IOS-XR XML agent ssl

Question

I have enabled xml agent on ASR9k:

#show run xml agent ssl
Tue May 20 22:19:11.791 UTC
xml agent ssl
 iteration off
!

When I try to connect to port 38752 it gets disconnected with connection reset

# openssl s_client -connect 10.104.56.84:38752 
CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 225 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---

How do I connect to the XML agent with SSL?

Answer 1

The router needs to generate a certificate that it can use to encrypt the communication. See the Cisco configuration guide chapter on "Implementing Secure Socket Layer" here: http://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k_r5-1/security/configuration/guide/b_syssec_cg51xasr9k/b_syssec_cg51xasr9k_chapter_01001.html

Answer 2

Cisco IOS XR XML API Guide, Cisco IOS XR Release 4.1

The k9sec package is required to use the SSL agent. The configuration is rejected during a commit when the k9sec package is not active on the system. When the k9sec package is deactivated after configuring the SSL agent, the agent is not available.