On which device is the Cisco SD-WAN manage certificate management API able to install certificates?

The Cisco SD-WAN vManage API provides comprehensive programmatic control over the entire SD-WAN fabric. A critical function of this API is the management of the certificate lifecycle for all SD-WAN components to establish and maintain a zero-trust security posture. The official API documentation explicitly includes endpoints to manage and install certificates on both the core control plane controllers, such as the vSmart controller, and on WAN Edge devices. The CSR 1000v is a supported WAN Edge router platform (cEdge), and its certificate can be installed using the API, just like the vSmart controller's certificate.

B. vFog router: This is not a recognized component in the Cisco SD-WAN architecture and serves as a distractor option.
C. load balancer: A load balancer is an external network appliance, not a native SD-WAN component managed by the vManage API. While a vManage cluster may operate behind a load balancer, its certificate is managed independently, not through the SD-WAN API.

1. Cisco SD-WAN REST API Reference

Release 20.8: This official documentation details the API endpoints available in vManage. The "Certificate Management APIs" section lists specific calls for managing certificates on various components.

POST /certificate/vsmart: This endpoint is used to "Add vSmart certificate

" confirming that the API manages certificates for the vSmart controller (Option D).

POST /certificate/install/vedge: This endpoint is used to "Install certificate on vEdge

" confirming the API can install certificates on WAN Edge devices like the CSR 1000v (Option A).

2. Cisco Programmability and Automation for Cisco SD-WAN Courseware (via Cisco Learning Network): This material covers the use of APIs for SD-WAN management. In modules discussing certificate management

it is shown that the API interacts with all SD-WAN entities. The documentation states

"The certificate APIs allow you to manage certificates for the vSmart

vBond

and WAN Edge devices." This directly supports both options A and D.

3. Cisco SD-WAN Design Guide: In the "Security Design" chapter

the guide explains the PKI architecture. It states

"Cisco vManage is responsible for orchestrating the certificate signing and installation for all controllers (Cisco vSmart Controller and Cisco vBond Orchestrator) and WAN Edge routers." The API is the programmatic interface to this orchestration function

reinforcing that it targets both controllers and edge routers.