Cisco DNA has many features and one of them is the device upgrade. If you are just getting to know DNA and Assurance this may be the best place to start exploring and familiarizing yourself with the interface.
Cisco DNA: 1.2.3
Start at DNA Center > Image Repository > Import to import the new image. Once imported you should see symbol Verified.
If not then import latest Integrity verification file under Settings > Integrity Verification > Import latest.
Back on the Image Repository mark desired image as Golden.
If you are missing an image you’ve uploaded then expand drop down option next to device model to list available images.
Select Update Devices.
Check Device > Actions > Update OS Image.
On the next screen, the Gold image will be automatically pre-selected and you can choose to initiate update immediately or schedule it for later.
If device is behind firewall make sure and open port tcp/22 and tcp/443 as it will try to use these protocols to run upgrade process. Otherwise you may see this error.
If you are running DNA version prior to 1.2 you will most likely get this error when trying to upgrade Cat3k/2k switches. Cat9k upgrade running IOS-XE 16.x had no issues with SSL.
I/O error: Certificate may not be installed.
Unfortunately, I could not find any resolution to it and the only way around it was to upgrade to DNA version 1.2 which has additional file transfer mechanism (scp) as a fallback. After that upgrade should proceed and complete as planned. Below is sample upgrade log.
As you can see it took about 1 hour to upgrade single 3850 switch over the LAN connection.