2

PROBLEM:

When I access the ilo via browser, it return to me an error with SSL certificate.

WHAT I TRIED:

I created a CSR (ilo.csr) from iLO web interface --> Security --> SSL Certificate

After I tried to self sign it through OpenSSL in that way:

openssl genrsa -aes256 -out rootCA.key 4096
openssl req -x509 -new -nodes -key rootCA.key -days 1024 -out rootCA.pem
openssl x509 -req -in ilo.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out ilo.crt -days 500

AT THE END:

-I imported ilo.crt in Security --> SSL Certificate --> Costumize Certificate --> Import Certificate

-I installed ilo.crt by clicking on it and insert it in trusted root certificate authorities

I didn't get any results

INSTRUCTIONS FROM SSL Certificate page

The iLO security features can be enhanced by importing a trusted certificate. iLO can create a Certificate Signing Request (CSR) in PKCS #10 format to send to a Certificate Authority (CA). The CSR is base64-encoded. The CA processes the request and returns a response (X.509 Certificate) to import to iLO.

There are four steps to importing a certificate:

Generate a CSR.
Send the CSR to a CA and receive a certificate.
Import the certificate into iLO.
Restart iLO.
Improve this question
5
  • What error are you getting when you tried to go to the iLO (before doing the OpenSSL stuff)? You might just need to download the certificate from the iLO and insert it into the Computer (or User) Cert Trust Store. You only need to go through the OpenSSL thing if you need a certificate because one is not already present.
    – Andrew
    Jul 18, 2018 at 16:24
  • It sounds like you've installed an invalid certificate which is now preventing iLO from operating as expected. You may need to reset to factory settings (maybe a firmware re-flash?) if you can't get in at all, but if you do have access, I would suggest creating a NEW self-signed certificate (not a CSR from iLO) and uploading a .p12/pkcs12/pfx certificate with private key (if possible). If your only option is a CSR, you may want to try again. Once you can gain access properly, you should just have to download the cert and make Windows trust it. There's plenty out there on how to trust certs.
    – Andrew
    Jul 18, 2018 at 16:32
  • Before trying this, I received a .NET error (HTTP error: The remote server returned an error: (400) Bad request) and I could connect via iOS app. now I can not connect anymore (not even with the app), Now .NET remote console return to me "Connection in progress is forcibly interrupted by the remote host". I do not think it is enough to import the csr into the browser. Please Reread the post, I inserted the instructions contained below the SSL Certificate page
    – Squalo
    Jul 18, 2018 at 16:37
  • Can you explain me how i can use other certificate?
    – Squalo
    Jul 18, 2018 at 16:40
  • I do not have access to iLO 5 to know if you can, or how to do so. You'll need to refer to the manual for the iLO software, or find something on how to manage it. Hopefully someone with more knowledge on HP's iLO can pipe up
    – Andrew
    Jul 18, 2018 at 16:42

1 Answer 1

Reset to default
1

If you self-sign, you need to ad the bogus CA to your root CA store. If you check your certificate path you will see this is your problem.

One hack to prove the concept is to inspect the failing cert in your browser, then simply install the cert into your root CA.

If you don't want to use self-signing you would have to make a real cert countersigned by your companies CA. Haven't played with generating a LetsEncrypt cert for iLO. These generally require something at the endpoint, though I know there are some ways to do it with DNSSEC or other DNS kung fu.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .