From ad7a54bf1f0a25e96247254ebba06fb46aec2fdb Mon Sep 17 00:00:00 2001
From: Dawei Huang <daweihuang@microsoft.com>
Date: Fri, 7 Aug 2026 17:25:00 -0500
Subject: [PATCH 01/24] [SmartSwitch] use TLS for certificate-free gNMI

Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
---
 dockers/docker-sonic-gnmi/gnmi-native.sh    | 2 +-
 dockers/docker-sonic-telemetry/telemetry.sh | 2 +-
 src/sonic-gnmi                              | 2 +-
 src/sonic-host-services                     | 2 +-
 src/sonic-utilities                         | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/dockers/docker-sonic-gnmi/gnmi-native.sh b/dockers/docker-sonic-gnmi/gnmi-native.sh
index 9bd4c3125c7..7e9e37b5ff5 100755
--- a/dockers/docker-sonic-gnmi/gnmi-native.sh
+++ b/dockers/docker-sonic-gnmi/gnmi-native.sh
@@ -57,7 +57,7 @@ elif [ -n "$X509" ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
     fi
 else
-    TELEMETRY_ARGS+=" --noTLS --bind_address 127.0.0.1"
+    TELEMETRY_ARGS+=" --insecure"
 fi
 
 # If no configuration entry exists for TELEMETRY, create one default port
diff --git a/dockers/docker-sonic-telemetry/telemetry.sh b/dockers/docker-sonic-telemetry/telemetry.sh
index 6c215651bff..92deed871b7 100755
--- a/dockers/docker-sonic-telemetry/telemetry.sh
+++ b/dockers/docker-sonic-telemetry/telemetry.sh
@@ -77,7 +77,7 @@ elif [ -n "$X509" ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
     fi
 else
-    TELEMETRY_ARGS+=" --noTLS --bind_address 127.0.0.1"
+    TELEMETRY_ARGS+=" --insecure"
 fi
 
 # If no configuration entry exists for TELEMETRY, create one default port
diff --git a/src/sonic-gnmi b/src/sonic-gnmi
index b1aa537b842..1f4e51d7b05 160000
--- a/src/sonic-gnmi
+++ b/src/sonic-gnmi
@@ -1 +1 @@
-Subproject commit b1aa537b84235971af1d6f5740c782f5f541298b
+Subproject commit 1f4e51d7b05c26b858549129e2fd91526af296ec
diff --git a/src/sonic-host-services b/src/sonic-host-services
index 233cd591c32..da87a85a6db 160000
--- a/src/sonic-host-services
+++ b/src/sonic-host-services
@@ -1 +1 @@
-Subproject commit 233cd591c324d4090a077f87da0eaaad7d12cabc
+Subproject commit da87a85a6db2cf4e34df2eff69216a44df0bfdf6
diff --git a/src/sonic-utilities b/src/sonic-utilities
index 9f5ee85c8cf..4901fdcf99b 160000
--- a/src/sonic-utilities
+++ b/src/sonic-utilities
@@ -1 +1 @@
-Subproject commit 9f5ee85c8cf79657259a954830fb75862c13e492
+Subproject commit 4901fdcf99b5ca7f1f2dd9a74e69380a84b90647

From 12b20b6250c33b2992c0f797268efb255889ba6a Mon Sep 17 00:00:00 2001
From: Dawei Huang <daweihuang@microsoft.com>
Date: Fri, 7 Aug 2026 17:47:03 -0500
Subject: [PATCH 02/24] [submodule] Update sonic-gnmi TLS fix

Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
---
 src/sonic-gnmi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/sonic-gnmi b/src/sonic-gnmi
index 1f4e51d7b05..dce81c3b292 160000
--- a/src/sonic-gnmi
+++ b/src/sonic-gnmi
@@ -1 +1 @@
-Subproject commit 1f4e51d7b05c26b858549129e2fd91526af296ec
+Subproject commit dce81c3b2923aefc094df8d17a1fdf656dce9dc9

From 74b73fa46bea2a47c0312901f79ef7bfb955fe69 Mon Sep 17 00:00:00 2001
From: Dawei Huang <daweihuang@microsoft.com>
Date: Fri, 7 Aug 2026 17:48:39 -0500
Subject: [PATCH 03/24] [submodule] Update sonic-gnmi TLS fix

Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
---
 src/sonic-gnmi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/sonic-gnmi b/src/sonic-gnmi
index dce81c3b292..f3b7022e209 160000
--- a/src/sonic-gnmi
+++ b/src/sonic-gnmi
@@ -1 +1 @@
-Subproject commit dce81c3b2923aefc094df8d17a1fdf656dce9dc9
+Subproject commit f3b7022e20930b9cb4568a506dda8133da59cb23

From 334da09987448d25cf6fae3954e09b1421b2baf5 Mon Sep 17 00:00:00 2001
From: Dawei Huang <daweihuang@microsoft.com>
Date: Fri, 7 Aug 2026 20:41:07 -0500
Subject: [PATCH 04/24] [submodule] Update sonic-utilities TLS fix

Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
---
 src/sonic-utilities | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/sonic-utilities b/src/sonic-utilities
index 4901fdcf99b..a3cc3fbe86d 160000
--- a/src/sonic-utilities
+++ b/src/sonic-utilities
@@ -1 +1 @@
-Subproject commit 4901fdcf99b5ca7f1f2dd9a74e69380a84b90647
+Subproject commit a3cc3fbe86db5963186f02a9fd23bfa36c317629

From d4c705339c967f190c33efbb520cb92dc98e24ae Mon Sep 17 00:00:00 2001
From: Dawei Huang <daweihuang@microsoft.com>
Date: Sat, 8 Aug 2026 00:58:20 -0500
Subject: [PATCH 05/24] gnmi: allow clients with ephemeral TLS

Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
---
 dockers/docker-sonic-gnmi/gnmi-native.sh    | 3 ++-
 dockers/docker-sonic-telemetry/telemetry.sh | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/dockers/docker-sonic-gnmi/gnmi-native.sh b/dockers/docker-sonic-gnmi/gnmi-native.sh
index 7e9e37b5ff5..b2d3c1d7e9f 100755
--- a/dockers/docker-sonic-gnmi/gnmi-native.sh
+++ b/dockers/docker-sonic-gnmi/gnmi-native.sh
@@ -58,6 +58,7 @@ elif [ -n "$X509" ]; then
     fi
 else
     TELEMETRY_ARGS+=" --insecure"
+    USE_EPHEMERAL_TLS=true
 fi
 
 # If no configuration entry exists for TELEMETRY, create one default port
@@ -74,7 +75,7 @@ fi
 TELEMETRY_ARGS+=" --port $PORT"
 
 CLIENT_AUTH=$(extract_field "$GNMI" '.client_auth')
-if [ -z $CLIENT_AUTH ] || [ $CLIENT_AUTH == "false" ]; then
+if [[ x"${USE_EPHEMERAL_TLS}" == x"true" ]] || [ -z $CLIENT_AUTH ] || [ $CLIENT_AUTH == "false" ]; then
     TELEMETRY_ARGS+=" --allow_no_client_auth"
 fi
 
diff --git a/dockers/docker-sonic-telemetry/telemetry.sh b/dockers/docker-sonic-telemetry/telemetry.sh
index 92deed871b7..7c55f6aac89 100755
--- a/dockers/docker-sonic-telemetry/telemetry.sh
+++ b/dockers/docker-sonic-telemetry/telemetry.sh
@@ -78,6 +78,7 @@ elif [ -n "$X509" ]; then
     fi
 else
     TELEMETRY_ARGS+=" --insecure"
+    USE_EPHEMERAL_TLS=true
 fi
 
 # If no configuration entry exists for TELEMETRY, create one default port
@@ -93,7 +94,7 @@ fi
 TELEMETRY_ARGS+=" --port $PORT"
 
 CLIENT_AUTH=$(extract_field "$GNMI" '.client_auth')
-if [ -z $CLIENT_AUTH ] || [ $CLIENT_AUTH == "false" ]; then
+if [[ x"${USE_EPHEMERAL_TLS}" == x"true" ]] || [ -z $CLIENT_AUTH ] || [ $CLIENT_AUTH == "false" ]; then
     TELEMETRY_ARGS+=" --allow_no_client_auth"
 fi
 

From d644062151c3d9a1068446ef36e9e443ed3c7066 Mon Sep 17 00:00:00 2001
From: Dawei Huang <daweihuang@microsoft.com>
Date: Sat, 8 Aug 2026 02:18:54 -0500
Subject: [PATCH 06/24] gnmi: cover every ephemeral TLS fallback

Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
---
 dockers/docker-sonic-gnmi/gnmi-native.sh    | 4 +++-
 dockers/docker-sonic-telemetry/telemetry.sh | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/dockers/docker-sonic-gnmi/gnmi-native.sh b/dockers/docker-sonic-gnmi/gnmi-native.sh
index b2d3c1d7e9f..9fccf7273f9 100755
--- a/dockers/docker-sonic-gnmi/gnmi-native.sh
+++ b/dockers/docker-sonic-gnmi/gnmi-native.sh
@@ -34,6 +34,7 @@ if [ -n "$CERTS" ]; then
     SERVER_KEY=$(extract_field "$CERTS" '.server_key')
     if [ -z $SERVER_CRT  ] || [ -z $SERVER_KEY  ]; then
         TELEMETRY_ARGS+=" --insecure"
+        USE_EPHEMERAL_TLS=true
     else
         TELEMETRY_ARGS+=" --server_crt $SERVER_CRT --server_key $SERVER_KEY "
     fi
@@ -48,6 +49,7 @@ elif [ -n "$X509" ]; then
     SERVER_KEY=$(extract_field "$X509" '.server_key')
     if [ -z $SERVER_CRT  ] || [ -z $SERVER_KEY  ]; then
         TELEMETRY_ARGS+=" --insecure"
+        USE_EPHEMERAL_TLS=true
     else
         TELEMETRY_ARGS+=" --server_crt $SERVER_CRT --server_key $SERVER_KEY "
     fi
@@ -75,7 +77,7 @@ fi
 TELEMETRY_ARGS+=" --port $PORT"
 
 CLIENT_AUTH=$(extract_field "$GNMI" '.client_auth')
-if [[ x"${USE_EPHEMERAL_TLS}" == x"true" ]] || [ -z $CLIENT_AUTH ] || [ $CLIENT_AUTH == "false" ]; then
+if [[ x"${USE_EPHEMERAL_TLS}" == x"true" ]] || [ -z "$CLIENT_AUTH" ] || [ "$CLIENT_AUTH" == "false" ]; then
     TELEMETRY_ARGS+=" --allow_no_client_auth"
 fi
 
diff --git a/dockers/docker-sonic-telemetry/telemetry.sh b/dockers/docker-sonic-telemetry/telemetry.sh
index 7c55f6aac89..0617771491b 100755
--- a/dockers/docker-sonic-telemetry/telemetry.sh
+++ b/dockers/docker-sonic-telemetry/telemetry.sh
@@ -55,6 +55,7 @@ if [ -n "$CERTS" ]; then
     SERVER_KEY=$(extract_field "$CERTS" '.server_key')
     if [ -z $SERVER_CRT  ] || [ -z $SERVER_KEY  ]; then
         TELEMETRY_ARGS+=" --insecure"
+        USE_EPHEMERAL_TLS=true
     else
         TELEMETRY_ARGS+=" --server_crt $SERVER_CRT --server_key $SERVER_KEY "
     fi
@@ -68,6 +69,7 @@ elif [ -n "$X509" ]; then
     SERVER_KEY=$(extract_field "$X509" '.server_key')
     if [ -z $SERVER_CRT  ] || [ -z $SERVER_KEY  ]; then
         TELEMETRY_ARGS+=" --insecure"
+        USE_EPHEMERAL_TLS=true
     else
         TELEMETRY_ARGS+=" --server_crt $SERVER_CRT --server_key $SERVER_KEY "
     fi
@@ -94,7 +96,7 @@ fi
 TELEMETRY_ARGS+=" --port $PORT"
 
 CLIENT_AUTH=$(extract_field "$GNMI" '.client_auth')
-if [[ x"${USE_EPHEMERAL_TLS}" == x"true" ]] || [ -z $CLIENT_AUTH ] || [ $CLIENT_AUTH == "false" ]; then
+if [[ x"${USE_EPHEMERAL_TLS}" == x"true" ]] || [ -z "$CLIENT_AUTH" ] || [ "$CLIENT_AUTH" == "false" ]; then
     TELEMETRY_ARGS+=" --allow_no_client_auth"
 fi
 

From c02431b8e7d9b30f98c5a9b0fb9c626f173e19aa Mon Sep 17 00:00:00 2001
From: Dawei Huang <daweihuang@microsoft.com>
Date: Sat, 8 Aug 2026 02:33:38 -0500
Subject: [PATCH 07/24] [submodule] Update DPU gNOI caller fallbacks

Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
---
 src/sonic-host-services | 2 +-
 src/sonic-utilities     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/sonic-host-services b/src/sonic-host-services
index da87a85a6db..36c0e34c11b 160000
--- a/src/sonic-host-services
+++ b/src/sonic-host-services
@@ -1 +1 @@
-Subproject commit da87a85a6db2cf4e34df2eff69216a44df0bfdf6
+Subproject commit 36c0e34c11b8667e4768d6164e94897df3ff8a4d
diff --git a/src/sonic-utilities b/src/sonic-utilities
index a3cc3fbe86d..1099d93335c 160000
--- a/src/sonic-utilities
+++ b/src/sonic-utilities
@@ -1 +1 @@
-Subproject commit a3cc3fbe86db5963186f02a9fd23bfa36c317629
+Subproject commit 1099d93335c5b849ed4cb8f5b201a5345c586ccc

From 7f6fcc04217d9d924680275dc053f64a1837152a Mon Sep 17 00:00:00 2001
From: Dawei Huang <daweihuang@microsoft.com>
Date: Sat, 8 Aug 2026 02:35:24 -0500
Subject: [PATCH 08/24] [submodule] Update DPU caller fallback tests

Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
---
 src/sonic-host-services | 2 +-
 src/sonic-utilities     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/sonic-host-services b/src/sonic-host-services
index 36c0e34c11b..798f9d1e773 160000
--- a/src/sonic-host-services
+++ b/src/sonic-host-services
@@ -1 +1 @@
-Subproject commit 36c0e34c11b8667e4768d6164e94897df3ff8a4d
+Subproject commit 798f9d1e77308d8b06aaed87af3af39740ae6e47
diff --git a/src/sonic-utilities b/src/sonic-utilities
index 1099d93335c..e1fd871251f 160000
--- a/src/sonic-utilities
+++ b/src/sonic-utilities
@@ -1 +1 @@
-Subproject commit 1099d93335c5b849ed4cb8f5b201a5345c586ccc
+Subproject commit e1fd871251f32dc445de5baedeb69e51016b79db

From 335786ef2fd6a7410e8a24230727adb4406e6959 Mon Sep 17 00:00:00 2001
From: Dawei Huang <daweihuang@microsoft.com>
Date: Sat, 8 Aug 2026 02:37:11 -0500
Subject: [PATCH 09/24] gnmi: quote TLS configuration values

Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
---
 dockers/docker-sonic-gnmi/gnmi-native.sh    | 8 ++++----
 dockers/docker-sonic-telemetry/telemetry.sh | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/dockers/docker-sonic-gnmi/gnmi-native.sh b/dockers/docker-sonic-gnmi/gnmi-native.sh
index 9fccf7273f9..3a33db508b7 100755
--- a/dockers/docker-sonic-gnmi/gnmi-native.sh
+++ b/dockers/docker-sonic-gnmi/gnmi-native.sh
@@ -32,7 +32,7 @@ export CVL_SCHEMA_PATH=/usr/sbin/schema
 if [ -n "$CERTS" ]; then
     SERVER_CRT=$(extract_field "$CERTS" '.server_crt')
     SERVER_KEY=$(extract_field "$CERTS" '.server_key')
-    if [ -z $SERVER_CRT  ] || [ -z $SERVER_KEY  ]; then
+    if [ -z "$SERVER_CRT" ] || [ -z "$SERVER_KEY" ]; then
         TELEMETRY_ARGS+=" --insecure"
         USE_EPHEMERAL_TLS=true
     else
@@ -40,14 +40,14 @@ if [ -n "$CERTS" ]; then
     fi
 
     CA_CRT=$(extract_field "$CERTS" '.ca_crt')
-    if [ ! -z $CA_CRT ]; then
+    if [ -n "$CA_CRT" ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
     fi
 
 elif [ -n "$X509" ]; then
     SERVER_CRT=$(extract_field "$X509" '.server_crt')
     SERVER_KEY=$(extract_field "$X509" '.server_key')
-    if [ -z $SERVER_CRT  ] || [ -z $SERVER_KEY  ]; then
+    if [ -z "$SERVER_CRT" ] || [ -z "$SERVER_KEY" ]; then
         TELEMETRY_ARGS+=" --insecure"
         USE_EPHEMERAL_TLS=true
     else
@@ -55,7 +55,7 @@ elif [ -n "$X509" ]; then
     fi
 
     CA_CRT=$(extract_field "$X509" '.ca_crt')
-    if [ ! -z $CA_CRT ]; then
+    if [ -n "$CA_CRT" ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
     fi
 else
diff --git a/dockers/docker-sonic-telemetry/telemetry.sh b/dockers/docker-sonic-telemetry/telemetry.sh
index 0617771491b..7b022d9db10 100755
--- a/dockers/docker-sonic-telemetry/telemetry.sh
+++ b/dockers/docker-sonic-telemetry/telemetry.sh
@@ -53,7 +53,7 @@ export GOTRACEBACK=crash
 if [ -n "$CERTS" ]; then
     SERVER_CRT=$(extract_field "$CERTS" '.server_crt')
     SERVER_KEY=$(extract_field "$CERTS" '.server_key')
-    if [ -z $SERVER_CRT  ] || [ -z $SERVER_KEY  ]; then
+    if [ -z "$SERVER_CRT" ] || [ -z "$SERVER_KEY" ]; then
         TELEMETRY_ARGS+=" --insecure"
         USE_EPHEMERAL_TLS=true
     else
@@ -61,13 +61,13 @@ if [ -n "$CERTS" ]; then
     fi
 
     CA_CRT=$(extract_field "$CERTS" '.ca_crt')
-    if [ ! -z $CA_CRT ]; then
+    if [ -n "$CA_CRT" ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
     fi
 elif [ -n "$X509" ]; then
     SERVER_CRT=$(extract_field "$X509" '.server_crt')
     SERVER_KEY=$(extract_field "$X509" '.server_key')
-    if [ -z $SERVER_CRT  ] || [ -z $SERVER_KEY  ]; then
+    if [ -z "$SERVER_CRT" ] || [ -z "$SERVER_KEY" ]; then
         TELEMETRY_ARGS+=" --insecure"
         USE_EPHEMERAL_TLS=true
     else
@@ -75,7 +75,7 @@ elif [ -n "$X509" ]; then
     fi
 
     CA_CRT=$(extract_field "$X509" '.ca_crt')
-    if [ ! -z $CA_CRT ]; then
+    if [ -n "$CA_CRT" ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
     fi
 else

From 590c2e449c47d0cdb69e04731581c134ccc43eea Mon Sep 17 00:00:00 2001
From: Dawei Huang <daweihuang@microsoft.com>
Date: Sat, 8 Aug 2026 02:48:42 -0500
Subject: [PATCH 10/24] gnmi: normalize missing TLS fields

Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
---
 dockers/docker-sonic-gnmi/gnmi-native.sh    | 12 ++++++------
 dockers/docker-sonic-telemetry/telemetry.sh | 12 ++++++------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/dockers/docker-sonic-gnmi/gnmi-native.sh b/dockers/docker-sonic-gnmi/gnmi-native.sh
index 3a33db508b7..fa59c815790 100755
--- a/dockers/docker-sonic-gnmi/gnmi-native.sh
+++ b/dockers/docker-sonic-gnmi/gnmi-native.sh
@@ -30,8 +30,8 @@ TELEMETRY_ARGS=" -logtostderr"
 export CVL_SCHEMA_PATH=/usr/sbin/schema
 
 if [ -n "$CERTS" ]; then
-    SERVER_CRT=$(extract_field "$CERTS" '.server_crt')
-    SERVER_KEY=$(extract_field "$CERTS" '.server_key')
+    SERVER_CRT=$(extract_field "$CERTS" '.server_crt // empty')
+    SERVER_KEY=$(extract_field "$CERTS" '.server_key // empty')
     if [ -z "$SERVER_CRT" ] || [ -z "$SERVER_KEY" ]; then
         TELEMETRY_ARGS+=" --insecure"
         USE_EPHEMERAL_TLS=true
@@ -39,14 +39,14 @@ if [ -n "$CERTS" ]; then
         TELEMETRY_ARGS+=" --server_crt $SERVER_CRT --server_key $SERVER_KEY "
     fi
 
-    CA_CRT=$(extract_field "$CERTS" '.ca_crt')
+    CA_CRT=$(extract_field "$CERTS" '.ca_crt // empty')
     if [ -n "$CA_CRT" ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
     fi
 
 elif [ -n "$X509" ]; then
-    SERVER_CRT=$(extract_field "$X509" '.server_crt')
-    SERVER_KEY=$(extract_field "$X509" '.server_key')
+    SERVER_CRT=$(extract_field "$X509" '.server_crt // empty')
+    SERVER_KEY=$(extract_field "$X509" '.server_key // empty')
     if [ -z "$SERVER_CRT" ] || [ -z "$SERVER_KEY" ]; then
         TELEMETRY_ARGS+=" --insecure"
         USE_EPHEMERAL_TLS=true
@@ -54,7 +54,7 @@ elif [ -n "$X509" ]; then
         TELEMETRY_ARGS+=" --server_crt $SERVER_CRT --server_key $SERVER_KEY "
     fi
 
-    CA_CRT=$(extract_field "$X509" '.ca_crt')
+    CA_CRT=$(extract_field "$X509" '.ca_crt // empty')
     if [ -n "$CA_CRT" ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
     fi
diff --git a/dockers/docker-sonic-telemetry/telemetry.sh b/dockers/docker-sonic-telemetry/telemetry.sh
index 7b022d9db10..9c533dffaba 100755
--- a/dockers/docker-sonic-telemetry/telemetry.sh
+++ b/dockers/docker-sonic-telemetry/telemetry.sh
@@ -51,8 +51,8 @@ export CVL_SCHEMA_PATH=/usr/sbin/schema
 export GOTRACEBACK=crash
 
 if [ -n "$CERTS" ]; then
-    SERVER_CRT=$(extract_field "$CERTS" '.server_crt')
-    SERVER_KEY=$(extract_field "$CERTS" '.server_key')
+    SERVER_CRT=$(extract_field "$CERTS" '.server_crt // empty')
+    SERVER_KEY=$(extract_field "$CERTS" '.server_key // empty')
     if [ -z "$SERVER_CRT" ] || [ -z "$SERVER_KEY" ]; then
         TELEMETRY_ARGS+=" --insecure"
         USE_EPHEMERAL_TLS=true
@@ -60,13 +60,13 @@ if [ -n "$CERTS" ]; then
         TELEMETRY_ARGS+=" --server_crt $SERVER_CRT --server_key $SERVER_KEY "
     fi
 
-    CA_CRT=$(extract_field "$CERTS" '.ca_crt')
+    CA_CRT=$(extract_field "$CERTS" '.ca_crt // empty')
     if [ -n "$CA_CRT" ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
     fi
 elif [ -n "$X509" ]; then
-    SERVER_CRT=$(extract_field "$X509" '.server_crt')
-    SERVER_KEY=$(extract_field "$X509" '.server_key')
+    SERVER_CRT=$(extract_field "$X509" '.server_crt // empty')
+    SERVER_KEY=$(extract_field "$X509" '.server_key // empty')
     if [ -z "$SERVER_CRT" ] || [ -z "$SERVER_KEY" ]; then
         TELEMETRY_ARGS+=" --insecure"
         USE_EPHEMERAL_TLS=true
@@ -74,7 +74,7 @@ elif [ -n "$X509" ]; then
         TELEMETRY_ARGS+=" --server_crt $SERVER_CRT --server_key $SERVER_KEY "
     fi
 
-    CA_CRT=$(extract_field "$X509" '.ca_crt')
+    CA_CRT=$(extract_field "$X509" '.ca_crt // empty')
     if [ -n "$CA_CRT" ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
     fi

From 83c56a5cb1306b67f6873667f0a555144b013a7d Mon Sep 17 00:00:00 2001
From: Dawei Huang <daweihuang@microsoft.com>
Date: Sat, 8 Aug 2026 02:52:43 -0500
Subject: [PATCH 11/24] gnmi: preserve jq filter arguments

Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
---
 dockers/docker-sonic-gnmi/gnmi-native.sh    | 2 +-
 dockers/docker-sonic-telemetry/telemetry.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/dockers/docker-sonic-gnmi/gnmi-native.sh b/dockers/docker-sonic-gnmi/gnmi-native.sh
index fa59c815790..85a6cd4ccec 100755
--- a/dockers/docker-sonic-gnmi/gnmi-native.sh
+++ b/dockers/docker-sonic-gnmi/gnmi-native.sh
@@ -6,7 +6,7 @@ TELEMETRY_VARS_FILE=/usr/share/sonic/templates/telemetry_vars.j2
 ESCAPE_QUOTE="'\''"
 
 extract_field() {
-    echo $(echo $1 | jq -r $2)
+    echo "$(echo "$1" | jq -r "$2")"
 }
 
 if [ ! -f "$TELEMETRY_VARS_FILE" ]; then
diff --git a/dockers/docker-sonic-telemetry/telemetry.sh b/dockers/docker-sonic-telemetry/telemetry.sh
index 9c533dffaba..5bdd62aaae2 100755
--- a/dockers/docker-sonic-telemetry/telemetry.sh
+++ b/dockers/docker-sonic-telemetry/telemetry.sh
@@ -27,7 +27,7 @@ TELEMETRY_VARS_FILE=/usr/share/sonic/templates/telemetry_vars.j2
 ESCAPE_QUOTE="'\''"
 
 extract_field() {
-    echo $(echo $1 | jq -r $2)
+    echo "$(echo "$1" | jq -r "$2")"
 }
 
 if [ ! -f "$TELEMETRY_VARS_FILE" ]; then

From 3fbc4c9d257e074962aa5f0d9886ca7114a0ab3a Mon Sep 17 00:00:00 2001
From: Dawei Huang <daweihuang@microsoft.com>
Date: Sat, 8 Aug 2026 02:57:16 -0500
Subject: [PATCH 12/24] gnmi: initialize ephemeral TLS selection

Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
---
 dockers/docker-sonic-gnmi/gnmi-native.sh    | 6 +++++-
 dockers/docker-sonic-telemetry/telemetry.sh | 6 +++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/dockers/docker-sonic-gnmi/gnmi-native.sh b/dockers/docker-sonic-gnmi/gnmi-native.sh
index 85a6cd4ccec..4e86c1b4c68 100755
--- a/dockers/docker-sonic-gnmi/gnmi-native.sh
+++ b/dockers/docker-sonic-gnmi/gnmi-native.sh
@@ -6,7 +6,10 @@ TELEMETRY_VARS_FILE=/usr/share/sonic/templates/telemetry_vars.j2
 ESCAPE_QUOTE="'\''"
 
 extract_field() {
-    echo "$(echo "$1" | jq -r "$2")"
+    if [ -z "$1" ]; then
+        return
+    fi
+    jq -r "$2" <<< "$1"
 }
 
 if [ ! -f "$TELEMETRY_VARS_FILE" ]; then
@@ -27,6 +30,7 @@ export GRPC_GO_LOG_VERBOSITY_LEVEL=99
 export GRPC_GO_LOG_SEVERITY_LEVEL=info
 
 TELEMETRY_ARGS=" -logtostderr"
+USE_EPHEMERAL_TLS=false
 export CVL_SCHEMA_PATH=/usr/sbin/schema
 
 if [ -n "$CERTS" ]; then
diff --git a/dockers/docker-sonic-telemetry/telemetry.sh b/dockers/docker-sonic-telemetry/telemetry.sh
index 5bdd62aaae2..6fe8f7c1630 100755
--- a/dockers/docker-sonic-telemetry/telemetry.sh
+++ b/dockers/docker-sonic-telemetry/telemetry.sh
@@ -27,7 +27,10 @@ TELEMETRY_VARS_FILE=/usr/share/sonic/templates/telemetry_vars.j2
 ESCAPE_QUOTE="'\''"
 
 extract_field() {
-    echo "$(echo "$1" | jq -r "$2")"
+    if [ -z "$1" ]; then
+        return
+    fi
+    jq -r "$2" <<< "$1"
 }
 
 if [ ! -f "$TELEMETRY_VARS_FILE" ]; then
@@ -47,6 +50,7 @@ export GRPC_GO_LOG_VERBOSITY_LEVEL=99
 export GRPC_GO_LOG_SEVERITY_LEVEL=info
 
 TELEMETRY_ARGS=" -logtostderr"
+USE_EPHEMERAL_TLS=false
 export CVL_SCHEMA_PATH=/usr/sbin/schema
 export GOTRACEBACK=crash
 

From 9b0818a0fc53a0ea50f978e65630e5574655b318 Mon Sep 17 00:00:00 2001
From: Dawei Huang <daweihuang@microsoft.com>
Date: Sat, 8 Aug 2026 03:33:36 -0500
Subject: [PATCH 13/24] gnmi: isolate ephemeral TLS authentication

Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
---
 dockers/docker-sonic-gnmi/gnmi-native.sh    | 18 +++++++++---------
 dockers/docker-sonic-telemetry/telemetry.sh | 16 ++++++++--------
 src/sonic-utilities                         |  2 +-
 3 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/dockers/docker-sonic-gnmi/gnmi-native.sh b/dockers/docker-sonic-gnmi/gnmi-native.sh
index 4e86c1b4c68..e0fe5c35d89 100755
--- a/dockers/docker-sonic-gnmi/gnmi-native.sh
+++ b/dockers/docker-sonic-gnmi/gnmi-native.sh
@@ -21,9 +21,9 @@ fi
 # Use default value if no valid config exists
 TELEMETRY_VARS=$(sonic-cfggen -d -t $TELEMETRY_VARS_FILE)
 TELEMETRY_VARS=${TELEMETRY_VARS//[\']/\"}
-X509=$(echo $TELEMETRY_VARS | jq -r '.x509')
-GNMI=$(echo $TELEMETRY_VARS | jq -r '.gnmi')
-CERTS=$(echo $TELEMETRY_VARS | jq -r '.certs')
+X509=$(jq -r '.x509 // empty' <<< "$TELEMETRY_VARS")
+GNMI=$(jq -r '.gnmi // empty' <<< "$TELEMETRY_VARS")
+CERTS=$(jq -r '.certs // empty' <<< "$TELEMETRY_VARS")
 
 # Enable GRPC GO LOG
 export GRPC_GO_LOG_VERBOSITY_LEVEL=99
@@ -44,7 +44,7 @@ if [ -n "$CERTS" ]; then
     fi
 
     CA_CRT=$(extract_field "$CERTS" '.ca_crt // empty')
-    if [ -n "$CA_CRT" ]; then
+    if [ "$USE_EPHEMERAL_TLS" == "false" ] && [ -n "$CA_CRT" ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
     fi
 
@@ -59,7 +59,7 @@ elif [ -n "$X509" ]; then
     fi
 
     CA_CRT=$(extract_field "$X509" '.ca_crt // empty')
-    if [ -n "$CA_CRT" ]; then
+    if [ "$USE_EPHEMERAL_TLS" == "false" ] && [ -n "$CA_CRT" ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
     fi
 else
@@ -135,15 +135,15 @@ else
     fi
 fi
 
-USER_AUTH=$(extract_field "$GNMI" '.user_auth')
+USER_AUTH=$(extract_field "$GNMI" '.user_auth // empty')
 # If user_auth is not set, default to certs
-if [ $USER_AUTH == "null" ]; then
+if [ -z "$USER_AUTH" ]; then
     USER_AUTH="cert"
 fi
-if [ ! -z "$USER_AUTH" ] && [  $USER_AUTH != "null" ] && [  $USER_AUTH != "none" ]; then
+if [ "$USE_EPHEMERAL_TLS" == "false" ] && [ "$USER_AUTH" != "none" ]; then
     TELEMETRY_ARGS+=" --client_auth $USER_AUTH"
 
-    if [ $USER_AUTH == "cert" ]; then
+    if [ "$USER_AUTH" == "cert" ]; then
         TELEMETRY_ARGS+=" --config_table_name GNMI_CLIENT_CERT"
 
         ENABLE_CRL=$(echo $GNMI | jq -r '.enable_crl')
diff --git a/dockers/docker-sonic-telemetry/telemetry.sh b/dockers/docker-sonic-telemetry/telemetry.sh
index 6fe8f7c1630..079e5332b7f 100755
--- a/dockers/docker-sonic-telemetry/telemetry.sh
+++ b/dockers/docker-sonic-telemetry/telemetry.sh
@@ -42,9 +42,9 @@ fi
 # Use default value if no valid config exists
 TELEMETRY_VARS=$(sonic-cfggen -d -t $TELEMETRY_VARS_FILE)
 TELEMETRY_VARS=${TELEMETRY_VARS//[\']/\"}
-X509=$(echo $TELEMETRY_VARS | jq -r '.x509')
-GNMI=$(echo $TELEMETRY_VARS | jq -r '.gnmi')
-CERTS=$(echo $TELEMETRY_VARS | jq -r '.certs')
+X509=$(jq -r '.x509 // empty' <<< "$TELEMETRY_VARS")
+GNMI=$(jq -r '.gnmi // empty' <<< "$TELEMETRY_VARS")
+CERTS=$(jq -r '.certs // empty' <<< "$TELEMETRY_VARS")
 
 export GRPC_GO_LOG_VERBOSITY_LEVEL=99
 export GRPC_GO_LOG_SEVERITY_LEVEL=info
@@ -65,7 +65,7 @@ if [ -n "$CERTS" ]; then
     fi
 
     CA_CRT=$(extract_field "$CERTS" '.ca_crt // empty')
-    if [ -n "$CA_CRT" ]; then
+    if [ "$USE_EPHEMERAL_TLS" == "false" ] && [ -n "$CA_CRT" ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
     fi
 elif [ -n "$X509" ]; then
@@ -79,7 +79,7 @@ elif [ -n "$X509" ]; then
     fi
 
     CA_CRT=$(extract_field "$X509" '.ca_crt // empty')
-    if [ -n "$CA_CRT" ]; then
+    if [ "$USE_EPHEMERAL_TLS" == "false" ] && [ -n "$CA_CRT" ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
     fi
 else
@@ -146,11 +146,11 @@ else
 fi
 TELEMETRY_ARGS+=" -gnmi_native_write=false"
 
-USER_AUTH=$(extract_field "$GNMI" '.user_auth')
-if [ ! -z "$USER_AUTH" ] && [  $USER_AUTH != "null" ]; then
+USER_AUTH=$(extract_field "$GNMI" '.user_auth // empty')
+if [ "$USE_EPHEMERAL_TLS" == "false" ] && [ -n "$USER_AUTH" ]; then
     TELEMETRY_ARGS+=" --client_auth $USER_AUTH"
 
-    if [ $USER_AUTH == "cert" ]; then
+    if [ "$USER_AUTH" == "cert" ]; then
         # Reuse GNMI_CLIENT_CERT for telemetry service
         TELEMETRY_ARGS+=" --config_table_name GNMI_CLIENT_CERT"
 
diff --git a/src/sonic-utilities b/src/sonic-utilities
index e1fd871251f..9436884762c 160000
--- a/src/sonic-utilities
+++ b/src/sonic-utilities
@@ -1 +1 @@
-Subproject commit e1fd871251f32dc445de5baedeb69e51016b79db
+Subproject commit 9436884762c8a3f4ffe0986935ba056470ace731

From 15378fc5558789ca58da6667e0987dd5f0c67edc Mon Sep 17 00:00:00 2001
From: Dawei Huang <daweihuang@microsoft.com>
Date: Sat, 8 Aug 2026 03:52:10 -0500
Subject: [PATCH 14/24] gnmi: preserve application auth with ephemeral TLS

Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
---
 dockers/docker-sonic-gnmi/gnmi-native.sh    | 7 +++++--
 dockers/docker-sonic-telemetry/telemetry.sh | 7 +++++--
 src/sonic-utilities                         | 2 +-
 3 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/dockers/docker-sonic-gnmi/gnmi-native.sh b/dockers/docker-sonic-gnmi/gnmi-native.sh
index e0fe5c35d89..b38da29ad21 100755
--- a/dockers/docker-sonic-gnmi/gnmi-native.sh
+++ b/dockers/docker-sonic-gnmi/gnmi-native.sh
@@ -140,10 +140,13 @@ USER_AUTH=$(extract_field "$GNMI" '.user_auth // empty')
 if [ -z "$USER_AUTH" ]; then
     USER_AUTH="cert"
 fi
-if [ "$USE_EPHEMERAL_TLS" == "false" ] && [ "$USER_AUTH" != "none" ]; then
+if [ "$USE_EPHEMERAL_TLS" == "true" ]; then
+    USER_AUTH=$(tr ',' '\n' <<< "$USER_AUTH" | sed '/^[[:space:]]*cert[[:space:]]*$/d' | paste -sd, -)
+fi
+if [ -n "$USER_AUTH" ] && [ "$USER_AUTH" != "none" ]; then
     TELEMETRY_ARGS+=" --client_auth $USER_AUTH"
 
-    if [ "$USER_AUTH" == "cert" ]; then
+    if [[ ",$USER_AUTH," == *,cert,* ]]; then
         TELEMETRY_ARGS+=" --config_table_name GNMI_CLIENT_CERT"
 
         ENABLE_CRL=$(echo $GNMI | jq -r '.enable_crl')
diff --git a/dockers/docker-sonic-telemetry/telemetry.sh b/dockers/docker-sonic-telemetry/telemetry.sh
index 079e5332b7f..d818a16e869 100755
--- a/dockers/docker-sonic-telemetry/telemetry.sh
+++ b/dockers/docker-sonic-telemetry/telemetry.sh
@@ -147,10 +147,13 @@ fi
 TELEMETRY_ARGS+=" -gnmi_native_write=false"
 
 USER_AUTH=$(extract_field "$GNMI" '.user_auth // empty')
-if [ "$USE_EPHEMERAL_TLS" == "false" ] && [ -n "$USER_AUTH" ]; then
+if [ "$USE_EPHEMERAL_TLS" == "true" ]; then
+    USER_AUTH=$(tr ',' '\n' <<< "$USER_AUTH" | sed '/^[[:space:]]*cert[[:space:]]*$/d' | paste -sd, -)
+fi
+if [ -n "$USER_AUTH" ]; then
     TELEMETRY_ARGS+=" --client_auth $USER_AUTH"
 
-    if [ "$USER_AUTH" == "cert" ]; then
+    if [[ ",$USER_AUTH," == *,cert,* ]]; then
         # Reuse GNMI_CLIENT_CERT for telemetry service
         TELEMETRY_ARGS+=" --config_table_name GNMI_CLIENT_CERT"
 
diff --git a/src/sonic-utilities b/src/sonic-utilities
index 9436884762c..e7500b78102 160000
--- a/src/sonic-utilities
+++ b/src/sonic-utilities
@@ -1 +1 @@
-Subproject commit 9436884762c8a3f4ffe0986935ba056470ace731
+Subproject commit e7500b781025d4d1140976d961566ee0e5c44c34

From 4702de54466660e1d450aca958fd82d78c628034 Mon Sep 17 00:00:00 2001
From: Dawei Huang <daweihuang@microsoft.com>
Date: Sat, 8 Aug 2026 04:00:44 -0500
Subject: [PATCH 15/24] gnmi: preserve explicit auth in ephemeral TLS

Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
---
 src/sonic-utilities | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/sonic-utilities b/src/sonic-utilities
index e7500b78102..02418fb13e4 160000
--- a/src/sonic-utilities
+++ b/src/sonic-utilities
@@ -1 +1 @@
-Subproject commit e7500b781025d4d1140976d961566ee0e5c44c34
+Subproject commit 02418fb13e4c5f9e7b6045e4e62231948cc088c7

From bda5e7c1559454df7617ee8e30fd48407c198664 Mon Sep 17 00:00:00 2001
From: Dawei Huang <daweihuang@microsoft.com>
Date: Sat, 8 Aug 2026 04:21:28 -0500
Subject: [PATCH 16/24] gnmi: make ephemeral auth policy explicit

Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
---
 dockers/docker-sonic-gnmi/gnmi-native.sh    | 5 ++++-
 dockers/docker-sonic-telemetry/telemetry.sh | 3 +++
 src/sonic-utilities                         | 2 +-
 3 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/dockers/docker-sonic-gnmi/gnmi-native.sh b/dockers/docker-sonic-gnmi/gnmi-native.sh
index b38da29ad21..826633a5232 100755
--- a/dockers/docker-sonic-gnmi/gnmi-native.sh
+++ b/dockers/docker-sonic-gnmi/gnmi-native.sh
@@ -142,8 +142,11 @@ if [ -z "$USER_AUTH" ]; then
 fi
 if [ "$USE_EPHEMERAL_TLS" == "true" ]; then
     USER_AUTH=$(tr ',' '\n' <<< "$USER_AUTH" | sed '/^[[:space:]]*cert[[:space:]]*$/d' | paste -sd, -)
+    if [ -z "$USER_AUTH" ]; then
+        USER_AUTH="none"
+    fi
 fi
-if [ -n "$USER_AUTH" ] && [ "$USER_AUTH" != "none" ]; then
+if [ -n "$USER_AUTH" ]; then
     TELEMETRY_ARGS+=" --client_auth $USER_AUTH"
 
     if [[ ",$USER_AUTH," == *,cert,* ]]; then
diff --git a/dockers/docker-sonic-telemetry/telemetry.sh b/dockers/docker-sonic-telemetry/telemetry.sh
index d818a16e869..6b10eba232d 100755
--- a/dockers/docker-sonic-telemetry/telemetry.sh
+++ b/dockers/docker-sonic-telemetry/telemetry.sh
@@ -149,6 +149,9 @@ TELEMETRY_ARGS+=" -gnmi_native_write=false"
 USER_AUTH=$(extract_field "$GNMI" '.user_auth // empty')
 if [ "$USE_EPHEMERAL_TLS" == "true" ]; then
     USER_AUTH=$(tr ',' '\n' <<< "$USER_AUTH" | sed '/^[[:space:]]*cert[[:space:]]*$/d' | paste -sd, -)
+    if [ -z "$USER_AUTH" ]; then
+        USER_AUTH="none"
+    fi
 fi
 if [ -n "$USER_AUTH" ]; then
     TELEMETRY_ARGS+=" --client_auth $USER_AUTH"
diff --git a/src/sonic-utilities b/src/sonic-utilities
index 02418fb13e4..15b2197b306 160000
--- a/src/sonic-utilities
+++ b/src/sonic-utilities
@@ -1 +1 @@
-Subproject commit 02418fb13e4c5f9e7b6045e4e62231948cc088c7
+Subproject commit 15b2197b3064d65af8e695594d9f5b908f871061

From 07c9928f133304ed824a582486f0a43ccf240b17 Mon Sep 17 00:00:00 2001
From: Dawei Huang <daweihuang@microsoft.com>
Date: Sat, 8 Aug 2026 04:44:54 -0500
Subject: [PATCH 17/24] gnmi: preserve CA-backed client auth

Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
---
 dockers/docker-sonic-gnmi/gnmi-native.sh    | 14 ++++++++++----
 dockers/docker-sonic-telemetry/telemetry.sh | 14 ++++++++++----
 src/sonic-utilities                         |  2 +-
 3 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/dockers/docker-sonic-gnmi/gnmi-native.sh b/dockers/docker-sonic-gnmi/gnmi-native.sh
index 826633a5232..c968d97dece 100755
--- a/dockers/docker-sonic-gnmi/gnmi-native.sh
+++ b/dockers/docker-sonic-gnmi/gnmi-native.sh
@@ -31,6 +31,7 @@ export GRPC_GO_LOG_SEVERITY_LEVEL=info
 
 TELEMETRY_ARGS=" -logtostderr"
 USE_EPHEMERAL_TLS=false
+CERTIFICATE_FREE_TLS=false
 export CVL_SCHEMA_PATH=/usr/sbin/schema
 
 if [ -n "$CERTS" ]; then
@@ -44,8 +45,10 @@ if [ -n "$CERTS" ]; then
     fi
 
     CA_CRT=$(extract_field "$CERTS" '.ca_crt // empty')
-    if [ "$USE_EPHEMERAL_TLS" == "false" ] && [ -n "$CA_CRT" ]; then
+    if [ -n "$CA_CRT" ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
+    elif [ "$USE_EPHEMERAL_TLS" == "true" ]; then
+        CERTIFICATE_FREE_TLS=true
     fi
 
 elif [ -n "$X509" ]; then
@@ -59,12 +62,15 @@ elif [ -n "$X509" ]; then
     fi
 
     CA_CRT=$(extract_field "$X509" '.ca_crt // empty')
-    if [ "$USE_EPHEMERAL_TLS" == "false" ] && [ -n "$CA_CRT" ]; then
+    if [ -n "$CA_CRT" ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
+    elif [ "$USE_EPHEMERAL_TLS" == "true" ]; then
+        CERTIFICATE_FREE_TLS=true
     fi
 else
     TELEMETRY_ARGS+=" --insecure"
     USE_EPHEMERAL_TLS=true
+    CERTIFICATE_FREE_TLS=true
 fi
 
 # If no configuration entry exists for TELEMETRY, create one default port
@@ -81,7 +87,7 @@ fi
 TELEMETRY_ARGS+=" --port $PORT"
 
 CLIENT_AUTH=$(extract_field "$GNMI" '.client_auth')
-if [[ x"${USE_EPHEMERAL_TLS}" == x"true" ]] || [ -z "$CLIENT_AUTH" ] || [ "$CLIENT_AUTH" == "false" ]; then
+if [[ x"${CERTIFICATE_FREE_TLS}" == x"true" ]] || [ -z "$CLIENT_AUTH" ] || [ "$CLIENT_AUTH" == "false" ]; then
     TELEMETRY_ARGS+=" --allow_no_client_auth"
 fi
 
@@ -140,7 +146,7 @@ USER_AUTH=$(extract_field "$GNMI" '.user_auth // empty')
 if [ -z "$USER_AUTH" ]; then
     USER_AUTH="cert"
 fi
-if [ "$USE_EPHEMERAL_TLS" == "true" ]; then
+if [ "$CERTIFICATE_FREE_TLS" == "true" ]; then
     USER_AUTH=$(tr ',' '\n' <<< "$USER_AUTH" | sed '/^[[:space:]]*cert[[:space:]]*$/d' | paste -sd, -)
     if [ -z "$USER_AUTH" ]; then
         USER_AUTH="none"
diff --git a/dockers/docker-sonic-telemetry/telemetry.sh b/dockers/docker-sonic-telemetry/telemetry.sh
index 6b10eba232d..0d1c2d236f5 100755
--- a/dockers/docker-sonic-telemetry/telemetry.sh
+++ b/dockers/docker-sonic-telemetry/telemetry.sh
@@ -51,6 +51,7 @@ export GRPC_GO_LOG_SEVERITY_LEVEL=info
 
 TELEMETRY_ARGS=" -logtostderr"
 USE_EPHEMERAL_TLS=false
+CERTIFICATE_FREE_TLS=false
 export CVL_SCHEMA_PATH=/usr/sbin/schema
 export GOTRACEBACK=crash
 
@@ -65,8 +66,10 @@ if [ -n "$CERTS" ]; then
     fi
 
     CA_CRT=$(extract_field "$CERTS" '.ca_crt // empty')
-    if [ "$USE_EPHEMERAL_TLS" == "false" ] && [ -n "$CA_CRT" ]; then
+    if [ -n "$CA_CRT" ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
+    elif [ "$USE_EPHEMERAL_TLS" == "true" ]; then
+        CERTIFICATE_FREE_TLS=true
     fi
 elif [ -n "$X509" ]; then
     SERVER_CRT=$(extract_field "$X509" '.server_crt // empty')
@@ -79,12 +82,15 @@ elif [ -n "$X509" ]; then
     fi
 
     CA_CRT=$(extract_field "$X509" '.ca_crt // empty')
-    if [ "$USE_EPHEMERAL_TLS" == "false" ] && [ -n "$CA_CRT" ]; then
+    if [ -n "$CA_CRT" ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
+    elif [ "$USE_EPHEMERAL_TLS" == "true" ]; then
+        CERTIFICATE_FREE_TLS=true
     fi
 else
     TELEMETRY_ARGS+=" --insecure"
     USE_EPHEMERAL_TLS=true
+    CERTIFICATE_FREE_TLS=true
 fi
 
 # If no configuration entry exists for TELEMETRY, create one default port
@@ -100,7 +106,7 @@ fi
 TELEMETRY_ARGS+=" --port $PORT"
 
 CLIENT_AUTH=$(extract_field "$GNMI" '.client_auth')
-if [[ x"${USE_EPHEMERAL_TLS}" == x"true" ]] || [ -z "$CLIENT_AUTH" ] || [ "$CLIENT_AUTH" == "false" ]; then
+if [[ x"${CERTIFICATE_FREE_TLS}" == x"true" ]] || [ -z "$CLIENT_AUTH" ] || [ "$CLIENT_AUTH" == "false" ]; then
     TELEMETRY_ARGS+=" --allow_no_client_auth"
 fi
 
@@ -147,7 +153,7 @@ fi
 TELEMETRY_ARGS+=" -gnmi_native_write=false"
 
 USER_AUTH=$(extract_field "$GNMI" '.user_auth // empty')
-if [ "$USE_EPHEMERAL_TLS" == "true" ]; then
+if [ "$CERTIFICATE_FREE_TLS" == "true" ]; then
     USER_AUTH=$(tr ',' '\n' <<< "$USER_AUTH" | sed '/^[[:space:]]*cert[[:space:]]*$/d' | paste -sd, -)
     if [ -z "$USER_AUTH" ]; then
         USER_AUTH="none"
diff --git a/src/sonic-utilities b/src/sonic-utilities
index 15b2197b306..217f882eeb6 160000
--- a/src/sonic-utilities
+++ b/src/sonic-utilities
@@ -1 +1 @@
-Subproject commit 15b2197b3064d65af8e695594d9f5b908f871061
+Subproject commit 217f882eeb6d7786b7d6e04650c7499c4b401df1

From 59c803ade3790edcb31f478ad15c5205b527addf Mon Sep 17 00:00:00 2001
From: Dawei Huang <daweihuang@microsoft.com>
Date: Sat, 8 Aug 2026 05:07:54 -0500
Subject: [PATCH 18/24] [submodule] Update DPU TLS security fixes

Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
---
 src/sonic-gnmi      | 2 +-
 src/sonic-utilities | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/sonic-gnmi b/src/sonic-gnmi
index f3b7022e209..835b6b43c69 160000
--- a/src/sonic-gnmi
+++ b/src/sonic-gnmi
@@ -1 +1 @@
-Subproject commit f3b7022e20930b9cb4568a506dda8133da59cb23
+Subproject commit 835b6b43c691c0984f0004a03e6397bb31b17769
diff --git a/src/sonic-utilities b/src/sonic-utilities
index 217f882eeb6..7186dc9f999 160000
--- a/src/sonic-utilities
+++ b/src/sonic-utilities
@@ -1 +1 @@
-Subproject commit 217f882eeb6d7786b7d6e04650c7499c4b401df1
+Subproject commit 7186dc9f999c95a8c7541f52c1e6b4f4fc09ae77

From 5d34e7cd749339586c7ccf47ea30688aaa2f289e Mon Sep 17 00:00:00 2001
From: Dawei Huang <daweihuang@microsoft.com>
Date: Sat, 8 Aug 2026 05:26:51 -0500
Subject: [PATCH 19/24] [submodule] Update DPU reboot recovery

Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
---
 src/sonic-utilities | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/sonic-utilities b/src/sonic-utilities
index 7186dc9f999..368c90e2ad3 160000
--- a/src/sonic-utilities
+++ b/src/sonic-utilities
@@ -1 +1 @@
-Subproject commit 7186dc9f999c95a8c7541f52c1e6b4f4fc09ae77
+Subproject commit 368c90e2ad318e60c642cd0eb9b5511062d13162

From 4c9ed3890af4d907f1e7f1296f38a5bf18105068 Mon Sep 17 00:00:00 2001
From: Dawei Huang <daweihuang@microsoft.com>
Date: Sat, 8 Aug 2026 05:39:07 -0500
Subject: [PATCH 20/24] [submodule] Update DPU detach recovery

Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
---
 src/sonic-utilities | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/sonic-utilities b/src/sonic-utilities
index 368c90e2ad3..56d9bc760e2 160000
--- a/src/sonic-utilities
+++ b/src/sonic-utilities
@@ -1 +1 @@
-Subproject commit 368c90e2ad318e60c642cd0eb9b5511062d13162
+Subproject commit 56d9bc760e294021a769303619d9005aebfec6a9

From 886b49bd22c1e605ecafca81f30a56a249c00069 Mon Sep 17 00:00:00 2001
From: Dawei Huang <daweihuang@microsoft.com>
Date: Sat, 8 Aug 2026 05:47:29 -0500
Subject: [PATCH 21/24] gnmi: normalize optional CRL setting

Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
---
 dockers/docker-sonic-gnmi/gnmi-native.sh    | 4 ++--
 dockers/docker-sonic-telemetry/telemetry.sh | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/dockers/docker-sonic-gnmi/gnmi-native.sh b/dockers/docker-sonic-gnmi/gnmi-native.sh
index c968d97dece..7b6d8bf6d7d 100755
--- a/dockers/docker-sonic-gnmi/gnmi-native.sh
+++ b/dockers/docker-sonic-gnmi/gnmi-native.sh
@@ -158,8 +158,8 @@ if [ -n "$USER_AUTH" ]; then
     if [[ ",$USER_AUTH," == *,cert,* ]]; then
         TELEMETRY_ARGS+=" --config_table_name GNMI_CLIENT_CERT"
 
-        ENABLE_CRL=$(echo $GNMI | jq -r '.enable_crl')
-        if [ $ENABLE_CRL == "true" ]; then
+        ENABLE_CRL=$(extract_field "$GNMI" '.enable_crl // false')
+        if [ "$ENABLE_CRL" == "true" ]; then
             TELEMETRY_ARGS+=" --enable_crl"
         fi
 
diff --git a/dockers/docker-sonic-telemetry/telemetry.sh b/dockers/docker-sonic-telemetry/telemetry.sh
index 0d1c2d236f5..e7e0f3939df 100755
--- a/dockers/docker-sonic-telemetry/telemetry.sh
+++ b/dockers/docker-sonic-telemetry/telemetry.sh
@@ -166,8 +166,8 @@ if [ -n "$USER_AUTH" ]; then
         # Reuse GNMI_CLIENT_CERT for telemetry service
         TELEMETRY_ARGS+=" --config_table_name GNMI_CLIENT_CERT"
 
-        ENABLE_CRL=$(echo $GNMI | jq -r '.enable_crl')
-        if [ $ENABLE_CRL == "true" ]; then
+        ENABLE_CRL=$(extract_field "$GNMI" '.enable_crl // false')
+        if [ "$ENABLE_CRL" == "true" ]; then
             TELEMETRY_ARGS+=" --enable_crl"
         fi
 

From 67c7b89299221ce879923e89a67c4620e893ef59 Mon Sep 17 00:00:00 2001
From: Dawei Huang <daweihuang@microsoft.com>
Date: Sat, 8 Aug 2026 05:53:34 -0500
Subject: [PATCH 22/24] gnmi: normalize configured auth modes

Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
---
 dockers/docker-sonic-gnmi/gnmi-native.sh    | 1 +
 dockers/docker-sonic-telemetry/telemetry.sh | 1 +
 2 files changed, 2 insertions(+)

diff --git a/dockers/docker-sonic-gnmi/gnmi-native.sh b/dockers/docker-sonic-gnmi/gnmi-native.sh
index 7b6d8bf6d7d..6995d32c0a3 100755
--- a/dockers/docker-sonic-gnmi/gnmi-native.sh
+++ b/dockers/docker-sonic-gnmi/gnmi-native.sh
@@ -146,6 +146,7 @@ USER_AUTH=$(extract_field "$GNMI" '.user_auth // empty')
 if [ -z "$USER_AUTH" ]; then
     USER_AUTH="cert"
 fi
+USER_AUTH=$(tr -d '[:space:]' <<< "$USER_AUTH")
 if [ "$CERTIFICATE_FREE_TLS" == "true" ]; then
     USER_AUTH=$(tr ',' '\n' <<< "$USER_AUTH" | sed '/^[[:space:]]*cert[[:space:]]*$/d' | paste -sd, -)
     if [ -z "$USER_AUTH" ]; then
diff --git a/dockers/docker-sonic-telemetry/telemetry.sh b/dockers/docker-sonic-telemetry/telemetry.sh
index e7e0f3939df..7bad157ea1b 100755
--- a/dockers/docker-sonic-telemetry/telemetry.sh
+++ b/dockers/docker-sonic-telemetry/telemetry.sh
@@ -153,6 +153,7 @@ fi
 TELEMETRY_ARGS+=" -gnmi_native_write=false"
 
 USER_AUTH=$(extract_field "$GNMI" '.user_auth // empty')
+USER_AUTH=$(tr -d '[:space:]' <<< "$USER_AUTH")
 if [ "$CERTIFICATE_FREE_TLS" == "true" ]; then
     USER_AUTH=$(tr ',' '\n' <<< "$USER_AUTH" | sed '/^[[:space:]]*cert[[:space:]]*$/d' | paste -sd, -)
     if [ -z "$USER_AUTH" ]; then

From 1060b689920da5451d604e25abb0eb379c0ee1f9 Mon Sep 17 00:00:00 2001
From: Dawei Huang <daweihuang@microsoft.com>
Date: Sat, 8 Aug 2026 05:58:41 -0500
Subject: [PATCH 23/24] gnmi: preserve CA-backed client auth default

Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
---
 dockers/docker-sonic-gnmi/gnmi-native.sh    | 5 ++++-
 dockers/docker-sonic-telemetry/telemetry.sh | 5 ++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/dockers/docker-sonic-gnmi/gnmi-native.sh b/dockers/docker-sonic-gnmi/gnmi-native.sh
index 6995d32c0a3..e09e356cbbf 100755
--- a/dockers/docker-sonic-gnmi/gnmi-native.sh
+++ b/dockers/docker-sonic-gnmi/gnmi-native.sh
@@ -32,6 +32,7 @@ export GRPC_GO_LOG_SEVERITY_LEVEL=info
 TELEMETRY_ARGS=" -logtostderr"
 USE_EPHEMERAL_TLS=false
 CERTIFICATE_FREE_TLS=false
+HAS_CLIENT_CA=false
 export CVL_SCHEMA_PATH=/usr/sbin/schema
 
 if [ -n "$CERTS" ]; then
@@ -47,6 +48,7 @@ if [ -n "$CERTS" ]; then
     CA_CRT=$(extract_field "$CERTS" '.ca_crt // empty')
     if [ -n "$CA_CRT" ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
+        HAS_CLIENT_CA=true
     elif [ "$USE_EPHEMERAL_TLS" == "true" ]; then
         CERTIFICATE_FREE_TLS=true
     fi
@@ -64,6 +66,7 @@ elif [ -n "$X509" ]; then
     CA_CRT=$(extract_field "$X509" '.ca_crt // empty')
     if [ -n "$CA_CRT" ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
+        HAS_CLIENT_CA=true
     elif [ "$USE_EPHEMERAL_TLS" == "true" ]; then
         CERTIFICATE_FREE_TLS=true
     fi
@@ -87,7 +90,7 @@ fi
 TELEMETRY_ARGS+=" --port $PORT"
 
 CLIENT_AUTH=$(extract_field "$GNMI" '.client_auth')
-if [[ x"${CERTIFICATE_FREE_TLS}" == x"true" ]] || [ -z "$CLIENT_AUTH" ] || [ "$CLIENT_AUTH" == "false" ]; then
+if [ "$CERTIFICATE_FREE_TLS" == "true" ] || [ "$CLIENT_AUTH" == "false" ] || { [ -z "$CLIENT_AUTH" ] && [ "$HAS_CLIENT_CA" == "false" ]; }; then
     TELEMETRY_ARGS+=" --allow_no_client_auth"
 fi
 
diff --git a/dockers/docker-sonic-telemetry/telemetry.sh b/dockers/docker-sonic-telemetry/telemetry.sh
index 7bad157ea1b..1327de0b07f 100755
--- a/dockers/docker-sonic-telemetry/telemetry.sh
+++ b/dockers/docker-sonic-telemetry/telemetry.sh
@@ -52,6 +52,7 @@ export GRPC_GO_LOG_SEVERITY_LEVEL=info
 TELEMETRY_ARGS=" -logtostderr"
 USE_EPHEMERAL_TLS=false
 CERTIFICATE_FREE_TLS=false
+HAS_CLIENT_CA=false
 export CVL_SCHEMA_PATH=/usr/sbin/schema
 export GOTRACEBACK=crash
 
@@ -68,6 +69,7 @@ if [ -n "$CERTS" ]; then
     CA_CRT=$(extract_field "$CERTS" '.ca_crt // empty')
     if [ -n "$CA_CRT" ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
+        HAS_CLIENT_CA=true
     elif [ "$USE_EPHEMERAL_TLS" == "true" ]; then
         CERTIFICATE_FREE_TLS=true
     fi
@@ -84,6 +86,7 @@ elif [ -n "$X509" ]; then
     CA_CRT=$(extract_field "$X509" '.ca_crt // empty')
     if [ -n "$CA_CRT" ]; then
         TELEMETRY_ARGS+=" --ca_crt $CA_CRT"
+        HAS_CLIENT_CA=true
     elif [ "$USE_EPHEMERAL_TLS" == "true" ]; then
         CERTIFICATE_FREE_TLS=true
     fi
@@ -106,7 +109,7 @@ fi
 TELEMETRY_ARGS+=" --port $PORT"
 
 CLIENT_AUTH=$(extract_field "$GNMI" '.client_auth')
-if [[ x"${CERTIFICATE_FREE_TLS}" == x"true" ]] || [ -z "$CLIENT_AUTH" ] || [ "$CLIENT_AUTH" == "false" ]; then
+if [ "$CERTIFICATE_FREE_TLS" == "true" ] || [ "$CLIENT_AUTH" == "false" ] || { [ -z "$CLIENT_AUTH" ] && [ "$HAS_CLIENT_CA" == "false" ]; }; then
     TELEMETRY_ARGS+=" --allow_no_client_auth"
 fi
 

From bd2ad72e8e2735ec51a7d4c7cde79a9cc9333a6f Mon Sep 17 00:00:00 2001
From: Dawei Huang <daweihuang@microsoft.com>
Date: Sat, 8 Aug 2026 06:03:01 -0500
Subject: [PATCH 24/24] gnmi: normalize optional client auth

Signed-off-by: Dawei Huang <daweihuang@microsoft.com>
---
 dockers/docker-sonic-gnmi/gnmi-native.sh    | 2 +-
 dockers/docker-sonic-telemetry/telemetry.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/dockers/docker-sonic-gnmi/gnmi-native.sh b/dockers/docker-sonic-gnmi/gnmi-native.sh
index e09e356cbbf..54551f8c666 100755
--- a/dockers/docker-sonic-gnmi/gnmi-native.sh
+++ b/dockers/docker-sonic-gnmi/gnmi-native.sh
@@ -89,7 +89,7 @@ fi
 
 TELEMETRY_ARGS+=" --port $PORT"
 
-CLIENT_AUTH=$(extract_field "$GNMI" '.client_auth')
+CLIENT_AUTH=$(extract_field "$GNMI" 'if .client_auth == null then empty else .client_auth end')
 if [ "$CERTIFICATE_FREE_TLS" == "true" ] || [ "$CLIENT_AUTH" == "false" ] || { [ -z "$CLIENT_AUTH" ] && [ "$HAS_CLIENT_CA" == "false" ]; }; then
     TELEMETRY_ARGS+=" --allow_no_client_auth"
 fi
diff --git a/dockers/docker-sonic-telemetry/telemetry.sh b/dockers/docker-sonic-telemetry/telemetry.sh
index 1327de0b07f..097ddc8bb46 100755
--- a/dockers/docker-sonic-telemetry/telemetry.sh
+++ b/dockers/docker-sonic-telemetry/telemetry.sh
@@ -108,7 +108,7 @@ else
 fi
 TELEMETRY_ARGS+=" --port $PORT"
 
-CLIENT_AUTH=$(extract_field "$GNMI" '.client_auth')
+CLIENT_AUTH=$(extract_field "$GNMI" 'if .client_auth == null then empty else .client_auth end')
 if [ "$CERTIFICATE_FREE_TLS" == "true" ] || [ "$CLIENT_AUTH" == "false" ] || { [ -z "$CLIENT_AUTH" ] && [ "$HAS_CLIENT_CA" == "false" ]; }; then
     TELEMETRY_ARGS+=" --allow_no_client_auth"
 fi