CISCOSB-SSL

All MIBs › CISCOSB-SSL

Organization: Cisco Small Business

Last Updated: 2003-09-21

Category: VPN and Security, Vendor: RADLAN/Cisco SB

Description: Manages SSL/TLS certificate and session configuration for secure web management on Cisco Small Business switches.

Start monitoring vendor-neutral, standards-based MIB, any SNMPv3-capable network device (SNMP engine identity/boot/clock status) with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

What Is CISCOSB-SSL?

CISCOSB-SSL is a Cisco Small Business (formerly Linksys/Broadcom "rl"-prefixed) enterprise MIB module that manages SSL/TLS certificate generation for securing the device's web-based management interface. It exposes configuration objects for generating a self-signed certificate, including the certificate's distinguished-name fields (country, state/province, locality, organization, organizational unit, common name), validity period in days, and RSA key length. As a monitoring resource it is used almost entirely to track and confirm software/security configuration state - e.g., which key length and validity period were used to generate the current HTTPS management certificate - rather than hardware health or performance counters. It has no strong dependency on external MIBs, being a self-contained certificate-configuration MIB, though it relates conceptually to the device's HTTP/HTTPS management access controls. It is deployed on Cisco Small Business managed switches to secure the device's HTTPS web-management console for SMB network administrators. Engineers can download the CISCOSB-SSL file directly to load it into their MIB browser.

IPNetwork Monitor allows you to monitor SNMP objects defined in CISCOSB-SSL. Use the built-in SNMP Monitoring Browser to explore available variables, view their current values and descriptions, and select the objects you want to monitor. You can then create SNMP monitors, configure thresholds, and receive alerts when monitored values change.

Supported Devices

Cisco Small Business managed switch

Monitoring Examples

An administrator would check rlSslCertificateGenerationRsaKeyLength and rlSslCertificateGenerationValidDays in rlSslCertificateGenerationTable/rlSslCertificateGenerationEntry (indexed by rlSslCertificateGenerationIndex) to confirm the currently generated management certificate uses an adequately strong key length and has not expired. Reviewing identity fields such as rlSslCertificateGenerationCommonName and rlSslCertificateGenerationOrganizationName lets an operator verify the certificate's subject matches the expected device identity, catching a misconfigured or stale self-signed certificate before it causes browser trust warnings on the HTTPS management page.

What Can Be Monitored

SSL certificate RSA key length
SSL certificate validity period
certificate subject fields (CN, O, OU, locality, etc.)

Imported Objects

From CISCOSB-MIB

switch001

MODULE-IDENTITY

From SNMPv2-SMI

IpAddress
MODULE-IDENTITY
OBJECT-TYPE
Unsigned32

From SNMPv2-TC

DisplayString
RowStatus
TEXTUAL-CONVENTION
TruthValue

OIDs

OID symbolic	OID numeric	Type	Access	Description
rlSsl	1.3.6.1.4.1.9.6.1.101.100			The private MIB module definition for SSL.
rlSslCertificateGenerationTable	1.3.6.1.4.1.9.6.1.101.100.1		not-accessible	This table is used for : 1. generating keys and self signed certificate - saved in flash and RAM (not in configuration file) 2. generating certificate requests - saved in RAM, can be read by rlSslCertificateExportTable 3. generating self signed certificate - saved in flash and RAM (not in configuraion file) By setting rlSslCertificateGenerationAction to the appropriate value this action takes place. The other fields of this table are used for each of this actions
rlSslCertificateGenerationEntry	1.3.6.1.4.1.9.6.1.101.100.1.1		not-accessible	The row definition for this table.
INT rlSslCertificateGenerationIndex	1.3.6.1.4.1.9.6.1.101.100.1.1.1	INTEGER	read-write	This index is always set to 1 no matter for which certificate or certificate request the action refers to.
INT rlSslCertificateGenerationId	1.3.6.1.4.1.9.6.1.101.100.1.1.2	INTEGER	read-write	The device can hold a number of keys/certificates/certificate requests. These certificates are always numbered from 1 to N (maximum number of certificates in device). This field decides to which keys/certificates/certificate requests the action refers.
STR rlSslCertificateGenerationCountryName	1.3.6.1.4.1.9.6.1.101.100.1.1.3	DisplayString	read-write	Value of country name field that will appear when a new certificate request or self signed certificate is generated.
STR rlSslCertificateGenerationStateOrProvinceName	1.3.6.1.4.1.9.6.1.101.100.1.1.4	DisplayString	read-write	Value of state or province name field that will appear when a new certificate or self signed certificate is generated.
STR rlSslCertificateGenerationLocalityName	1.3.6.1.4.1.9.6.1.101.100.1.1.5	DisplayString	read-write	Value of locality field that will appear when a new certificate or self signed certificate is generated.
STR rlSslCertificateGenerationOrganizationName	1.3.6.1.4.1.9.6.1.101.100.1.1.6	DisplayString	read-write	Value of organization field that will appear when a new certificate or self signed certificate is generated.
STR rlSslCertificateGenerationOrganizationUnitName	1.3.6.1.4.1.9.6.1.101.100.1.1.7	DisplayString	read-write	Value of organization field that will appear when a new certificate or self signed certificate is generated.
STR rlSslCertificateGenerationCommonName	1.3.6.1.4.1.9.6.1.101.100.1.1.8	DisplayString	read-write	Value of common name field that will appear when a new certificate or self signed certificate is generated.
INT rlSslCertificateGenerationValidDays	1.3.6.1.4.1.9.6.1.101.100.1.1.9	INTEGER	read-write	When generating self signed certificate this field sets the valid fields. 'Valid from' is current GMT and 'valid to' current GMT + the value of this field.
INT rlSslCertificateGenerationRsaKeyLength	1.3.6.1.4.1.9.6.1.101.100.1.1.10	INTEGER	read-write	Setting the RSA key size that will be created when a new key is generated - generateRsaKeyAndSelfSignedCertificate
STR rlSslCertificateGenerationPassphrase	1.3.6.1.4.1.9.6.1.101.100.1.1.11	DisplayString	read-write	When a RSA key is generated (generateRsaKeyAndSelfSignedCertificate) this passphrase is saved in flash and when the time comes and the certificate and the key are exported in PKCS12 format this passphrase is used to encrypt it. If the passphrase is empty the key and certificate can not be exported. There is no method of obtaining this passphrase once a key was generated.
INT rlSslCertificateGenerationAction	1.3.6.1.4.1.9.6.1.101.100.1.1.12	INTEGER	read-write	Setting to a regenerateCertificate causes a new certificate to be generated and to be used for all new sessions.
rlSslCertificateExportTable	1.3.6.1.4.1.9.6.1.101.100.2		not-accessible	This table is used for viewing saved data from RAM and flash.
rlSslCertificateExportEntry	1.3.6.1.4.1.9.6.1.101.100.2.1		not-accessible	The row definition for this table.
INT rlSslCertificateExportId	1.3.6.1.4.1.9.6.1.101.100.2.1.1	INTEGER	read-only	Identifies the index of this certficate / certificate request the table holds.
INT rlSslCertificateExportType	1.3.6.1.4.1.9.6.1.101.100.2.1.2	INTEGER	read-only	Identifies the type of data the current entry shows.
INT rlSslCertificateExportFragmentId	1.3.6.1.4.1.9.6.1.101.100.2.1.3	INTEGER	read-only	Identifies the index of this fragment in the certificate request.
OCT rlSslCertificateExportFragmentText	1.3.6.1.4.1.9.6.1.101.100.2.1.4	OCTET STRING	read-only	A part of the readable text entry for the certificate request.
INT rlSslCertificateSave	1.3.6.1.4.1.9.6.1.101.100.3	INTEGER	read-write	Saves data from rlSslCertificateImportTable to RAM and CDB. When an external certificate should be copied to the device first we copy it to rlSslCertificateImportTable and then this scalar is set to the certificate id that we want to save - 1. All entries in rlSslCertificateImportTable that have this id and their format is equal to the current value of rlSslCertificateSaveFormat are concatenated. 2. If the imported certificate format is .. - section 1 result is validated against the key with the same index. If validation fails for any reason - the certificate is not saved and the setting this scalar fails.] This scalar is for certificate 1 only... for certificate 2 use rlSslCertificateSave2
INT rlSslCertificateSaveFormat	1.3.6.1.4.1.9.6.1.101.100.4	INTEGER	read-write	.
STR rlSslImportedPKCS12CertificatePassphrase	1.3.6.1.4.1.9.6.1.101.100.5	DisplayString	read-write	.
rlSslCertificateImportTable	1.3.6.1.4.1.9.6.1.101.100.6		not-accessible	This table is used for copying an external certificate to the device - see rlSslCertificateSave
rlSslCertificateImportEntry	1.3.6.1.4.1.9.6.1.101.100.6.1		not-accessible	The row definition for this table.
INT rlSslCertificateImportId	1.3.6.1.4.1.9.6.1.101.100.6.1.1	INTEGER	read-write	The certificate ID.
INT rlSslCertificateImportFormat	1.3.6.1.4.1.9.6.1.101.100.6.1.2	INTEGER	read-write	.
INT rlSslCertificateImportFragmentId	1.3.6.1.4.1.9.6.1.101.100.6.1.3	INTEGER	read-write	Identifies the index of this fragment in the certificate.
OCT rlSslCertificateImportFragmentText	1.3.6.1.4.1.9.6.1.101.100.6.1.4	OCTET STRING	read-write	A part of the readable text entry for the certificate.
ROW rlSslCertificateImportFragmentStatus	1.3.6.1.4.1.9.6.1.101.100.6.1.5	RowStatus	read-write
INT rlSslSSLv2Enable	1.3.6.1.4.1.9.6.1.101.100.7	INTEGER	read-write	if enabled then SSLv2 will be supported , if disabled SSLv2 won't be supported. only SSLV3 and TSL1. Note: disabling SSLv2 is more secure.
rlSslImportExportSelfKeyTable	1.3.6.1.4.1.9.6.1.101.100.8		not-accessible	This table can be used for 2 purposes: 1) Importing public/private key pair to serve as the device key when acting as SSL server. This is done by setting entries to this table, according to the specified format. When the last entry (footer) is set, the whole key pair is checked and if valid, stored in CDB. 2) Exporting the device SSL server public/private key. This can be done by performing GetNext operations on this table.
rlSslImportExportSelfKeyEntry	1.3.6.1.4.1.9.6.1.101.100.8.1		not-accessible	The row definition for this table.
INT rlSslImportExportSelfKeyFormat	1.3.6.1.4.1.9.6.1.101.100.8.1.1	INTEGER	not-accessible	Specifies the format of public/key pair. The following formats are supported for import/export: 1) uuencoded_format - in this format both private and public key are in uu-encoded format, and are seperated from one another by header and footer. An example of the concateneation of all fragments in this format is: -----BEGIN RSA PRIVATE KEY----- tDaNkZZoCxXfkLLsLDlZ6T9H8U4Gz637eRV7BYBpapkidAxY1UG0/qgfKLPkbId4wzht6ArV9bE4fMtX wSMOxL3q31pOmUdVhjbWYcgZQBDy1DjFSbuIEdP85c96B9bBE2nPv90mSvb/6j8R2NItT/KJeiYMtLtI N3m6/zESKJGIrX0jP1RFDjVZSS5chSAFgB0egsLZEyOQn7jAqpX/x/easD2J6F/OjPXlJ9Hff2tMb3NU QYyBoWH2J9IxhWB6Vo66R9Y04JGR18uL/rV2sMCtpg5ppkVTEpNTp9qE1yXocR2NmzUfNFap+GJ4IHj8 CzkVfmJM/kEWaJsYgHbAgLyRg4QVyelfobv1B71aQ+u1z9KGu/QajkWdR04OQfsGOL1CvU2LGYDcRjfH jv+jl/UkDRRjoD9kt2WvouT+OL6esvKl0OJBqWbGNXg9TWv/VLtJIwgUno+MLaJuOM4Fh44+wpnqUXwQ TFtBFc8pzt5BoOwbv9gXpicTkq4/+GhwXWXxSVFebKhnHAvKSLT+Ba7K7ZeR8EIIxbXdDNFOiS45R2KI jxxXLXK44u6KGl5MygCKXUOFlJ+Zhgrq6ZH17z/RVJQ2CWqb5Ekn9GY3kH9QZ3mb4MDPfriWi2lHGXHY JmJd4SLQhpBdnOS5tu84QmyU3dNbAdzghDsR+dEY/6g7Cn0kcVkeHNZ0H+mCZik5f6XBD8eplkk43bdR FrkwTeAjwurGcKwdiKkR4DlfSq3DKssVBucTqUpqsKqPXLwTIL44rWKhEPXgGPB2XDG0VLvIRKkAgEGI LNTwOm091Ro= -----END RSA PRIVATE KEY----- -----BEGIN RSA PUBLIC KEY----- MIGHAoGBAOeIC9gRg3YaEGGMp3C00qNwLINAEDZV/J4BWM5WnWwCWZyHXDs2XiEmFu0ZONAD4gcT2f2f NNfCBPye39VVuOkKQuSV0MLLX5800LZ4y1BNcPzPZHpnGaCzl7iAjhfj9MolzAh5VRjeiYt0t1um4dm+ q9A4BtfpJqDYxCW9uxd/AgEj -----END RSA PUBLIC KEY-----
INT rlSslImportExportSelfKeyIndex	1.3.6.1.4.1.9.6.1.101.100.8.1.2	INTEGER	not-accessible	Identifies the SSL server key index (there can be more than one key).
INT rlSslImportExportSelfKeyFragmentId	1.3.6.1.4.1.9.6.1.101.100.8.1.3	INTEGER	not-accessible	Identifies the index of this fragment in the key pair input/output.
RLS rlSslImportExportSelfKeyAlgorithm	1.3.6.1.4.1.9.6.1.101.100.8.1.4	RlSslPublicKeyAlgorithm	read-write	Identifies the type of key pair.
OCT rlSslImportExportSelfKeyFragmentText	1.3.6.1.4.1.9.6.1.101.100.8.1.5	OCTET STRING	read-write	A part of the readable text entry for the key pair input/output.
INT rlSslCertificateSave2	1.3.6.1.4.1.9.6.1.101.100.9	INTEGER	read-write	Saves data from rlSslCertificateImportTable to RAM and CDB. When an external certificate should be copied to the device first we copy it to rlSslCertificateImportTable and then this scalar is set to the certificate id that we want to save - 1. All entries in rlSslCertificateImportTable that have this id and their format is equal to the current value of rlSslCertificateSaveFormat are concatenated. 2. If the imported certificate format is .. - section 1 result is validated against the key with the same index. If validation fails for any reason - the certificate is not saved and the setting this scalar fails.] This scalar is for certificate 2 only... for certificate 1 use rlSslCertificateSave
T/F rlSslisCertificate1Default	1.3.6.1.4.1.9.6.1.101.100.10	TruthValue	read-write	if set to true then this is the default key , will be configured when auto generation is done , will set to try , all other cases will be set to false.
T/F rlSslisCertificate2Default	1.3.6.1.4.1.9.6.1.101.100.11	TruthValue	read-write	if set to true then this is the default key , will be configured when auto generation is done , will set to try , all other cases will be set to false.

RFC description

Manages SSL certificate generation, import/export, and configuration on Cisco Small Business devices for secure management access.

Start monitoring Cisco Small Business managed switch with a free 30-day trial of IPNetwork Monitor. Import MIBs, browse SNMP OIDs, create custom SNMP monitors, configure alerts, and monitor any SNMP-enabled network device from a single console.

Download CISCOSB-SSL

What Is CISCOSB-SSL?

Supported Devices

Monitoring Examples

What Can Be Monitored

This MIB depends on

Related MIBs

RFC description