Creating CSR in IM7, SP2

[Patrick Murphy_2]

I need to order an SSL cert from Verisign for our IM7 server, but I have a problem. The CSR that IM is creating lists Hewlett Packard, Houston, Texas as the company information. Verisign won't accept this, since it's not the name or location of our company. Also, it's listing the FQDN of the server as "CIM7SERVER" instead of "cim7server.company.com". Where can I change this info so the cert request can go though? Thanks!

[MC1903]

Good luck with your quest.....

I have tried to implement this feature in the past and have failed miserably!

It seems that whoever developed this feature was arrogant enough to think only people in HP/Houston would ever need a third party signed certificate!

I was on an IM7 course a few weeks back and the HP trainer could not answer this question either! He asked his support for help, but all we received was a stock reply of read the PDFs/etc.

I have searched the SQL database tables & config files to see where these CSR default values are stored and have found nothing. I can only guess that they are hard-coded into the application.

I have given up for the moment and perhaps the new version of IM (Nimbus) will have better support for this feature.

Is there anyone from HP who would care to offer any words of wisdom regarding this???

All the bestâ ¦â

[David Claypool · Accepted solution]

This was fixed a while ago but not widely publicized. Find it in SP21908 in the directory ftp://ftp.compaq.com/pub/softpaq/sp21501-22000/ on the ftp site.

With this, you can create certificate requests and specify organization and organizational unit. From the README.TXT:

EADME for MXCERT.EXE
---------------------

This executable needs to be placed in the directory where Insight Manager 7
is installed.

To create a certificate request file, run the following command:

mxcert createCSR -dracomakestore servercertificate -o "Organization name" -ou "Organizational Unit"

where:

"Organization Name" = the name of the organization as you want it to
appear in the certificate.

"Organizational Unit" = the name of the Organizational Unit as you want
it to appear in the certificate.

Both the -o and -ou options are optional. The command line parameters are
case sensitive.

After running mxcert, the CSR file "certreq.p10" is created in the same
directory. This file will be the certificate request that you need to
submit to the Certificate Authority.

[MC1903]

David,

Can you tell me how:

1) I should format the OU details to include Country,State,etc...?

2) Are there any other fixes that fall into the *This was fixed a while ago but not widely publicized* category?

3) Is there a published definitive list of SP's for IM7?

4) Finally, do you know if Nimbus will have this feature from day 1?

Cheers

Martin

[David Claypool]

1) I should format the OU details to include Country,State,etc...?

We call the Java/Sun applet 'keytool' to do the work for us. Documentation on keytool can be found at http://java.sun.com/j2se/1.3/docs/tooldocs/win32/keytool.html.

Keytool uses a slightly different syntax than mxcert, but we pass all the parameters to it, so I did a little playing around and you can pass locality, state and country with the -l, -s and -c parameters respectively. (I did not try CN for common name)

2) Are there any other fixes that fall into the *This was fixed a while ago but not widely publicized* category?

No, not that I know of. :) This one has only become an issue once before that I know of (discovered by a customer which led us to the MXCERT solution). Surprisingly, there are very few PKI implementations out in the installed base, or perhaps they aren't extending PKI to the IM7 application.

3) Is there a published definitive list of SP's for IM7?

In the "Support & Drivers" section of hp.com is the 'reference library' at http://h71025.www7.hp.com/support/home/selectproduct.asp?destination=reflib

Select 'management' --> 'management software' --> 'Insight Manager' in the 3 panes. This will display all service notifications, the FAQ and all of the pertinent whitepapers.

4) Finally, do you know if HP Systems Insight Manager will have this feature from day 1?

'MXCERT' was kind of stolen from the future. In other words, we solved the problem for IM7 by stealing it from the development of HP Systems Insight Manager.

[MC1903]

David,

Fantastic - lots of real good IM7 info... Many many thanks!!!

I would love to award you points for your help, but as did not start the thread I cannot... Patrick would you add them on my behalf?

Cheers

Martin