TACACS+ over TLS

TACACS+ over TLS (RFC 9887) wraps the TACACS+ session in TLS instead of the shared-secret obfuscation of classic TACACS+. Both sides authenticate with certificates: Taranac presents a server certificate, and the device presents a client certificate from a CA Taranac trusts. The policy, profiles, command sets and logging are exactly those of TACACS+. Only the transport changes.

The listener is on by default and runs next to the classic one:

Listener	Port	Variable
Classic TACACS+	TCP 49	TACACS_PORT
TACACS+ over TLS	TCP 6049	TACACS_TLS_PORT

The port is one number end to end: the port published on the host, the port the daemon listens on inside its container and the port AAA → Settings → TACACS+ shows (read-only). To change it, edit TACACS_TLS_PORT in .env and run ./taranac up -d. In a cluster, keep it the same on every node. Enable TLS Listener on the same page turns the listener off.

Platforms with TACACS+ over TLS support include Cisco IOS-XE 17.18+, IOS-XR 7.x+ and NX-OS 10.x+. Taranac accepts TLS 1.3 and TLS 1.2, because some device firmware negotiates only 1.2.

A fresh installation needs no TLS configuration on the Taranac side:

• The listener presents a generated server certificate, signed by the Taranac Infrastructure CA and naming this node’s addresses.
• The listener trusts client certificates from every internal CA, so a device holding a certificate from your Taranac PKI, whether issued by hand or enrolled over EST, can connect.

The installer’s final screen prints the TLS endpoint (<node address>:6049) next to the EST gateway URL.

What a device needs:

1. Trust the CA that signed the server certificate. For the generated certificate, this is the Taranac Infrastructure CA. Download it from Settings → PKI / Certificates: select the CA in the tree and click Download CA certificate (PEM).
2. A client certificate from a CA the listener trusts, with its key. See PKI & trust to issue one, or EST enrollment to enroll the device automatically.
3. The TACACS+ server configured on port 6049 with TLS, at an address the server certificate names.

The Server Certificate card on AAA → Settings → TACACS+ manages the certificate the listener presents. Taranac sends it with its intermediate CAs, so a device that trusts only the root can still build the chain.

Each node generates its own server certificate, signed by its Infrastructure CA. Its subject alternative names list the node’s addresses:

• TARANAC_NODE_IPS from .env (the installer detects it; ./taranac update adds it when missing)
• TARANAC_DOMAIN and NODE_ADDRESS, when set

A device configured with the server’s IP address checks for that address among the IP SANs, so these addresses matter. Each time the api container starts, the certificate is checked and reissued if it does not cover all of these addresses or expires within 30 days. The listener picks up the reissued certificate on its own, without a restart.

After the node’s address changes, edit TARANAC_NODE_IPS in .env and run ./taranac up -d.

Replace the generated certificate when your devices should verify Taranac against a CA they already trust:

Action	When
Issue from Internal CA	The devices trust one of your Internal CAs. Fill in IP addresses (SAN) with every address devices use to reach this server. A hostname CN is also written as a DNS SAN.
Upload Certificate	The certificate comes from a corporate or public CA. Create the key and the CSR outside Taranac, have the CA sign it, then upload the certificate, its key and the CA chain (intermediates and root).
Generate Self-Signed	Labs only. Every device must be told to trust this one certificate.

Then click Deploy to tac_plus-ng. The daemon reloads with the new certificate, with no restart. If the daemon cannot load a certificate or key, only TLS handshakes fail: classic TACACS+ on port 49 keeps working.

A certificate you deployed is never replaced by the automatic reissue, whatever addresses the node gets later. You keep it current yourself: watch its expiry on the card.

The TLS Client Trust card, on the same page, decides which CAs may sign the certificates devices present. It has two modes:

Mode	Trusted
All internal CAs (default)	Every enabled, active Internal CA, the Infrastructure CA included. Imported Trusted CAs are not included.
Selected CAs	Exactly the CAs you add to the two lists: Internal CAs and Trusted CAs (imported).

Imported CAs are trusted only when selected. A Trusted CA is usually a corporate root imported for EAP-TLS, and trusting it here would let every domain laptop reach the TACACS+ transport. To accept device certificates from an external CA, switch to Selected CAs and add it under Trusted CAs.

Use Selected CAs to narrow trust, for example to the one CA that issues your network devices’ certificates.

In All internal CAs mode, the card shows Trusted now: the CAs the listener actually trusts at the moment. A CA you create later is added automatically.

Rules that apply in both modes:

• Nothing selected means no client. In Selected CAs mode with both lists empty, no TLS client can authenticate. While the listener is on, the card warns when no CA can be used.
• A disabled or inactive CA is not trusted. The same applies to an Internal CA issued under a disabled or inactive CA. The card marks such a CA Not in use.
• Selecting an intermediate CA trusts its whole root. The listener needs the chain up to the root, so a certificate from any CA under that root is accepted. To separate two issuers, give them separate roots.
• Changes apply without a restart. Save the card, and TACACS+ auto-reload applies the change to new connections, the same way it applies policy changes.

Choosing CAs from the lists needs the NAC PKI view permission. Without it, the card shows the current selection read-only.

TLS secures the transport. It does not change how Taranac decides:

• The device is identified by its source address, as on port 49. The client certificate does not name the device to the policy. A certificate copied to another device gets the policy of the address it connects from.
• The shared secret is not used on a TLS connection.
• A device missing from the inventory is still accepted at the transport if its certificate is trusted. Only policy rules that are not limited to specific devices can match it, and Taranac raises the tacacs:unknown_device:<address> alert. Register the device, or narrow the trusted CAs.

Symptom	Likely cause	Fix
The device rejects the server certificate	The device does not trust the CA that signed it, or the address the device uses is not among its SANs	Install the Infrastructure CA (or your CA) on the device. Check that TARANAC_NODE_IPS lists the address and run ./taranac up -d. For your own certificate, reissue it with the right IP SANs.
Taranac ends the handshake although the server certificate is accepted	The device presents no client certificate, or one from a CA the listener does not trust	Configure the device’s TLS client identity (certificate and key). Check TLS Client Trust: an imported CA needs Selected CAs, and a CA marked Not in use is disabled or inactive.
No TLS client connects at all	Selected CAs mode with nothing usable selected	Add a CA, or return to All internal CAs. The card shows a warning in this state.
TLS works on one cluster node, fails after failover	The other node presents a certificate from its own Infrastructure CA	Make the device trust every node’s CA, or deploy a certificate from a common CA on every node.
The handshake succeeds, then the login fails	Policy, not TLS	Read the TACACS+ log and the AAA policy tester, as for port 49.

• TACACS+ — profiles, command sets, prompts and banners.
• PKI & trust — Internal CAs, issued certificates and Trusted CAs.
• EST enrollment — devices that enroll and renew their certificates automatically.
• Network devices — the inventory a TLS client is matched against.
• Installation — ports and .env.