Recreate SMH Certificate for SIM

[T. Rectenwald]

Is there a way to recreate the certificate used by SMH (/etc/opt/hp/sslshare/cert.pem)? I have 100's of servers with the incorrect certificate copied over from a common Ignite image.

I need these to be correct so that I can import them into SIM (Options|Security|Certificates|Trusted Certificate), thus establishing a correct SSL certificate trust between SIM and SMH.

As of now, the only way I know how to do it would be to uninstall SMH, ensure that the certificate is deleted and then reinstall. That is a very time consuming process though, and I have several hundred systems to correct.

Thanks for any help or advice.
Tom

[marsh_1]

TOM,

if the target systems are hp-ux then the configure or repair agents option can be used to deploy a certificate.


good luck

[T. Rectenwald]

Thanks for the help. The trouble is, when you run configure/repair the job actually deploys the SIM server certificate to SMH. In addition, it installs a certificate for WBEM in /etc/opt/hp/sslshare/cimserver_trust.

It doesn't change, or modify the client's SMH certificate though (/etc/opt/hp/sslshare/cert.pem (and file.pem (private)).

I'm fairly certain that cannot be done in SIM. It doesn't appear that it can be done within the SMH GUI either. Perhaps it needs to have an openssl command run.

I guess this is more of a SMH question than SIM one; didn't know which forum to post to.

My thoughts are that I may be able to remove the certificates and have them recreated by running an swconfig with the reconfigure option set. I've also noticed that, after SMH is upgraded, new certificates seem to be generated in /var/opt/smh/sslshare. Those appear valid (as the upgrade was done outside of the initial Ignite image).

I'm going to poke at it some more and will post my findings. Thanks again for the help.

Regards,
Tom

[Derek_56]

Tom,

Yes, if you're talking about regenerating client SMH instances' certificates, then I believe you'll need to reinstall the SMH on each system. According to the HP SMH User Guide, that is autogenerated at installation. I cannot find any documented method of regenerating this once it's installed. Sorry.

[Gladiator]

Hi,

There is one more unorthodox away to recreate the SMH certificate.

Just stop SMH service.
Goto /etc/opt/hp/sslshare/ and delete cert.pem.
Now restart SMH service.

It will automatically create a new SMH certificate i.e cert.pem file.

This should work fine though.

Regards
Sinto

[T. Rectenwald]

I didn't have much luck with certification regeneration when stopping/starting SMH. I did manage to find that whenever SMH is upgraded, it appears to generate new certificates and stores them in /var/opt/hpsmh/sslshare. If I just copy these into place over the ones in /etc/opt/hp/sslshare that works okay (haven't tested fully yet, but they import right).

So, it looks like I can get away with doing the above, as SMH has been upgraded on all systems since the initial Ignite installs.

A reinstall works also; while non-intrusive (no reboot) it does take some time.

Anyway, thanks all for the help. If I can figure out anymore, I'll let you know. May take a look at the configure script and see what the openssl command is that it uses; not much of an expert with that.

Regards,
Tom

[Kasper Haitsma]

Hi Tim,

I ran into the same issue.
I discovered there is tool to do this:

/opt/wbem/sbin/gen_wbem_certs

you need to stop cimserver (cimserver -s), you'll be warned if cimserver is still running.
gen_wbem_certs
start cimserver (cimserver)

works like a charm

regards,
Kasper Haitsma