HPE OneView
cancel
Showing results for 
Search instead for 
Did you mean: 

Clear Locked Alerts for Expired Leaf Certificates

BenjieE
Occasional Advisor

Clear Locked Alerts for Expired Leaf Certificates

Hi,

Since upgrading to HP OneView 4.0 we have multiple alerts that will not clear due to locked alerts relating to expired certificates for a number of our iLO's and Onboard Administrators. It appears they will not clear no matter what we do. Things tried are

  1. Delete expired certificates.
  2. Create new certficiates from our CA.
  3.  Create new certificates from our CA with the original name of expired certificate
  4. Remove and Re-Add Enclosures and Servers.
  5. Rescan
  6. Reboot
  7. Firmware updates on all of the iLO's and OA's.

We would like to close these locked alerts, but I gather you cannot and it must clear itself automatically. Problem is they wont clear automatically, so either its a bug or we would like some assistance if possible to clear them?

Thanks in advance.

 

10 REPLIES

Re: Clear Locked Alerts for Expired Leaf Certificates

We currently have exactly the same problem and have tried everything you have listed.

The appliance is saying to add a new cert with the same alias name as the expired one. Once this has been done the alert does not clear.

Following the thread for a resolution. 

JakubM
Advisor

Re: Clear Locked Alerts for Expired Leaf Certificates

Yep, we have same problem but with C7000 Onboard Administrator certificate. After regenerating of certificate one alert goes away, but other two are still locked: for IPv6 address and for enclosure serial number. How to get rid of them?

sc2.PNG

Refreshing enclosure not helping, deleting old certificates too. In certificate configuration i have good certificates now for all three options: ipv4, ipv6 and SN:

sc1.PNG

Something is really broken with certificate management in OV4.

Re: Clear Locked Alerts for Expired Leaf Certificates

@BenjieE Have you had a response from HPE yet? They seem to have replied to all recent threads apart from this one which is pretty disappointing. Getting tired of looking at locked alerts now ha!

BenjieE
Occasional Advisor

Re: Clear Locked Alerts for Expired Leaf Certificates

Hey ServerParrott,

Nope not a peep from HP about this issue yet sadly.

Thanks

Benjie

Matthew Ingram
Regular Advisor

Re: Clear Locked Alerts for Expired Leaf Certificates

I have a case opned at Level 2 for this issue as well.

BenjieE
Occasional Advisor

Re: Clear Locked Alerts for Expired Leaf Certificates

Hi Matt,

It would be great if you could share the results of their findings. I am expecting/hoping it to be fixed in the next release judging by some of the comments on others posts in this forum.

Thanks

Ben

 

Re: Clear Locked Alerts for Expired Leaf Certificates

It would actually be ideal if we had the option to simply trust the root certificate and the leaf certificates would be trusted as well regardless if they renew.  I have domain controllers which I use for LDAP authentication which will go out and renew their own certificate and everything I use other than OneView seems to be fine with simply trusting the root CA.

BhaskarV
Advisor

Re: Clear Locked Alerts for Expired Leaf Certificates

Hi Kelly M Knowles, 

Starting version 4.0.x, we do allow trusting just the top most Root CA, allowing LDAP / AD servers to freely renew their certificates, retaining the top most Root CA.

Let us know if this is not working and open a support case with a support dump.

Regards,
Bhaskar

mLuXoR
Occasional Advisor

Re: Clear Locked Alerts for Expired Leaf Certificates

Try:

- Factory Reset applience
- before add enclosure OneView Settings - security - Certificates - Disable Certificate validation and Certificate revocation checking (using CRLs).
- add enclosure

 

Vladislav1
Advisor

Re: Clear Locked Alerts for Expired Leaf Certificates

You need create case with L2.

With him you can unlock Lockes State, when do Clear for this Alerts. In root console do:

cidb=# UPDATE "health-services".alert SET alertstate = 'Active' WHERE id = 810015;

where number - number ID for locked alert. 

Then in console simple do Clear.