I'm trying to create a csr for a cisco prime server.

I managed to create a csr and put it in the "defaultRepo", which is local on the disk. After what I've read I need to create a certificate repo and upload the csr to that location. Now to the real question, where am I supposed to upload the csr?

When I try to generate the csr with: admin# ncs key genkey -newdn -csr csrfile.cert repository certificates

I get the following error message:

Writing certificate signing request to /opt/CSCOlumos/migrate/restore/csrfile.cert
INFO: no staging url defined, using local space.        rval:2
ERROR: Upload of csrfile.cert failed.   rval:-200
ERROR: ncs key genkey command failed.   rval:-200

My thoughts is that i can't use that repo since it does not exist in the running config.

Follow-up question. After i have created mye certificate in a new repo, and signed it afterwards. How can i make the web-server use it (to remove URL-warnings) ?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Jan 5, 2021 at 0:41

1 Answer 1


Make sure that you have created the repository using the following commands from the Command Guide.

(Remote sftp repository for example below, but you could use tftp, ftp, etc):

ncs/admin# configure terminal
ncs/admin(config)# repository myrepository
ncs/admin(config-Repository)# url sftp://example.test.com/repository/system1
ncs/admin(config-Repository)# user luke password plain example
ncs/admin(config-Repository)# exit
ncs/admin(config)# exit

Then it looks like you have the right syntax for generating the CSR according to this document.

ncs key genkey -newdn -csr csrfilename repository repositoryname

It just seems that NCS is missing the required repository configuration, so that NCS knows where to put the CSR once it creates it.

Once you have generated the certificate, upload it to NCS using the following:

ncs key importcacert aliasname ca-cert-filename repository repositoryname

Then just issue ncs stop and ncs start from the CLI to begin using the certificates.

  • Thanks for the answer Brett. Do you have an opinion on mye follow-up?
    – Garmroth
    Jun 13, 2013 at 11:31
  • Edited above answer with more detail directed at your follow-up. Jun 13, 2013 at 11:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.