Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

At the request of higher-up, I need to deploy a SSL Certificate(s) signed by our Active Directory CA to over 100 lights-out interfaces. Given all these devices have been given a hostname .ilo.my.domain a Wildcard certificate seems to be the way to go.

I've not been able to find any useful instructions on how to do this - Googling just gets me 100s of results for various SSL Resellers.

Does anyone have any experience with MS Cert Services & Wilcard SSL Certificates that they can point me in the right direction with?

Cheers

share|improve this question

2 Answers 2

up vote 1 down vote accepted

It's possible to use the iLO scripting interfaces to get the certificate request and import the reply. That would be using CPQLOCFG or HPONCFG for the iLO I/O.

If you're a programming sort, there's a perl version of cpqlocfg that could be used to fetch the request, programmatically submit it to the Microsoft CA, fetch the reply, and update iLO.

share|improve this answer
1  
Thanks for the reply Daven - Yep, can do that, but the CSR is generated for system name only. This causes hostname mismatches when you need to use a FQDN :) The issue is with HP now with their iLO team who hopefully will correct the CSR generation to be FQDN in an upcoming firmware release :) –  Ben Short Nov 5 '09 at 10:09
    
@Ben - iLO 3 certificate requests include subject alternative names for the FQDN, and the CN defaults to the FQDN, so that should work for you now. –  davenpcj Jul 30 '11 at 23:42
    
Thanks Daven - in time, HP finally got their firmware set up so I could successfully sign certificates in a subdomain at which point I could write a script to do do a batch update. The script is located on my blog (practicaladmin.wordpress.com). Given this was the solution, I'll mark you as having the answer :) –  Ben Short Aug 8 '11 at 4:11

The real problem you have is that you need to get the HP iLO to issue a wildcard certificate request in the first place. From my quick searching of the HP IT Resource Center this doesn't appear possible.

What I did find however was a great post at The Lazy Admin - Using Certificates with Compaq/HP RILOE and ILO Hardware which step-by-step walks you through the process of requesting a HP iLO cert against a MS Certificate Authority.

With respect to SSL wildcards in general have a read of Publishing Multiple Web Sites Using a Wildcard Certificate in ISA Server 2004 though focussed on ISA it explains what needs to happen with respect to the request.

share|improve this answer
    
iLO does not issue wildcard certificate requests. –  davenpcj Nov 4 '09 at 17:59
    
Well not at the moment it doesn't. Maybe Chage can get HP to introduce that functionality as per his comment. –  Sim Nov 6 '09 at 1:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.