topic Re: Anyone have iLO 3 certificate signing working? in Server Management - Remote Server Management

Anyone have iLO 3 certificate signing working?

NJK-Work — Mon, 09 Aug 2010 18:24:01 GMT

We have been able to sucessfully sign iLO 2 certicates with our internal Windows 2008 R2 CA and it works great. Now we are trying to use the same process and certifcate template (1024-bit encryption) with the new iLO 3 and it is not working. It says:

The Certificate could not be imported from the supplied X.509 Certificate data.

Check the following:
- Make sure that the input text was base64 encoded X.509 Certificate data.
- Make sure that the input X.509 Certificate data was intended for this server (not another server).

Does anyone have document process for signing iLO 3 certicates with a Windows 2008 or 2008 R2 CA that they could share? Here what we have been doing in the past:

1) Generate certicate from iLO web interface and copy it to clipboard.
2) Go to our CA web site http://caservername/certsrv
3) Click on "Request a Certificate" link
4) Click on "Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file" link.
5) Paste from clipboard into the "Saved Request" field.
6) Select our template from the "Certificate Template" drop-down list. This is the same one that works perfectly for iLO 2 (1024-bit encryption).
7) Click on the "Submit" button.
8) Select "Base 64 encoded" radio button.
9) Click on "Download Certifcate" button and save as a TEXT file.
10) Copy contents of TEXT file to the "Import the certificate" field in the iLO 3 web page.
11) Generates above mentioned error.

Thanks
Nelson

Re: Anyone have iLO 3 certificate signing working?

Brody — Mon, 23 Aug 2010 23:54:46 GMT

We're having the exact same problem with iLO3 and our Windows 2003 CAs. (Working fine with iLO / iLO2.)

iLO3 FW: 1.05

No solution as yet, but at least you know you're not alone. Will post more info if I find out anything further.

Re: Anyone have iLO 3 certificate signing working?

Brody — Tue, 24 Aug 2010 00:19:26 GMT

Not resolved in iLO3 FW 1.10 either.

Re: Anyone have iLO 3 certificate signing working?

NJK-Work — Tue, 24 Aug 2010 03:40:26 GMT

Thanks. Misery love company I guess :)

Nelson

Re: Anyone have iLO 3 certificate signing working?

JoshC — Tue, 14 Sep 2010 21:34:58 GMT

I am having the same problem with iLO 3 (1.05) and a Windows 2008 R2 Enterprise CA. Is there a fix yet?

Re: Anyone have iLO 3 certificate signing working?

Oscar A. Perez — Thu, 16 Sep 2010 14:45:38 GMT

This is what I reproduced. If the cert generated by your CA in Base64 is larger than 2048 bytes then, the iLO3 web interface doesn't allow you to import it.
This will be fixed in the next release.

Re: Anyone have iLO 3 certificate signing working?

Anonymous — Thu, 04 Nov 2010 23:33:20 GMT

This issue has been resolved in Firmware 1.15, released October 28.

Re: Anyone have iLO 3 certificate signing working?

NJK-Work — Fri, 05 Nov 2010 03:03:49 GMT

Thanks - I will try out the new firmware shortly.

Re: Anyone have iLO 3 certificate signing working?

Jonathan_Barker — Wed, 24 Nov 2010 02:04:27 GMT

f/w v1.15. I'm still having this issue. Furthermore, after the error message is given iLO3 completely locks up and I have to restart it using the windows online configuration tool.

I've tried resetting everything back to defaults with no success.

Re: Anyone have iLO 3 certificate signing working?

Oscar A. Perez — Wed, 24 Nov 2010 15:04:00 GMT

How big is your cert? Can you attach one so I can test it?

Re: Anyone have iLO 3 certificate signing working?

Jonathan_Barker — Wed, 24 Nov 2010 19:49:29 GMT

cert is 3.70 KB in size.

Re: Anyone have iLO 3 certificate signing working?

NJK-Work — Thu, 25 Nov 2010 04:04:37 GMT

The latest firmware fixed my problem. I am now able to sign the certificate using our internal CA.

Re: Anyone have iLO 3 certificate signing working?

NJK-Work — Thu, 25 Nov 2010 04:05:27 GMT

Update to firmware 1.15.