Verify Switch Certificates for HFT | NVIDIA Minerva User Guide

By default, the collector connects to each switch's NVUE API over HTTPS without checking the switch's certificate. That protects against eavesdropping, but not against a device on the network posing as the switch to capture its NVUE password. To close that gap, install the NVIDIA Minerva switch certificate on the switch and register its credentials with skip_verify set to false. You can verify some switches and not others.

The installer creates one certificate for all switches. Anyone with admin access to one verified switch can get the key that every verified switch presents, so treat the key like a switch admin password.

Install the Certificate on a Switch

On the platform, find ~/minerva/pki/nvue-switch/nvue-switch.crt and nvue-switch.key. The installer also prints this path at the end of the installation.
Copy both files to the switch over SSH, for example to /tmp.

On the switch, run these commands:

chmod 644 /tmp/nvue-switch.crt /tmp/nvue-switch.key
nv action import system security certificate minerva-hft \
  uri-public-key file:///tmp/nvue-switch.crt uri-private-key file:///tmp/nvue-switch.key
rm -f /tmp/nvue-switch.key /tmp/nvue-switch.crt
nv set system api certificate minerva-hft
nv config apply -y

From the host that connects to the switch, check that the switch presents the certificate. In a single-node installation, that host is the platform; with remote collectors, it is the switch's collector. The check uses the platform root CA, which is at ~/minerva/secrets/ca-certs/root-ca.crt on the platform and on every collector. It must verify the name minerva-nvue-switch, not the switch's IP address, and print Verify return code: 0 (ok):
```
openssl s_client -connect <switch-ip>:8765 -CAfile ~/minerva/secrets/ca-certs/root-ca.crt \
  -verify_hostname minerva-nvue-switch </dev/null | grep "Verify return code"
```
Import the credential file again with skip_verify set to false for this switch. See Register Switch Credentials for HFT.

Install the certificate before you set skip_verify to false. Otherwise every collection on the switch fails with nvue_cert_untrusted.

After a Reinstallation

A clean reinstallation of the platform creates a new certificate. Install it on every verified switch. Until you do, collections on those switches fail with nvue_cert_untrusted; to keep using a switch in the meantime, import its credentials with skip_verify empty.

Stop Verifying a Switch

Import the credential file with the switch's skip_verify empty.

Optionally, restore the switch's own certificate:

nv set system api certificate self-signed
nv config apply -y

Last updated: October 29, 2026