iLO 5 Custom SSL Certificate - Is it possible to load certificate and key generated by your own

[ay_jay]

I see the option to generate a CSR, and another to import a certificate, but we have our own trusted CA who generate certificates and we typically create certificate bundles with the root and intermediate.  We need to add certificates to our iLO 5 hosts and the certs with their respective keys have already been generated.  How do I upload them to iLO?  Is there a step by step guide for this, and will this be disreuptive to the server/ESXi traffic?

[Torsten.]

ILO user guide has all the steps.

Importing a trusted certificate
Prerequisites
Configure iLO Settings privilege
Procedure
1. Click Security in the navigation tree, and then click the SSL Certificate tab.
2. Click Customize Certificate.
3. Click Import Certificate.
4. In the Import Certificate window, paste the certificate into the text box, and then click Import.
iLO prompts you to confirm the request and reset iLO.
5. Click Yes, apply and reset.
iLO imports the certificate, and then resets

[auscop]

This does not answer the OP question. He is asking can an already generated key be uploaded. So the private key would need to be replaced as well so it matches the public key. I have the same issue, I have over 1000 iLO4 and iLO5 interfaces. I have a wildcard certificate generated from our CA. I need to be able to upload it plus the matchng private key in to iLO. It is not practical to have to manually generate over 1000 CSRs, and have them submitted to our CA to create over 1000 different public keys. Can this be done?

[Grimy]

Hi mate, any luck with this?

I attempted to paste in a combined -----BEGIN PRIVATE KEY----------BEGIN CERTIFICATE----- via the gui but no deal.  About to try the commandline route....I've got aboutttt 550 servers to sort

[auscop]

Sorry Mate, no luck. Have have not tried much after I posted. By what I can tell it is not possible without some type of hackery. I don't see anyway to access the private key in the normal manner. Using ssh straight to the iLO I looked everywhere for a private key and couldn't find it. Even if it was viewable then I would not know how to write over it.  I have tried messing with hponcfg and hpilo_cli tools and neither will accept private key as a variable.  My guess the lack of response from HP to my post means they don't want to admit it is not possible at the moment. Why developers would think we would be happy to create 100's or 1000's of separate private/public key pairs makes zero sense. And given all my servers have zero internet access doesn't help. 

[SanjeevGoyal]

Hello,

You can refer user guide as well : https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=a00105236en_us 

Symptom

User authentication fails when iLO is configured to use Active Directory.

 Cause

There is a certificate problem:

• An SSL certificate is not installed on the Active Directory server.
• An old SSL certificate on the Active Directory server points to a previously trusted CA with the same

name as the CA in the current certificate. This situation might happen if a certificate service is added

and removed, and then added again.

You can verify this cause by checking the SSL Connection test results on the Directory Tests page.

 Action

1. Open the MMC.
2. Add the certificates snap-in.
3. When prompted, select Computer Account for the type of certificates you want to view.
4. To return to the Certificates snap-in, click OK.
5. Select the Personal > Certificates folder.
6. Right-click the folder and select Request New Certificate.
7. Verify that the Type is domain controller, and click Next until a certificate is issued.

Connect using SSL test reports a failure

Symptom

The Connect using SSL test reports the status Failed.

Cause

The SSL handshake and negotiation between iLO and the directory server were unsuccessful.

Action

• Enable the directory server for SSL negotiations.
• If you are using Microsoft Active Directory, verify that Active Directory Certificate Services is installed.

Please feel free to contact me if you have any further questions or concerns.

If you feel this was helpful please click the KUDOS! thumb below!   

Regards,

[Moderator edit: Updated the broken link.]

[scottwichall]

This post is completely irrelevant.

We wish to know how to upload our own certificates and private keys to iLo so we dont have to generate potentially thousands of certificate requests (for those with big estates)

Funny how your biggest competitor can manage this with a 3 simple RACADM commands isn't it.

[Grimy]

True that  

[Tono11]

As appointed, completly unuseful answer.

I have the same problem. I cannot generate the certificate from a crt made in the ILO server. I need change the certificate AND de private key. My company doesn't give me a certificate if I don't generate the private key myself.

Please let us know how to change the private key AND the certificate.

[Adis_S]

As far I know, it is not possible to upload Private Key to iLO5 (or older). We have an two feature requests ongoing, one for this issue, and one for CSR request over iLO or PowerShell iLO cmdlets to add EMail Attribute. If more ppl requests this over their HPE Contacts, maybe this would be implemented in future.

Also some information which we find as wrong in Documentation and are now fixed:
* iLO4 have the limit of 3k for Certificates  3k Limit <- not posible to extend because of Hardware limitation
* iLO5 have 16k limit for Certificate <- so here could be posible to store private key and certificate to.

As workaround to your problem, you could use PowerShell and iLO cmdlets to do bulk CRS requests and then also to automate sending to internal CA for signing with certreq.exe and also for retrieve.