topic Re: HP IP Console Switch G2 - Vertiv Certificate Expired even with Latest 2.12.6 Firmware in Servers - General

HP IP Console Switch G2 - Vertiv Certificate Expired even with Latest 2.12.6 Firmware

edwardforgacs — Fri, 10 May 2024 02:21:11 GMT

The latest firwmare, version 2.12.6, released on 9 Apr 2024, appears to contain an expired Vertiv certificate, which triggers Java security warnings every time a connection is made.

Is this correct? HP released an update with a certificate which had already expired at the time of release?

Perhaps I'm the only one who actually looked into the reason for the security warning, others have given up and just ignore them because this device can potentally generate so many security warnings.

CN="Vertiv IT Systems, Inc.",
O="Vertiv IT Systems, Inc.",
L=Columbus,
ST=Ohio,
C=US

[From: Tue Mar 02 11:00:00 AEDT 2021,
To: Wed Mar 06 10:59:59 AEDT 2024]

Note the rest of the cert chain is unexpired, I am aware there was an older version with a cert which expired in 2021.

I believe the issue is the code signing certificate used to sign the Java binary, and this is not configurable in the web GUI, but I am happy to be corrected if there is a way for this to be resolved.

Re: HP IP Console Switch G2 - Vertiv Certificate Expired even with Latest 2.12.6 Firmware

Suman_1978 — Mon, 06 May 2024 05:01:07 GMT

Hi,

If you see the release notes, there are some enhancements and unsupported JAVA and IE versions.

Thank You!
I work with HPE but opinions expressed here are mine.

Re: HP IP Console Switch G2 - Vertiv Certificate Expired even with Latest 2.12.6 Firmware

edwardforgacs — Mon, 06 May 2024 05:28:41 GMT

I fail to understand how "unsupported Java versions" (which I don't believe I'm using) would be related to a certificate which expired in March 2024?

There is mention in the release notes of a certifcate expiring in 2021, not the one I am referring to.

Re: HP IP Console Switch G2 - Vertiv Certificate Expired even with Latest 2.12.6 Firmware

Suman_1978 — Mon, 16 Sep 2024 09:35:21 GMT

Hi,

Is it possible for you to share the error message or screenshot of the error you are getting on the switch?

Thank You!
I work with HPE but opinions expressed here are mine.

Re: HP IP Console Switch G2 - Vertiv Certificate Expired even with Latest 2.12.6 Firmware

edwardforgacs — Tue, 07 May 2024 03:28:11 GMT

See below:

Re: HP IP Console Switch G2 - Vertiv Certificate Expired even with Latest 2.12.6 Firmware

Suman_1978 — Mon, 16 Sep 2024 09:35:15 GMT

Hi,

Are you using any Vertiv software for management of switches, if so, what is the name of that SW and its version, do you think you need to contact them for Certificate issues?

Thank You!
I work with HPE but opinions expressed here are mine.

Re: HP IP Console Switch G2 - Vertiv Certificate Expired even with Latest 2.12.6 Firmware

edwardforgacs — Mon, 16 Sep 2024 09:33:51 GMT

No we are not using any software from Vertiv and never have. The certificate comes from the built-in firmware in the HP IP Console Switch G2. It is an OEM Avocent (Vertiv) product sold by HP.

Re: HP IP Console Switch G2 - Vertiv Certificate Expired even with Latest 2.12.6 Firmware

Suman_1978 — Tue, 07 May 2024 08:27:52 GMT

Hi,

In this scenario, I can only think of JAVA update or getting in touch with HPE Support to log a ticket.

Thank You!
I work with HPE but opinions expressed here are mine.

Re: HP IP Console Switch G2 - Vertiv Certificate Expired even with Latest 2.12.6 Firmware

Suvamay — Mon, 16 Sep 2024 09:24:31 GMT

1 - Generate Request and PrivateKey

openssl req -newkey rsa:2048 -keyout serverprvkey.pem -nodes -sha1 -days 1095 -out server.req

2 - Generate certificate against CA

certreq -attrib "CertificateTemplate:WebServer"

3 - convert BEGIN PRIVATE KEY to BEGIN RSA PRIVATE KEY)

openssl rsa -in server2prvkey.pem -out server2_newkey.pem

4 - copy paste rsa key to cert

5 - upload to kvm

Re: HP IP Console Switch G2 - Vertiv Certificate Expired even with Latest 2.12.6 Firmware

edwardforgacs — Mon, 16 Sep 2024 09:30:54 GMT

Unfortunately there seems to be confusion about the certificate being discussed.

The certificate which is presented by the web console can be replaced by OpenSSL commands and the procedure described above.

The Vertiv certificate is the actual code signing certificate used to sign the Java binary which is built in, and I don't believe can be changed. The app which downloads when a remote connection is initiated (not through the web console but downloading a file to launch the KVM viewer app).

Re: HP IP Console Switch G2 - Vertiv Certificate Expired even with Latest 2.12.6 Firmware

Suvamay — Fri, 10 May 2024 02:11:37 GMT

Please log a support ticket with HPE, we will check furthe on this with HPE engineering.

Re: HP IP Console Switch G2 - Vertiv Certificate Expired even with Latest 2.12.6 Firmware

edwardforgacs — Thu, 29 Aug 2024 13:17:43 GMT

Still an issue months later, with the added bonus it's now completely blocked by the latest Java updates.

If HP ever get their act together with the certificates, let me know. The reason I posted in the forum was because of not having good experiences in the past with HP support tickets.

Re: HP IP Console Switch G2 - Vertiv Certificate Expired even with Latest 2.12.6 Firmware

Sunitha_Mod — Fri, 30 Aug 2024 10:20:50 GMT

Hello @edwardforgacs,

We regret the inconvenience caused. We request you please take a moment to reply to the private message we've sent and provide the requested information. This will enable us to address your concerns with the relevant team.