topic Re: Question about SSL on OA/iLO in Server Management - Remote Server Management

Question about SSL on OA/iLO

Blaine Baker — Mon, 04 Oct 2010 21:46:48 GMT

Hi all,

This is probably a pretty easy question for most of you. I have a c3000 enclosure with some bl460c blades in it. I have followed the process to get an ssl certificate (from our internal enterprise CA) for the onboard administrator itself, and that works perfectly, but everything under Device Bays -> nnn -> iLO, those links all open directly to the IP address of the blade and not a DNS hostname. As a result, even though i have a certificate installed for one of my iLO interface's FQDN, and it works if I manually go there, if I simply click the links inside OA (like I want to) it says the certificate is not valid because the name is mismatched (the URL is only the IP address).

Can anyone clue me in on what I can do to resolve this? Thanks,

-Blaine

Re: Question about SSL on OA/iLO

Martin Smoral — Wed, 06 Oct 2010 01:52:36 GMT

Did you enter your DNS info under the Enclosure settings ?

Re: Question about SSL on OA/iLO

Blaine Baker — Wed, 06 Oct 2010 17:24:23 GMT

Yes, my DNS settings are configured properly. OA is not even attempting to connect via hostname however - just IP address; so no DNS resolution is even being attempted.

Re: Question about SSL on OA/iLO

T. Jones — Thu, 14 Oct 2010 11:20:02 GMT

I'm experiencing the same issue. Currently looking into using the subject alternate name extension to specify the IP address.

Re: Question about SSL on OA/iLO

T. Jones — Fri, 15 Oct 2010 17:09:03 GMT

I got this working with our local Microsoft CA. Here's what I did:

1. Created the certificate and copied to clipboard.
2. On the CA, pasted the request, specified web server template, and added the subject alternate name attribute as "san:dns=xxx.xxx.xxx.xxx" (where "xxx.xxx.xxx.xxx" was my iLo IP address).
3. Imported the new cert.
4. Restarted browser, logged back in and no more cert error.

I did have to configure our CA to accept SAN attributes. Directions here: http://support.microsoft.com/kb/931351

Hope that helps,
tj

Re: Question about SSL on OA/iLO

Blaine Baker — Thu, 04 Nov 2010 21:40:50 GMT

T. Jones' solution works perfectly. I had a little back and forth with my CA and they got it all sorted out. Thanks!