WAN Edge Registration with Enterprise CA Certificates
Short answer
BD Generate a CSR manually within vManage server and Install the certificate received from the CA server manually on the vManage.
Question
Key Takeaways
The question tests the distinction between manual CSR generation on the edge versus controller-managed CSR generation when using an Enterprise CA in a multi-controller environment.
This page explains the correct certificate workflow for registering Cisco SD-WAN WAN Edges to vManage controllers using an Enterprise CA. It clarifies that CSR generation must occur on the controller (vManage) and certificates must be installed there, distinguishing this from manual edge-based enrollment.
Common mistake: Many learners choose A and E because they assume the edge device must generate its own CSR and request the certificate manually, which is incorrect for the standard Enterprise CA integration pattern shown in the exhibit.
Expert Analysis
Why the Answer Is Correct
When integrating Cisco SD-WAN WAN Edges with an Enterprise CA in a multi-vManage environment, the recommended and supported workflow involves the vManage controllers handling the Certificate Signing Request (CSR) generation. Option B is correct because you must generate the CSR within the vManage server (or via the vManage API/UI) so it can sign the certificate against the Enterprise CA. Option D is correct because the resulting signed certificate must be installed on the vManage controller to facilitate the trust chain for the WAN Edges. This allows the WAN Edges to register securely without needing direct access to the CA or manual certificate management on every edge device.
Why the Other Options Are Wrong
Options A, C, and E describe a manual enrollment process where the edge generates a CSR (C), requests the cert (E), and installs it (A). While technically possible in isolated setups, this is not the standard 'Enterprise CA' configuration implied by the exhibit and exam doctrine for registered WAN Edges. The term 'registered' implies the controller manages the identity. Option C is wrong because generating CSRs manually on the WAN Edge bypasses the controller's ability to manage the certificate lifecycle. Option E is wrong because the edge does not directly request certificates from the Enterprise CA in this architecture; the vManage acts as the intermediary.
Community Comment Notes
Community discussion is split between BD and AE. Users like Networkchamp87 and Knowledge33 correctly identify BD based on official Cisco deployment guides. However, several users (e.g., PureInertiaCopy, Outlaw_87) argue for AE, citing lab experiences or specific manual configurations. One user noted that if the picture shows 'Enterprise', it implies the CA is already trusted, but the exam question specifically asks for the configuration needed to get them registered, which points to the controller-side actions. As one commenter stated, 'Process for that is B,D,' aligning with the official SD-WAN Controller Certificate Deploy Guide.
Official Reference
This link opens the official vendor documentation in a new tab.
Exam Strategy
For SD-WAN security questions involving 'Enterprise CA' and 'Registration', always look for options where the vManage controller handles the CSR and certificate installation. Avoid options that suggest manual interaction on the WAN Edge unless the question explicitly states 'Manual Enrollment'.
Frequently Asked Questions
Why can't the WAN Edge generate its own CSR?
What is the difference between Manual and Enterprise CA?
Community Votes
53% of anonymous learners picked answer BD. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 7 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 7
-
Networkchamp87 👍 3Enterprise - Mean you are using an Enterprise CA, not Default / Cloud I.E Cisco & DigiCert. Process for that is B,D.
-
Outlaw_87 👍 2In the picture it shows Enterprise not Manual. So, B and C eliminates. If Controller Certificate Authorization shows Enterprise I hope certificate from CA is already installed in vManage. So, D eliminates. Remains A and E.
-
rubendrios 👍 21 and 2 clearly states what to do to configure https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/SDWAN/sdwan-wan-edge-onboarding-deploy-guide-2020nov.pdf
-
RafaJohnston76 👍 2I believe is BD https://www.cisco.com/c/en/us/td/docs/solutions/CVD/SDWAN/cisco-sdwan-controller-cert-deploy-guide.html
-
PureInertiaCopy 👍 2BD don't make sense to me . I think it's A and E
Show 2 more comments
-
Networkchamp87 👍 1To On-board a WAN edge using enterprise CA [which is the exact same lab setup by Keith B on CBTnug) You need to put a root cert on the edge, which you pull from the vmanage using the request file command. You then need to install it by using the request " request root-cert-chain install" https://www.cisco.com/c/en/us/support/docs/routers/sd-wan/221605-install-root-certificate-on-sdwan-vedges.html
-
Knowledge33 👍 3B and D are correct
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All 300-415 Questions
Access 120 questions with complete answers and detailed explanations.
View Full 300-415 Practice Test →