Skip to content
Docs sslbrain sslbrain.com

Juniper SRX / vSRX

Copy link to the page “Juniper SRX / vSRX”

← All integrations

Firewall and VPN

Replaces the J-Web HTTPS certificate through Junos CLI over SSH with commit confirmed and a served-certificate check.

The appliance runs the package and drives the Juniper SRX / vSRX command line over SSH on port 22. No agent is installed on the device.

What happens

  1. The appliance connects to the Juniper SRX / vSRX command line over SSH, port 22.
  2. The agent reads the model, Junos version, J-Web binding, PKI and commit status. It records the previous binding and probes the served leaf.
  3. The PEM certificate, issuer-ordered chain and unencrypted key are copied with SCP and loaded under an ID derived from the name and SHA-256. The staged files are purged.
  4. J-Web is bound to the new PKI certificate with commit check and commit confirmed. Every commit carries a comment with the agent's certificate-id, so the agent confirms or withdraws only its own change. The agent rereads the binding and commit status and probes the HTTPS certificate. If it fails: If TLS does not show the new certificate (the old leaf, no answer or another certificate), the agent withdraws its switch. If its switch breaks a previously working J-Web, it restores the previous binding. If the switch is still unconfirmed when the window expires, Junos reverts it; any other commit on the device before then confirms it.
  5. The switch is confirmed only when J-Web serves the new certificate over TLS and a fresh read just before shows the agent's own pending commit. Rollback uses the deployment state and restores only the agent-owned switch when a previously healthy service has stopped answering.

Technical details

Connection
The package runs on the appliance, which connects over SSH, port 22. No agent is installed.
Service ports
443
You need
SSH and SCP with a pinned SSH host key. The Junos user needs view, maintenance, security, configure and system-control; reset for the optional J-Web restart. The appliance supplies the target, SSH credentials and host key fingerprint, and must reach J-Web over HTTPS to check the served certificate.
Platform
Junos OS on SRX and vSRX
Actions
Discovery, Installation, Verification, Rollback
Packages
juniper-srx-ssh 1.0.0
Note
  • Junos 19.1R1+ uses the documented J-Web profile. Older releases use the same load/bind commands with a version warning; identity uses SHA-256 when shown, otherwise serial, end date and subject. OpenSSH 9.0+ uses scp -O.
  • Bash 4.4+, Python 3, OpenSSL 1.1.1+ and OpenSSH 8.4+, or PowerShell 7.4+ with OpenSSH. Windows requires SSH key authentication, supplied protected by the executor. PFX and encrypted keys are rejected. RSA 2048/3072/4096 and ECDSA P-256/P-384 are supported.
  • Discovery lists IKE, SSL proxy and J-Web virtual domains without changing them. Chassis clusters are read-only; MNHA nodes are separate targets. A new J-Web binding takes control away from the previous identity's auto-re-enrollment for this service. Other uses of the certificate and auditing are preserved.
  • Deploy requires that the appliance reaches J-Web over TLS: with no handshake, or another certificate on the endpoint, the switch is withdrawn and the result is activation_not_verified. Set JUNOS_VERIFY_ADDRESS, JUNOS_VERIFY_PORT and JUNOS_VERIFY_SNI when J-Web does not answer on the SSH address and the configured port. Missing served intermediates and name differences are warnings. SNI for a J-Web virtual domain selects that domain's own binding.

Get started