topic Re: HP-Oneview 4.0 upgrade Issues in HPE OneView

HP-Oneview 4.0 upgrade Issues

Jkersten1982 — Thu, 28 Dec 2017 14:48:41 GMT

Hello, Have upgraded our 3.0-Oneview appliance to 4.0, and I'm facing issues;

- Error: Unable to establish trusted communication with server, Could not find a valid iLO certificate (on 5 servers). Have already tried to remove the oneview user at the ILO of the server

- Oneview time isn't updated correctly, so adding a new server isn't possible (option Synchronize with VM Host is enabled, Host has correct time)

Any idea how I can fix this? Luckily we have a seperate Oneview for our live servers, but I'd like to solve this problem.

Re: HP-Oneview 4.0 upgrade Issues

peyrache — Thu, 28 Dec 2017 15:27:56 GMT

Hello
>From OV 4.0 release notes page 17
Communication with a managed device may fail despite the
existence of the certificate in the trust store
Under very rare circumstances communication with a managed device may fail with an unable to establish
trusted communication alert (shown below) despite the existence of the certificate in the trust store. The
resolution to add the certificate will fail.
Remote support master task incomplete even though subtasks are completed 17
Suggested action
>From the Settings > Security > Manage Certificate page:
* Delete the device certificate for which the communication failed
* Add the device certificate back with the same alias name
18 Issues

Re: HP-Oneview 4.0 upgrade Issues

Jkersten1982 — Thu, 28 Dec 2017 16:12:29 GMT

Thanks for your reply, however I did read the notes, and it was a part I still had to read (my bad).

However, the certificate (self-signed, which came with ILO) isn't in the list as I search the name (UUID). Also, when I remove the server, I also can't add it back because it complains of the system date/time configured and '[..] all the certificates in the ILO certificate chain are current and valid'.

Any idea?

Re: HP-Oneview 4.0 upgrade Issues

peyrache — Thu, 28 Dec 2017 16:15:56 GMT

how are you picked time ?( ntp local ?)

Re: HP-Oneview 4.0 upgrade Issues

Jkersten1982 — Fri, 29 Dec 2017 08:29:07 GMT

Time setting in Oneview is by host, and time of the ILO is picked by Oneview.

At this time, there's 1 minute difference between the ILO host and Oneview Appliance, but the error remains, see attachment

Re: HP-Oneview 4.0 upgrade Issues

peyrache — Fri, 29 Dec 2017 08:45:04 GMT

Did you try to delete certificate a described in release notes ?

Re: HP-Oneview 4.0 upgrade Issues

Jkersten1982 — Fri, 29 Dec 2017 09:14:45 GMT

Yeah, but the certificate isn't listed under 'Certificate' (No Matches when searching on UUID), so the first step failes. And I can't see how I can download the new certificate.

When I'm trying to add the certificate through Add Certificate -> "option Add certificate from an IP address or hostname", it says "One or more certificate(s) have expired." I think it's a correct message because the certificate on the server is expired (see attachment). Any idea how we can recreate a selfsigned ilo certificate? On a server in the same Oneview appliance, what doesn't have the problem, the certificate is valid untill 2032 or later.

Re: HP-Oneview 4.0 upgrade Issues

BenjieE — Fri, 29 Dec 2017 10:03:21 GMT

Hi,

I have also just had this issue and noticed your post, I had to re-generate the self signed cert by changing iLO host name and resetting the iLO, and then it fixed the problem and I could import into OneView 4.0. See this link.

The expiry date of the self signed cert is now 2038 following the name change.

https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c03743622.

I also have lots of locked errors from the upgrade as well relating to Leaf Certificates but cannot solve this even after deleting the expired certs, and removing and re-importing Enclosures. Anyway this is for another thread but lots of problems from the upgrade.

Thanks

Ben

Re: HP-Oneview 4.0 upgrade Issues

BenjieE — Fri, 29 Dec 2017 10:28:41 GMT

And you need to change it to something else reset iLo then change the name back and another iLO reset otherwise it doesnt re-generate cert.

Re: HP-Oneview 4.0 upgrade Issues

Jkersten1982 — Fri, 29 Dec 2017 10:57:25 GMT

Yeah, so, under Network -> ILO Dedicated network port -> General -> change hostname -> submit & reset, than after reset, again change hostname -> Submit & Reset?

Re: HP-Oneview 4.0 upgrade Issues

BenjieE — Fri, 29 Dec 2017 10:58:56 GMT

Yes, works on DL servers, but with Blades in an Enclosure proving more tricky to get OneView to refresh.

Re: HP-Oneview 4.0 upgrade Issues

Jkersten1982 — Fri, 29 Dec 2017 11:01:26 GMT

OK, i've done the hard way (so factory reset ILO and configure ILO again via SHH through my Vmware machines with HPONCFG), but that takes a lot more time. WIll try this also.

Re: HP-Oneview 4.0 upgrade Issues

Jkersten1982 — Fri, 29 Dec 2017 11:05:23 GMT

Hmm, ILO 4-2.55 will not regenerate the certificate after renaming the ILO hostname..

Re: HP-Oneview 4.0 upgrade Issues

BenjieE — Fri, 29 Dec 2017 11:20:22 GMT

My servers were iLO 3's havent had to re-generate the certs on my iLO 4 sevrers yet.

Re: HP-Oneview 4.0 upgrade Issues

Jkersten1982 — Fri, 29 Dec 2017 12:10:35 GMT

Ah. So, it's better to factory reset the ILO and reapply the settings. Than problem is solved.

But it was kinda weird the problem came up after applying the update from 3.10 to 4.0. It is something in 4.0 what doesn't work as it should do.

Re: HP-Oneview 4.0 upgrade Issues

Dennis Handly — Fri, 29 Dec 2017 20:31:40 GMT

@Jkersten1982I think it's a correct message because the certificate on the server is expired

Strange, your certificate was never valid, says it expires in 2006 and started in 2017.

(Unless it uses a 32 bit time_t that can't handle dates after 2038?)

Re: HP-Oneview 4.0 upgrade Issues

Jkersten1982 — Tue, 02 Jan 2018 12:16:50 GMT

@Dennis Handly yeah, that's strange right? I've updated the ILO on most of the servers when we started to use Oneview for simple monitoring ot the state of the servers, the oldest ilo v4 was 1.30. Don't know if that was the reason for it.

Re: HP-Oneview 4.0 upgrade Issues

thomaspunktelf — Mon, 15 Jan 2018 08:45:08 GMT

Hi,
I`m facing the same problem with the "Leaf certificate...is expired" errors.
Is there any possibility to unlock and clear or hide this alert?
I`ve deleted and recreated the certificates as described, but the errors aren`t gone.

regards
Tom

Re: HP-Oneview 4.0 upgrade Issues

Chris_L1 — Thu, 01 Feb 2018 14:12:16 GMT

We just finished updating our instances of OneView and had the same issue with all Gen-7 (iLO3) servers. We fixed by doing what was stated earlier in this posting.

Note: we still have a few Gen-7s (DL380 and DL360) that did not resolve after performing the rename/rediscover steps. The one thing that they all have in common is that they are at iLO ver. 1.88. We are working on getting these updated and will try the fix on these remaining servers.

Just wanted to share the firmware observation.

Re: HP-Oneview 4.0 upgrade Issues

ChrisLynch — Thu, 01 Feb 2018 17:21:08 GMT

I wanted to let those in this thread know that we have a patch in the works to address these issues. For customers looking to upgrade to 4.00, I would ask that you hold off on performing that upgrade. The patch I mentioned is currently on track for early this month (Feb 2018). I will post back on this thread with the exact details of the patch, including version and location when we have that.