topic Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work in ProLiant Servers (ML,DL,SL)

Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

AlexPotter — Fri, 24 Feb 2023 08:09:03 GMT

Just wanted to let everyone know the automatic certificate enrollment using Microsoft NDES (SCEP) server doesn't work (despite documentation says it is supposed to). At least on the current 2.78 iLO. Don't spend time trying to get it working. Dissapointed with HP. Works perfectly with with Dell iDRAC.

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

techin — Fri, 24 Feb 2023 08:00:30 GMT

@AlexPotter ,

Did you check with HPE Support?

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

AlexPotter — Fri, 24 Feb 2023 08:07:12 GMT

I did. The answer was "It works in our lab so suppose to work". No details or explanations how they managed to get it working. I have my environment configured as per MS standard and other devices are working fine. SO definitely problem with on HP side.

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

Suman_1978 — Tue, 28 Feb 2023 07:28:08 GMT

Hi,

May we know the error message you get during certificate enrolment?

Automatic certificate enrollment

NOTE: This feature is not supported when iLO is in CNSA security state.

Disabling the CNSA security state

Thank You!
I work with HPE but opinions expressed here are mine.
Recent Support Video Releases

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

AlexPotter — Fri, 03 Mar 2023 05:31:56 GMT

@Suman_1978

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

Suman_1978 — Fri, 03 Mar 2023 06:49:44 GMT

Hi,

Please contact HPE Support and log a ticket to get this checked.

Thank You!
I work with HPE but opinions expressed here are mine.
Recent Support Video Releases

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

thutchings — Wed, 08 Mar 2023 16:03:05 GMT

Is the certificate being supplied to the iLO using SCEP an intermediate cert? If so, then this is likely related to a known problem that is resolved in an upcoming iLO 5 firmware.

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

AlexPotter — Mon, 13 Mar 2023 03:30:13 GMT

Finally some useful info. Yes, you absolutely right - it is Intermediate sert. And I had support case open with support - they were useless, telling me "it is suppose to work because it works in our lab".

Thank you for your comment.

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

drehstrom79 — Tue, 19 Sep 2023 09:31:45 GMT

We're just installing and configuring about 200 servers using HPE OneView. Of course I don't want to rollout every certificate manually. Is using an MS SCEP-Server with an intermediate certificate working with iLO 2.96 yet?

Regards
Stephan

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

Sunitha_Mod — Thu, 21 Sep 2023 06:32:49 GMT

Hello @drehstrom79,

Thank you for posting! We would recommend you to create a new topic using the create a "New Discussion" button, so the experts can check and assist you further.

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

drehstrom79 — Fri, 22 Sep 2023 11:53:49 GMT

Hi,

I don't really see why I should create a new topic containing the exact same problem!?
Meanwhile I have my SCEP-Server working and can confirm that problems with iLO 2.96 are still the same. I also use an intermediate certificate and get the same error message as AlexPotter.

I got about 200 servers to configure, so please HPE get going! Can't be that difficult if DELL got it working!?

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

jnc277 — Mon, 02 Oct 2023 09:14:19 GMT

Hi,

I have the same problem. Switching to http the wireshark trace says "Bad request" when sending: http://x.x.x.x/certsrv/mscep/mscep.dll?operation=GetCACaps

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>Bad Request</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD>
<BODY><h2>Bad Request - Invalid Verb</h2>
<hr><p>HTTP Error 400. The request verb is invalid.</p>
</BODY></HTML>

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

drehstrom79 — Mon, 02 Oct 2023 09:47:20 GMT

Hi,

I can confirm this. My wireshark-trace shows the exact same error.
Pretty disappointing that there is obviously no rush to fix this error by HPE. All in all I'm very displeased with HPE OneView. There are so many bugs and missing features. All my 200 servers are claiming security risks that are pre-configured ex factory as for instance
- Login for RBSU
- SNMPv1 enabled
- Password Complexity disabled
but none of them can be adjusted with the OneView template. If there is no real improvement over the next years we'll be forced to move to DELL...

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

jnc277 — Mon, 02 Oct 2023 10:17:30 GMT

Thanks for confirming.

Move to DELL - we will consider that as well.

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

AlexPotter — Mon, 02 Oct 2023 10:20:38 GMT

+1 with the same conclusion. Has already started migration.