Adding a signed SSL certificate to the Nimble GUI

[aprice119]

Hi all.

We're just getting our new Nimble finished up and deployed and I was wondering if anybody had any insight into how to add a signed SSL certificate to the Nimble GUI.  I'd like to make the connection trusted and secure rather than adding exceptions to my browser.

Thanks!

[benwatson87]

I, too, have wondered this. Unfortunately I can't offer you a solution, but hoping someone can post one (I'm piggybacking on your question mainly).

[#3]

Bump - Looking to see if there is anything new on this.

[aprice119]

I decided to ask support about this since it looks like there's community interest, but no answer.  As of right now, there is no way to add a custom SSL certificate to a CS-series array.  It's in the development queue as RFE #368, so it's being explored.

[Nick_Dyer]

I believe this is something that is slated for release in the future (although unsure of the timeframes of it personally).

[marktheblue45]

This is feature that will be required for PSN (UK Public Services Network) for Compliance. I've just minted VCentre certs using Active Directory Certificate Authority but once the Nimble VCentre plugin is installed I get those annoying security warnings. Hopefully someone will get the procedure to do this shortly. Looks like RFE #368 has been in the to do list for a while now.

[Daniel-san]

It's pretty unbelievable that a publicly-traded company would bring a product to market without a signed SSL cert.  I still have no idea who jetty.mortbay.org is - sounds like a cert for a project that someone started in their garage.  Nimble support confirmed that they have multiple RFEs to fix this and many people have requested they do - yet they still can't say WHEN they'll do it.

But whatever, until Nimble gets this properly implemented, here is a workaround you can use:

1. Open IE as "Run as Administrator".
2. Navigate to Tools > Internet Options
   > Advanced tab > Deselect the following under Security:
   * Check for publishers certificate revocation
   * Check for server certificate revocation*
   * Warn about certificate address mismatch*
3. Navigate to the Array UI, go past the security warning, in the login page the address bar has a red box next to it which says Certificate Error. Double click it and install the certificate in the Trusted Root... folder.
4. Close and open IE and navigate to Array UI. (no security error should be displayed now)

[aprice119]

You're right Daniel, it is very odd that the issue hasn't been addressed yet.  I know when I added my particular feature request I was contacted by the PM team to discuss what kind of options I would want to see for SSL certificate management (import a PFX?  send an online certificate request?  upload private key and certificate files?) but nothing has yet come of that conversation.

To address a couple of your points:

jetty.mortbay.org is an old reference to the original creators of Jetty, MortBay.  Jetty is the Java-based web and servlet server from Eclipse that Nimble uses to offer up it's interface.  The built-in self-signed certificate is a Jetty default.

Your workaround does clear the IE warning but it also disables some critical checkpoints for validating SSL certificates in the entire browser.  IE doesn't provide a method to exempt a certificate on a particular site or for that exact cert, but Firefox does.  I use Firefox for most of my admin work now anyway, and it's especially nice since I can tell it to make the Nimble's exception permanent (but only until the certificate in the Nimble changes, or I change the DNS alias of the array).  I do the same thing with some other picky systems, notably VMware and Cisco.

I was hoping to see the SSL certificates fixed in NOS 2.0 but alas, 'twas not to be.  Hopefully sometime very soon, especially for those prospective customers who HAVE to have a signed cert for compliance reasons (like Mark Harrison).

Alan

[kent106 · Accepted solution]

A couple of points:

1. The 2.1 release has code that generates a new self-signed certificate chain on group setup that replaces the mortbay certificate for use by the webui. There is a CA certificate and a host certificate that contains the group and array FQDNs, as well as management IP addresses. The certificates generated are also stronger than the mortbay one, using 2048 bit RSA keys and SHA hashing..

2. There is a mechanism whereby customer generated certificates can be installed on an array with the aid of Nimble support. These certificates will now survive a software upgrade, which was previously not the case.

3. Adding the capability to create a CSR, get a signed certificate from the customer's CA, and import it is on the roadmap. We may also support automating the process that support does manually now to import the keys and certificates, and install them.. I can't say when this will be released.

The reason this has taken so long, by the way, is that the demand for the feature is relatively small. We have a support-assisted solution, cumbersome as it is, and the burden on support to do this when requested has been negligible.

Kent

[nick_caldwell]

Thanks Kent for the info. Browsers are going to get more and more annoying about untrusted certs, and some are talking about not letting someone go to a site at all if it doesn't have a good cert, so this issue may come up as a bigger problem quickly. Hopefully we can get a solution in to the GUI before then.

[rbutterworth54]

Any update on this?  I can't add my admin page to my Okta SSO system due to the certificate warnings. 

[aprice119]

Hi Rob.

There remains no way to do this as an end-user but you can open a support ticket and have them assist you.  NOS was updated a few months ago to prevent it from erasing custom SSL certificates during an upgrade.  With support's help you can load your own and it will persist.  Also, the support ticket will help continue to show that there is customer demand for this feature.  I need to open a ticket myself to get one installed.

Alan

[txhookem2]

Bumping for an update.  Are we any closer to being able to do this ourselves?

[Nick_Dyer]

Hi John,

NimbleOS 3.0 is slated to have this feature, although no set timeline on release just yet.

[PeterMu]

nice...what else can you tell us about possible features of 3.0?

[Nick_Dyer]

Nothing to mention as of yet in a public forum; i'd expect more news / information on 3.0 in the next couple of months.

[Jacob_Wilde]

The other recommendation I would suggest is that anyone interested in having this feature released open a ticket with support asking they be added to RFE #368, the more people that Nimble knows want this feature the higher it'll get prioritized.

[ENVOY]

Welp, it's been 4 years since this topic was last updated and Nimble OS is now well into the 5.x's. Yet this is still one of the very first search results I get when looking for installing a custom SSL cert on the Nimble OS Web UI.

Any update here? Or did this really get marked as "Solved" based on a response that essentially boils down to "our support team isn't sufficiently burdened by these requests, therefore we won't let you do it yourself"?

Is this thing on? 

Just kidding - found it. FYI the guide at that link is using a MS Active Directory environment and CA to generate/issue the cert but you should be able to apply the directions provided to any cert vendor who takes a CSR.

[EliteX2Owner]

Hard to believe seven years later this is where we're at currently.  Even the antiquated interface of APC PDU's lets you upload a certificate.  The way Nimble OS handles it, staff have to go through the time wasting pain of going into each array, generating a new CSR, taking it to a real authority to sign, do the email or dns validation, wait for it to be issued, cut/paste, move on to the next.  It's even worse now that cert issuers have dramatically reduced the length you can purchase.  We have wildcard certs to solve this problem, which all of our other infrastructure hardware is happy to accept, but then there's Nimble...

[Nick_Dyer]

Hello,

We've done some significant enhancements to security within NimbleOS 5.2 (available now as GA Candidate)...

I've personally not had a chance to test this out yet....

Take a look at Page 170 of the NimbleOS 5.2 Admin Guide for more information.

[ENVOY]

Well look at that! Thanks for the update Nick.

And to think I was getting ready to write off 2020 altogether...