topic Re: SSL certificate request creating using CLI in Server Management - Remote Server Management

SSL certificate request creating using CLI

michal1 — Wed, 23 Jun 2010 11:01:14 GMT

Hi!

Model iLO2
Firmware Version 1.81 Jan 15 2010

I have to write script to get certificate request from iLO, sign it in my CA and export signed certificate back to iLO.
Have You maybe any idea how to do it?
What CLI command can I use to get certificate request when I using SSH?
And what CLI command should I use to export signed certificate back to iLO?

Re: SSL certificate request creating using CLI

WFHC-WI — Wed, 23 Jun 2010 16:29:19 GMT

Hi michal,

Check page 109 of this document:
http://bizsupport1.austin.hp.com/bc/docs/support/SupportManual/c00294268/c00294268.pdf

This scripting method uses XML files along with the HPONCFG utility for Windows or Linux.

Re: SSL certificate request creating using CLI

michal1 — Thu, 24 Jun 2010 07:02:00 GMT

Yes, I know about RIBCL, but I looking for any simples solution :)

Re: SSL certificate request creating using CLI

michal1 — Thu, 24 Jun 2010 13:30:51 GMT

Ok, I found how to use RIBCL
For windows:
http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareDescription.jsp?lang=en&cc=us&swItem=MTX-5ee197c5bd7641359f45d876b1&jumpid=reg_R1002_USEN

For linux:
http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareDescription.jsp?lang=en&cc=us&prodTypeId=15351&prodSeriesId=1121516&prodNameId=3288134&swEnvOID=4006&swLang=8&mode=2&taskId=135&swItem=MTX-a17bde2a8b0643c3b54a8d41f2

And simple XML to get SSL request:

Re: SSL certificate request creating using CLI

SamMan — Thu, 24 Jun 2010 13:36:55 GMT

I had the same issue and here is how I accomplished this task:
1. using CPQLOCFG I generated a Certificate Request and output to a log file name CertReq.log.
2. I then searched through the CertReq.log file to look for the data between -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST-----.
3. I then stored this data into a string and wrote this string into a seperate TXT file name CACertReq.req.
4. Using Microsoft's CERTREQ.EXE I used the following:
CERTREQ.EXE -submit -attrib "CertificateTemplate:myILOTemplate" -config "myCAServerName\Issuing CA Name" C:\TEMP\CACertReq.req C:\TEMP\iLOCert.cer"
5. I then pulled all data from the file iLOCert.cer and stored it to a string variable.
6. I then wrote the .XML file Import_Cert.XML while injecting the string variable in step 5 into the XML file.
7. Using CPQLOCFG.EXE I then imported the certificate via the Import_Cert.XML file.

I wrote this in 2 different languages. First I wrote it is C++ and then I wrote it in AutoItv3. This can be done in just about any language such as VBS, Powershell etc.. I am just more familiar with C++ and AutoItv3 more then the others. I won't post my code as it is very long. But if you can figure out how to perform the steps above then you should be able to automate this process.

Re: SSL certificate request creating using CLI

michal1 — Thu, 22 Jul 2010 12:08:28 GMT

Using RIBCL I generated the ssl request, I signed it in my CA (openssl) and uploaded signed certificate back to iLo.
I generated also ca.der and uploaded it to my Internet browser. When I trying open ilo my browser give a warning about a mismatched hostname.

In certificate request was:
CN = some-iLO-2-Subsystem-Name
OU = ISS
O = Hewlett-Packard Development Company
ST = Texas
C = US

What should i do to connect to ilo without any warnings?

Re: SSL certificate request creating using CLI

WFHC-WI — Thu, 22 Jul 2010 17:10:58 GMT

hi michal,

Are you accessing iLO via:

IP address?
DNS name?
FQDN?

Which method gives you a hostname mismatch?

Re: SSL certificate request creating using CLI

michal1 — Fri, 23 Jul 2010 06:07:47 GMT

I'm accessing ilo via IP address.
I didn't add this addresses to my DNS.
I tried to change the iLO 2 Subsystem Name to IP address of iLO, but i got "The iLO 2 Subsystem Name may contain only alphanumeric and '-'"
Is any method to access iLO via IP address without warnings?

Re: SSL certificate request creating using CLI

michal1 — Mon, 26 Jul 2010 08:14:44 GMT

I've solved this problem.
I created file ip.ext with:

subjectAltName=IP:10.5.19.191

To sign certificate I used:

openssl ca -notext -extfile ip.ext -in /etc/ssl/req.txt > /etc/ssl/ilocert.pem

Everything works well!