HPE OneView
cancel
Showing results for 
Search instead for 
Did you mean: 

HP-Oneview 4.0 upgrade Issues

Highlighted
ChrisLynchHPE
Neighborhood Moderator

Re: HP-Oneview 4.0 upgrade Issues

It does support upgrading from 4.00.05 and older. We pulled the 4.00.05 release from. The web and replaced it with the 4.00.07 update.
MikeE78
Occasional Visitor

Re: HP-Oneview 4.0 upgrade Issues

I just upgraded from 4.00.05 to 4.00.07 and my certificate issues are still present.

Only an issue on 1 enclosure. Other enclosures are fine. Firmware levels etc between the enclosures and blades are identical.

Have tried all the suggestions prior to the update, even after updating, and get the same. Nothing seems to fix this ILO certificate error on 1 enclosure.

JulianHPclient
Occasional Visitor

Re: HP-Oneview 4.0 upgrade Issues

I also have that error:

"Self-signed certificate with alias name HP Infrastructure Management Certificate Authority-internalroot Basic Constraint is not valid"

"Resolution:  Provide a certificate with Basic Constraint set to SubjectType=CA. Try again."

Comming from 3.x -> 4.00.05 to 4.00.07

How can I solve it. I'm not seeing the certificate in question anywhere.

cesarpegado
Valued Contributor

Re: HP-Oneview 4.0 upgrade Issues

I have upgraded from 4.00.05 to version 4.00.07 with no issues. and its fixed the original issue with the certificates :)

Bart_Heungens
Honored Contributor

Re: HP-Oneview 4.0 upgrade Issues

I can confirm that the certificate alerts are gone after the upgrade to 4.0.07...

I still had the error on the SCMB certificate with SHA1, but that one is solved now with the 2 CLI instructions from Chris Lynch, mentioned in another thread...

--------------------------------------------------------------------------------
If my post was useful, clik on my KUDOS! "White Star" !
Jkersten1982
Advisor

Re: HP-Oneview 4.0 upgrade Issues

Kick of this topic., as I'm facing 3 issues with another Oneview environment (on another location) from 3.x to 4.00.07.02. Had a lot of expired ILO certificates (15), this issue is resolved by reset the ilo to factory defaults, re-add the ip-address etc again and update the certificates in the store in OV.

1.  a lot of 'leaf certificate with alias name 'xxx' is expired. I can't remove these alerts myself, they are locked in 'Active Alerts'

2. CA certificate with alias name xx is expired. Can i see somewhere if this CA Certificate is still being used by some device?

3. Alert 'The appliance certificate does not have 'Client Authentication' in its Enhanced Key Usage field which is required for OneView to communicate to an iLO that has two-factor authentication mode enabled.' Where can I change this or resolve this behavior?

KSM1
Advisor

Re: HP-Oneview 4.0 upgrade Issues

I just installed version 4.00.09 and after thast the certificate problem was gone.

Now i just have to figure out how to get a leaf certificate, but the critical error is gone.

Best Regards
Kenneth
ChrisLynchHPE
Neighborhood Moderator

Re: HP-Oneview 4.0 upgrade Issues

Glad to hear the 4.00.09 patch helped fix the critical error.  The leaf certificate is the iLO cert.  As long as it is being managed, and no further errors about the certificate have been reported, the cert should already be trusted within the appliance certificate store.

ChrisLynchHPE
Neighborhood Moderator

Re: HP-Oneview 4.0 upgrade Issues


@Jkersten1982 wrote:

Kick of this topic., as I'm facing 3 issues with another Oneview environment (on another location) from 3.x to 4.00.07.02. Had a lot of expired ILO certificates (15), this issue is resolved by reset the ilo to factory defaults, re-add the ip-address etc again and update the certificates in the store in OV.

1.  a lot of 'leaf certificate with alias name 'xxx' is expired. I can't remove these alerts myself, they are locked in 'Active Alerts'

2. CA certificate with alias name xx is expired. Can i see somewhere if this CA Certificate is still being used by some device?

3. Alert 'The appliance certificate does not have 'Client Authentication' in its Enhanced Key Usage field which is required for OneView to communicate to an iLO that has two-factor authentication mode enabled.' Where can I change this or resolve this behavior?


  1. The 4.00.09 update will help fix this issue.
  2. Unfortunately, not today.
  3. You need to validate in your Cert Authority template that it will  create a certificate with both "Server Authentication" and "Client Authentication" Ehanced Key Usage proerties when issuing the certificate.  If you are using Microsoft Certificate Authority, these ehance key usage properties are standard in the Web Server template.
Jkersten1982
Advisor

Re: HP-Oneview 4.0 upgrade Issues

Hmm didn't notice .09 was released; will try to upgrade the OV to this version this weekend or next week, and let's see what happends than. Still working to fix the issue(s), out of the blue, there are some servers complaining now about; the following. Strange thing is, the certificate is valid, so I don't expect these messages at all.

Unable to establish trusted communication with the server. The iLO certificate does not have any IP address or host name specified.

The certificate has a hostname, so i have to figure out why this error is happening and howto resolve this.

 

Jkersten1982
Advisor

Re: HP-Oneview 4.0 upgrade Issues


@ChrisLynchHPE wrote:

 


  1. The 4.00.09 update will help fix this issue.
  2. Unfortunately, not today.
  3. You need to validate in your Cert Authority template that it will  create a certificate with both "Server Authentication" and "Client Authentication" Ehanced Key Usage proerties when issuing the certificate.  If you are using Microsoft Certificate Authority, these ehance key usage properties are standard in the Web Server template.

Thanks! Will give it a try later. Maybe my issues what I'm facing now is also resolved when upgrading to 4.00.09. Will let you know.

Jkersten1982
Advisor

Re: HP-Oneview 4.0 upgrade Issues

This morning, I have deployed update 4.00.09 to resolve 2 issues.

After the upgrade the 2 errors are still displayed in Oneview:

1. 'Leaf certificate' with alias name <hash> is expired

2. 'Unable to establish trusted communication with the server. ILO certificate does not have any IP address or host specified'

Is there something what we can do to remove the alerts?

Thanks!

KSM1
Advisor

Re: HP-Oneview 4.0 upgrade Issues

I found this interiesting document here https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-a00041655en_us&docLocale=en_US, my issue is that the date validation from to is reversed.

I tried to follow a link in the file, but it took me to an HPE site where this file does not exist.

this is the link https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c03743622

is there a solution to this?

Best Regards
Kenneth
John Bigg
Esteemed Contributor

Re: HP-Oneview 4.0 upgrade Issues

KSM1
Advisor

Re: HP-Oneview 4.0 upgrade Issues

@Jkersten1982 I was able to fix the Certificate problem, all it took was to reset the ILO to default and then set it up again with the correct ip and so on, then the certificate was renewed with correct from - to date and all went green again :)

hope this will help you to solve your issue.

Best Regards
Kenneth
Jkersten1982
Advisor

Re: HP-Oneview 4.0 upgrade Issues

@KSM1 yeah I know, I have corrected it for the Gen8 machines. for Gen7 machines I can't get it fixed. Certificate has a correct date (start 2018/end 2033), but the error still remains.

And second, the error starting with 'Leaf certificate' is still displayed as a critical alerts. I still can't remove the error myself.