Question

A network engineer configures a gNMI dial-in subscription over TLS between a Cisco IOS XR router and a telemetry collector. The router presents a server certificate whose Common Name and Subject Alternative Name contain only the router's loopback IP address (10.0.0.1), but the collector initiates the session using the router's DNS hostname (rtr1.example.com). SNMP and NETCONF over SSH work fine. The gNMI session fails during the TLS handshake with a certificate validation error on the collector. Which action resolves the failure while keeping TLS validation enabled?

Accepted Answer

Reissue the router's server certificate so that its SAN includes the DNS name rtr1.example.com used by the collector to connect

Answer

Switch the gNMI session from TLS to mTLS so the collector also presents a client certificate

Answer

Disable TLS on the gNMI server and rely on the underlying TCP session for transport security

Answer

Increase the gNMI sample-interval so the subscription negotiates before the TLS timer expires