topic Re: Sign SIM certificate with internal CA in Server Management - Systems Insight Manager

Sign SIM certificate with internal CA

NJK-Work — Fri, 12 Nov 2010 18:36:53 GMT

Does anyone have a documented process for signing the certificate used by SIM with an internal Windows 2008 CA that they would like to share?

Thanks
Nelson

Re: Sign SIM certificate with internal CA

NJK-Work — Fri, 12 Nov 2010 18:40:24 GMT

I forgot to mention, this would be for SIM 6.2.

NElson

Re: Sign SIM certificate with internal CA

Arunav Nayak — Mon, 15 Nov 2010 05:04:23 GMT

Hi Nelson,

Please find the User Guide @ http://h10018.www1.hp.com/wwsolutions/misc/hpsim-helpfiles/hpsim_userguide_51.pdf
that has the documentation on how to perform the steps.

Go to page no. 152 and you can get the details on Certificate related setings.

Please get back in case of any issue or confusion.

Thanks,
Arunav

Re: Sign SIM certificate with internal CA

NJK-Work — Mon, 15 Nov 2010 23:44:48 GMT

Thanks, but I could find nothing in that document that specifically describes how to perform this task with a Windows 2008 CA.

Here is the problem I run into:

1) Verify the root CA cert is on the SIM server in the "Computer Account" folder called "Trusted Root Authority Certificates/Certificates" - it is indeed there, as it is on every server we build

2)Create a new certifcate with my company settings and this replaces the existing one installed by HP SIM

3) From the "Import Certificate" page, I "Create a Certificate Signing Request" and it creats a "certreq.p10" file

4) I go to the https://mycaservername//certsrv/certrqxt.asp page and paste in the text from the "certreq.p10" file and select the template we have created for this - this is the same template I use for iLOs (which work fine for us). I download the file a "Base 64 encoded" CRT file.

5) From the "Import Certificate" page I "Import signed certificate reply from CA" and point it to the "CRT" file created in step 4 above.

6) When I click the "Import" button as part of step 5 above I get this error:

"Error importing signed certificate: failed to establish chain of trust from reply; first import CA certificate into Trusted System Certificates list." - as I mentioned in step one, I have already done this.

So somewhere, must likely in my CA template I am using - the same template I successfully use for iLO 2 and iLO 3 devices, I am doing something wrong.

So, does anyone have a documented process (i.e. what do I do on the CA server) to make this work for a Windows 2008 CA.

Thanks
Nelson

Re: Sign SIM certificate with internal CA

Robb Howell — Thu, 16 Jun 2011 08:49:50 GMT

Hi, Did you ever figure this out, I've got exactly the same issue.

Cheers!
Robb.

Re: Sign SIM certificate with internal CA

NJK-Work — Thu, 16 Jun 2011 12:50:06 GMT

No, I gave up.

Nelson

Re: Sign SIM certificate with internal CA

dgerol — Wed, 29 Jun 2011 03:55:06 GMT

I have managed to get this working with a W2K8 AD CA.

Before importing the SIM signed certificate, the SIM server needs to be able to establish a chain back to the Root CA. You do this by:

1. Go Options / Security / Credentials / Trusted Systems.

2. Select the tab "Trusted Certificates"

3. Import the cert (or certs) of your CA.

4. Now go back to the HP SIM Server Certificate section and import the signed certificate.

Hope this helps...

Dennis.

Re: Sign SIM certificate with internal CA

zeroagemain — Tue, 26 Nov 2013 10:08:54 GMT

I know this is an old post but we had this issue due to downloading just the certificate from our cert server rather than the certificate chain.

Once we downloaded and imported the certificate chain it worked fine.

Re: Sign SIM certificate with internal CA

StephaneD — Tue, 18 Feb 2014 18:46:31 GMT

Hello I'm using HP SIM 7.3 with the exact same issue. I have imported the whole chain into the 'Trusted Certificates' tab. I can see all my certs CA listed in the page.

From the HP Sim Server certificate section, I'm doing import of the signed certificate and get this error :

Error importing signed certificate: failed to establish chain of trust from reply; first import CA certificate into Trusted System Certificates list.

Any help is appreciate.

Stephane

Re: Sign SIM certificate with internal CA

EricBu — Mon, 19 May 2014 09:32:26 GMT

HI HP...feedback from the above post pls?