Question

Your team deployed a model-driven telemetry solution where IOS-XE routers use dial-out gRPC subscriptions to push telemetry to a central collector over a TLS-encrypted channel. After enabling TLS on the collector with a certificate signed by your internal CA, the routers report the subscription state as 'Connecting' and never reach 'Valid', while the collector logs show TLS handshake failures. The collector's certificate chain and private key are correctly installed. What is the most likely cause and correct remediation?

Accepted Answer

The routers do not trust the collector's certificate because the internal CA's root/intermediate certificate is not installed in the router's trustpoint; import the CA certificate into a PKI trustpoint on each router.

Answer

gRPC dial-out does not support TLS; disable TLS on the collector and use plaintext gRPC so the handshake can complete.

Answer

The sensor-path encoding is set to self-describing-gpb instead of JSON, which prevents the TLS session from negotiating; change the encoding to JSON.

Answer

The subscription cadence is set too low, causing the collector to reject connections; increase the sample-interval to allow the handshake to complete.