0627\u0632\u06af\u0634\u062a \u0628\u0647 TLS \u0642\u062f\u06cc\u0645\u06cc (\u063a\u06cc\u0631 Certz)<\/strong><\/td>\n<td>\u062d\u0630\u0641 \u062e\u0637 \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc<code>grpc gnsi service certz<\/code>\u0628\u0647 \u0637\u0648\u0631 \u06a9\u0627\u0645\u0644. \u0633\u0631\u0648\u0631 gRPC \u0628\u0647 \u0645\u062a\u0631\u06cc\u0627\u0644<code>cert.proto<\/code>\u0628\u0627\u0632\u0645\u06cc\u200c\u06af\u0631\u062f\u062f \u0648 \u0633\u067e\u0633 \u0628\u0647 \u0645\u0633\u06cc\u0631\u0647\u0627\u06cc PEM \u062a\u0631\u0627\u0633\u062a\u200c\u067e\u0648\u06cc\u0646\u062a (Trustpoint) \u0642\u062f\u06cc\u0645\u06cc.<\/td>\n<\/tr>\n<tr>\n<td><strong style=\"color: rgb(26, 26, 26)\">\u062d\u0630\u0641 \u06cc\u06a9 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 \u062a\u0633\u062a<\/strong><\/td>\n<td><code>DeleteProfile<\/code>RPC \u2014 \u062a\u0646\u0647\u0627 \u062f\u0631 \u0635\u0648\u0631\u062a\u06cc \u06a9\u0627\u0631 \u0645\u06cc\u200c\u06a9\u0646\u062f \u06a9\u0647 \u067e\u0631\u0648\u0641\u0627\u06cc\u0644 \u0628\u0647 \u0633\u0631\u0648\u0631 gRPC \u0641\u0639\u0627\u0644 \u0645\u062a\u0635\u0644 \u0646\u0628\u0627\u0634\u062f.<\/td>\n<\/tr>\n<tr>\n<td><strong style=\"color: rgb(26, 26, 26)\">\u062c\u0627\u06cc\u06af\u0632\u06cc\u0646\u06cc \u0645\u062a\u0631\u06cc\u0627\u0644 \u06af\u0648\u0627\u0647\u06cc\u0646\u0627\u0645\u0647 \u0645\u0639\u06cc\u0648\u0628<\/strong><\/td>\n<td>\u0627\u062c\u0631\u0627\u06cc \u06cc\u06a9<code>Rotate<\/code>\u062f\u06cc\u06af\u0631 \u0628\u0627<code>forceOverwrite: true<\/code>\u0648 \u0645\u062a\u0631\u06cc\u0627\u0644 \u0627\u0635\u0644\u0627\u062d\u200c\u0634\u062f\u0647. \u0646\u06cc\u0627\u0632\u06cc \u0628\u0647 \u062d\u0630\u0641 \u0627\u0648\u0644\u06cc\u0647 \u0646\u06cc\u0633\u062a.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr>\n<h2 style=\"color: rgb(26, 26, 26); font-weight: 700; direction: rtl; text-align: right\">\u0645\u0631\u0627\u062c\u0639<\/h2>\n<ol style=\"direction: rtl; text-align: right\">\n<li>OpenConfig \u2014 <a href=\"https:\/\/github.com\/openconfig\/gnsi\/blob\/main\/certz\/certz.proto\" style=\"color: rgb(0, 102, 204)\"><code>certz.proto<\/code><\/a>, <a href=\"https:\/\/github.com\/openconfig\/gnsi\/blob\/main\/certz\/README.md\" style=\"color: rgb(0, 102, 204)\"><code>certz\/README.md<\/code><\/a><\/li>\n<li>OpenConfig \u2014 <a href=\"https:\/\/www.netconfcentral.org\/modules\/openconfig-gnsi-certz\/2024-02-13\/source\/raw\/\" style=\"color: rgb(0, 102, 204)\"><code>openconfig-gnsi-certz<\/code>\u0645\u062f\u0644 YANG \u0646\u0633\u062e\u0647 0.5.0<\/a><\/li>\n<li>Cisco IOS XR \u2014 <a href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/iosxr\/cisco8000\/programmability\/b-programmability-configuration-guide-cisco8000\/m-grpc-authentication.html#concept_C66C0E5371BF46E8937AB14F7D25EE11\" style=\"color: rgb(0, 102, 204)\">\u0631\u0627\u0647\u0646\u0645\u0627\u06cc \u067e\u06cc\u06a9\u0631\u0628\u0646\u062f\u06cc \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u067e\u0630\u06cc\u0631\u06cc (Programmability): \u0627\u062d\u0631\u0627\u0632 \u0647\u0648\u06cc\u062a gRPC \u2014 \u0645\u062f\u06cc\u0631\u06cc\u062a \u06af\u0648\u0627\u0647\u06cc\u0646\u0627\u0645\u0647\u200c\u0647\u0627 \u0628\u0627 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 Certz.proto<\/a><\/li>\n<li>Cisco IOS XR \u2014 <a href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/iosxr\/cisco8000\/programmability\/b-programmability-cr-cisco8000\/grpc-commands.html\" style=\"color: rgb(0, 102, 204)\">\u0645\u0631\u062c\u0639 \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0628\u0631\u0646\u0627\u0645\u0647\u200c\u067e\u0630\u06cc\u0631\u06cc (Programmability): \u062f\u0633\u062a\u0648\u0631\u0627\u062a gRPC<\/a><\/li>\n<li>XRdocs \u2014 <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/Introduction-to-gnsi\" style=\"color: rgb(0, 102, 204)\">\u0645\u0642\u062f\u0645\u0647\u200c\u0627\u06cc \u0628\u0631 gNSI (\u0645\u062c\u0648\u0632\u062f\u0647\u06cc \u06cc\u0627 Authz)<\/a>, <a href=\"https:\/\/xrdocs.io\/programmability\/blogs\/PathZ\" style=\"color: rgb(0, 102, 204)\">PathZ<\/a><\/li>\n<\/ol>\n<hr>\n<div style=\"display: flex\" title=\"\u0627\u0646\u062a\u062e\u0627\u0628 \u06a9\u0644 \u0627\u06cc\u0646 \u0628\u062e\u0634\">&nbsp;<\/div>\n<div style=\"display: flex\" title=\"\u0627\u0646\u062a\u062e\u0627\u0628 \u06a9\u0644 \u0627\u06cc\u0646 \u0628\u062e\u0634\">&nbsp;<\/div>\n<div title=\"\u0627\u0646\u062a\u062e\u0627\u0628 \u06a9\u0644 \u0627\u06cc\u0646 \u0628\u062e\u0634\" style=\"display: flex\"><svg width=\"14\" height=\"14\" viewBox=\"0 0 24 24\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"2.5\"><\/svg><\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\u0645\u0634\u06a9\u0644 \u0645\u062c\u0648\u0632\u062f\u0647\u06cc (Authz) \u0648 \u0645\u0633\u06cc\u0631\u062f\u0647\u06cc (Pathz) \u06a9\u0646\u062a\u0631\u0644 \u0645\u06cc\u200c\u06a9\u0646\u0646\u062f \u06a9\u0647 \u06a9\u0644\u0627\u06cc\u0646\u062a\u200c\u0647\u0627 \u062f\u0631 \u0628\u0633\u062a\u0631 gRPC \u0648 gNMI \u0686\u0647 \u0627\u0642\u062f\u0627\u0645\u0627\u062a\u06cc \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u0646\u062f \u0627\u0646\u062c\u0627\u0645 \u062f\u0647\u0646\u062f\u060c \u0627\u0645\u0627 \u062a\u0645\u0627\u0645\u06cc \u0627\u06cc\u0646 \u0645\u0648\u0627\u0631\u062f\u2026<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[98,232,234,47,236,35],"tags":[],"class_list":["post-250","post","type-post","status-publish","format-standard","hentry","category-automation","category-gnsi","category-grpc","category-iosxr","category-programmability","category-security"],"_links":{"self":[{"href":"https:\/\/www.anynet.ir\/blog\/wp-json\/wp\/v2\/posts\/250","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.anynet.ir\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.anynet.ir\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.anynet.ir\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.anynet.ir\/blog\/wp-json\/wp\/v2\/comments?post=250"}],"version-history":[{"count":0,"href":"https:\/\/www.anynet.ir\/blog\/wp-json\/wp\/v2\/posts\/250\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.anynet.ir\/blog\/wp-json\/wp\/v2\/media?parent=250"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.anynet.ir\/blog\/wp-json\/wp\/v2\/categories?post=250"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.anynet.ir\/blog\/wp-json\/wp\/v2\/tags?post=250"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}