topic Re: iLO3 1.26 Certificate error in ProLiant Servers (ML,DL,SL)

iLO3 1.26 Certificate error

NterSup — Fri, 11 Nov 2011 14:05:29 GMT

DL380 G7 iLO FW : 1.26

When I import a certificate in iLO, I receive this message :

Error: The Certificate could not be imported from the supplied X.509 Certificate data.

Check the following:
- Make sure that the input text was base64 encoded X.509 Certificate data.
- Make sure that the input X.509 Certificate data was intended for this server (not another server).

The CSR has been generated on a Windows Server 2008 authority.

With iLO2 or iLO3 1.20, that works.

Can someone help me ?

Re: iLO3 1.26 Certificate error

Oscar A. Perez — Fri, 11 Nov 2011 15:08:28 GMT

The cert is probably too big. Can you post it here?

Re: iLO3 1.26 Certificate error

ViktorSylantiev — Thu, 22 Dec 2011 13:51:36 GMT

I Have a same problem with import cert.

Why it imports in ILO2, and ILO3 1.20, and not imports in ILO3 1.26?

Re: iLO3 1.26 Certificate error

AlonsoRojas — Mon, 02 Jan 2012 19:18:47 GMT

Hi Oscar

I am seeing the same issue with firmware 1.26 when the key is set for 2048, stating that the key size is too big, but with older firmware versions it works fine.

What could be casing this issue with this version?

Re: iLO3 1.26 Certificate error

Oscar A. Perez — Tue, 03 Jan 2012 17:37:08 GMT

iLO3 stores the custom cert, public and private key in the same file in the NVRAM. The file is currently limited to 3Kb. On the other hand, iLO2 stored in the NVRAM the cert and keys in separate structures. This allowed the custom cert to be few bytes bigger in iLO2.

Older iLO3 versions (before 1.20) only supported 1024bit keys for certs. In iLO3 1.20 and later, all custom certs contain 2048bit keys.

I have requested the team to increase the size limit in iLO3 to match the iLO2 limit size.

Re: iLO3 1.26 Certificate error

CMMWSP — Fri, 13 Jan 2012 16:33:13 GMT

What would be the solution to allow the import of a certificate for ILO3 with firmware 1.26? I've tried both 1024 and 2048bit keys and neither work.

If it's due to a size limitation on the cert how would I generate a certificate that is small enough in size?

Re: iLO3 1.26 Certificate error

Oscar A. Perez — Fri, 13 Jan 2012 22:58:56 GMT

Can you post here one of the certs?

Re: iLO3 1.26 Certificate error

JoeBruneau — Wed, 18 Jan 2012 18:34:48 GMT

I am having the same problem importing a certificate - Same firmware using Windows Sever 2008 as the CA

Re: iLO3 1.26 Certificate error

ViktorSylantiev — Mon, 23 Jan 2012 09:27:44 GMT

I can't install this certificate:

It have many CRL sources, and root CA have many CRL sources, and I think this was the reason that the certificate is not installed. But we needed all it sources.

Re: iLO3 1.26 Certificate error

Oscar A. Perez — Tue, 24 Jan 2012 15:27:20 GMT

This cert cannot be imported because it is too big. iLO3 only has 3Kb in the NVRAM to store imported certs. Can you make it leaner by unchecking the LDAP for CRL and AIA in the CA issuing your cert?

Re: iLO3 1.26 Certificate error

ViktorSylantiev — Wed, 25 Jan 2012 12:18:32 GMT

I can not, because We use them all. If I turn them off - I have reissued all certificates in the company, and this is unacceptable. ILO2 works well with such certificates. It is a pity that the new version get the new restrictions.

Re: iLO3 1.26 Certificate error

JoeBruneau — Wed, 25 Jan 2012 14:22:43 GMT

I am seeing the same problem and the certificate I am using is only 2.75KB.

Re: iLO3 1.26 Certificate error

Oscar A. Perez — Wed, 08 Feb 2012 14:56:13 GMT

iLO does not use those LDAP fields you have in CRL and AIA so, including these fields in Certs destinated to your iLOs is a waste of space.

I guess, you could request your CA to create a separate template for your iLOs, a template without these extra LDAP fields.

From my side, I have formally requested the iLO team to increase the max size of certs to match what iLO2 accepts. They are evaluating the impact of increasing NVRAM usage in iLO3 and other needed code changes. I will post an update as soon as I get the final answer from the team.

Re: iLO3 1.26 Certificate error

ViktorSylantiev — Thu, 09 Feb 2012 12:25:32 GMT

Thank you, we will wait.

Re: iLO3 1.26 Certificate error

UserHP — Fri, 16 Mar 2012 15:47:23 GMT

Are there any news regarding this issue? My certificate has only 2,84 KB but I also receive the "Error: The Certificate could not be imported from the supplied X.509 Certificate data."

I think this will end up in a new ILO firmware (v1.27) ?

Re: iLO3 1.26 Certificate error

UserHP — Wed, 15 Jan 2014 12:16:52 GMT

Hi,

with the newest ILO Firmware v1.61 from Aug 01 2013 I still have this issue. I still receive

Error: The Certificate could not be imported from the supplied X.509 Certificate data.

Check the following:
- Make sure that the input text was base64 encoded X.509 Certificate data.
- Make sure that the input X.509 Certificate data was intended for this server (not another server).

Is this bug still not fixed yet??? It´s really urgent!

Re: iLO3 1.26 Certificate error

Torsten. — Wed, 15 Jan 2014 12:24:08 GMT

The current firmware is 1.65, try this.

Re: iLO3 1.26 Certificate error

UserHP — Wed, 15 Jan 2014 13:07:51 GMT

Where to get? The Download Area of HP ILO is frustrating. The vcagent only offers the v1.61 as latest version.

Re: iLO3 1.26 Certificate error

Torsten. — Wed, 15 Jan 2014 13:20:06 GMT

www.hp.com

-> support -> drivers

-> search for "ilo-3"

-> select windows

download the file, extract it, use the *.bin file directly on the ILO web interface.

http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/psi/swdDetails/?sp4ts.oid=4154847&spf_p.tpst=swdMain&spf_p.prp_swdMain=wsrp-navigationalState%3Didx%253D%257CswItem%253DMTX_abf6391893fc490fa687b76d4c%257CswEnvOID%253D4138%257CitemLocale%253D%257CswLang%253D%257Cmode%253D%257Caction%253DdriverDocument&javax.portlet.begCacheTok=com.vignette.cachetoken&javax.portlet.endCacheTok=com.vignette.cachetoken

Re: iLO3 1.26 Certificate error

UserHP — Wed, 15 Jan 2014 14:07:35 GMT

Nope, doesn´t work also on v1.65. Doesn´t it support key length of 2048 or what crap is that SSL implementation on ILO?!?