Transport protocol requirements

RESTCONF requires the following transport protocols.

The RESTCONF server is supported over HTTPS without the TLS. To support data integrity and confidentiality, RESTCONF requires HTTPS.
RESTCONF supports the "https" URI scheme, and SLX-OS uses the IANA assigned default port 443.
The X.509v3 based certificate is used for establishing the connection between server and client.
The X.509 certificate must be used by the client to verify the integrity of the server‘s TLS certificate. The RESTCONF client must check the identity of the server according to Section 6 of [RFC6125].
The RESTCONF server must authenticate client access to any protected resource. If the RESTCONF client is not authenticated, the server must send an HTTP response with "401 Unauthorized". The error-tag value "access-denied" is used in this case.

The following is an HTTPS configuration on an SLX device.

on SLX:
crypto key label mykey rsa modulus 2048
crypto ca trustpoint myca
keypair mykey
end

crypto ca authenticate <trustpoint-name> cert-type <commoncert|https> directory <dir-name> file <file-name> 
host <host-name/ip> protocol <SCP|FTP> user <user-name>
crypto ca enroll myca common brocade country US directory /root/vishu host <server ip> locality SJ organization Brocade 
orgunit Eng protocol SCP state CA user root password pass

On Linux CA:
============
cd  <your directory>

openssl ca -policy policy_anything -extensions server_cert -out 10.25.164.147.pem -config openssl.cnf 
-infiles <slx mgmt ip>.csr

From the CA host, find out the certificate creation time.  The time on the switch must be later than this time, 
or the installation will not work:
date; 
openssl x509 -noout -text -in <slx mgmt ip>.pem | grep 'Not Before'

On  SLX:
===========
To adjust the time on the switch, run the following command.  You might need to adjust for the time zone:
clock set yyyy-mm-ddThh:mm:ss

crypto ca import myca certificate directory <your directory> host <server ip> protocol SCP user root file <slx mgmt ip>.pem 
password pass

copy running-config startup-config
show crypto key mypubkey 
show crypto ca trustpoint 
show crypto ca certificates 
show running-config crypto key
show running-config crypto ca