up vote 1 down vote favorite
3
share [g+] share [fb]

At the request of higher-up, I need to deploy a SSL Certificate(s) signed by our Active Directory CA to over 100 lights-out interfaces. Given all these devices have been given a hostname .ilo.my.domain a Wildcard certificate seems to be the way to go.

I've not been able to find any useful instructions on how to do this - Googling just gets me 100s of results for various SSL Resellers.

Does anyone have any experience with MS Cert Services & Wilcard SSL Certificates that they can point me in the right direction with?

Cheers

link|improve this question
100% accept rate
feedback

2 Answers

up vote 1 down vote accepted

It's possible to use the iLO scripting interfaces to get the certificate request and import the reply. That would be using CPQLOCFG or HPONCFG for the iLO I/O.

If you're a programming sort, there's a perl version of cpqlocfg that could be used to fetch the request, programmatically submit it to the Microsoft CA, fetch the reply, and update iLO.

link|improve this answer
1  
Thanks for the reply Daven - Yep, can do that, but the CSR is generated for system name only. This causes hostname mismatches when you need to use a FQDN :) The issue is with HP now with their iLO team who hopefully will correct the CSR generation to be FQDN in an upcoming firmware release :) – Ben Short Nov 5 '09 at 10:09
@Ben - iLO 3 certificate requests include subject alternative names for the FQDN, and the CN defaults to the FQDN, so that should work for you now. – davenpcj Jul 30 '11 at 23:42
Thanks Daven - in time, HP finally got their firmware set up so I could successfully sign certificates in a subdomain at which point I could write a script to do do a batch update. The script is located on my blog (practicaladmin.wordpress.com). Given this was the solution, I'll mark you as having the answer :) – Ben Short Aug 8 '11 at 4:11
feedback
up vote 1 down vote

The real problem you have is that you need to get the HP iLO to issue a wildcard certificate request in the first place. From my quick searching of the HP IT Resource Center this doesn't appear possible.

What I did find however was a great post at The Lazy Admin - Using Certificates with Compaq/HP RILOE and ILO Hardware which step-by-step walks you through the process of requesting a HP iLO cert against a MS Certificate Authority.

With respect to SSL wildcards in general have a read of Publishing Multiple Web Sites Using a Wildcard Certificate in ISA Server 2004 though focussed on ISA it explains what needs to happen with respect to the request.

link|improve this answer
iLO does not issue wildcard certificate requests. – davenpcj Nov 4 '09 at 17:59
Well not at the moment it doesn't. Maybe Chage can get HP to introduce that functionality as per his comment. – Sim Nov 6 '09 at 1:42
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.