Transport protocol requirements

REST API requires the following transport protocols.

The REST API server is supported over HTTP and HTTPS without the TLS. To support data integrity and confidentiality, REST API requires HTTPS.
REST API supports the "https" URI scheme, and SLX-OS uses the IANA assigned default port 443.
The X.509v3 based certificate is used for establishing the connection between server and client.
The X.509 certificate must be used by the client to verify the integrity of the server‘s TLS certificate. The REST API client must check the identity of the server according to Section 6 of [RFC6125].
The REST API server must authenticate client access to any protected resource. If the REST API client is not authenticated, the server must send an HTTP response with "401 Unauthorized". The error-tag value "access-denied" is used in this case.

The following is an HTTPS configuration on an SLX device.

on SLX:
crypto key label mykey rsa modulus 2048
crypto ca trustpoint myca
keypair mykey
end

crypto ca authenticate myca cert-type https directory /root/<directory>/certs file ca.cert.pem 
host <server ip> protocol
SCP user root password pass
crypto ca enroll myca cert-type https common extreme country US directory /root/<directory> 
host <server ip> locality SJ
organization Extreme orgunit Eng protocol SCP state CA user root password pass

On Linux CA:
============
cd  <your directory>

openssl ca -policy policy_anything -extensions server_cert -out slx mgmt ip.pem -config openssl.cnf 
-infiles <slx mgmt ip>.csr

From the CA host, find out the certificate creation time.  The time on the switch must be later 
than this time, or the installation will not work:
date; 
openssl x509 -noout -text -in <slx mgmt ip>.pem | grep 'Not Before'

On  SLX:
===========
To adjust the time on the switch, run the following command.  You might need to adjust for the time zone:
clock set yyyy-mm-ddThh:mm:ss

crypto ca import myca certificate directory <your directory> host <server ip> protocol SCP user root 
file <slx mgmt ip>.pem password pass

copy running-config startup-config
show crypto key mypubkey 
show crypto ca trustpoint 
show crypto ca certificates 
show running-config crypto key
show running-config crypto ca