OneView Alert: CRL issued by VeriSign Class 3 Public Primary Certification Authority - G5 is expired

[David Claussen]

OneView Appliance for vSphere, version 4.00.07.02-0334467.

Why is OneView so incredibly difficult to work with?

My latest problem is the following error:

So I copied the URL for the cert and it downloaded fine. 

Now, I tried to get this new cert into my HPOneView appliance. Security/Manager Certificates/Add Certificates

After an hour of searching, I can find no way to open the CRL files and get the base64 cert text and there is no option to inport a local file.

So I try Add certificate from an IP address or hostname:

Entering the url provided by the initial alert FROM ONEVIEW yeilds the error:

I tried multiple ports as well with no success.

Now I have been fighting with OneView for months now - configuration issues, update issues, alerting issues (IE - seven alerts for a server reboot - this is a total nightmare and there is no documentation anywhere for help) and now this cert thing.

Any help is appreciated, but this is strike 27 for this software and if I can't get this cert thing cleared up - OneView is gone and I'll go back to SIM.

[Nikolape]

I have the same problem with our Synergy frame, and could not agree more with previous post. Please, any help would be appreciated! 

The question is simple, how to import missing .crl file?

Thank you.

[frenchy94]

this issue is well documented in release notes i think


---
L'absence de virus dans ce courrier électronique a été vérifiée par le logiciel antivirus Avast.
https://www.avast.com/antivirus

[Dennis Handly]

I'm not sure why you want to get a CRL?  The Certificate Revocation List contains a list of certs that have been revoked.

I only see a Last Update and Next Update fields.

You need to create new certs to replace the expired ones.

> I tried to get this new cert into my HPOneView appliance. Security/Manager Certificates/Add Certificates

I'm not sure why it would need you to add a CRL?

>  I can find no way to open the CRL files and get the base64 cert text and there is no option to import a local file.

You can open the .CRL in Windows.  Or use:

openssl crl -inform der -in pca3-g5.crl -text -noout

So I would suggest you look for expiration dates for your certs and CA certs.

Unless it's related to you can't access the CRL?

https://github.com/HewlettPackard/POSH-HPOneView/issues/97

[David Claussen]

It is not. There are references to CRL files in both the release douments and the user manual, but nowhere does it show how to istall/import a CRL file.

[David Claussen]

As you can see in my inital post, the CRL file is what my OneView shows as expired - that is why I would assume that I need to replace it. 

[Dennis Handly]

> the CRL file is what my OneView shows as expired

Hmm, except the date fields in a CRL don't have "expired" in them, just "next update".

[David Claussen]

I don't know how much clearer I can get than this screen shot directly from my HPOneView appliance:

[David Claussen · Accepted solution]

Well I give up. No help for the CRL issue, no help for the impossible alerting configuration and no help for the LDAP cert issues. Six months wasted on the software. It is too bad really, the appliance is good, but no support is a deal breaker. I will go back to HP SIM.  OV appliance powered off and deleted.

Funny, I'm sure that if I was using the paid version of OneView, help would be in abundance.

Thanks HP.

PS: HP SIM will be in production for a quite a while. I spoke to an HP tech about SIM's EOL and he said that because there are so many customers still using servers below G7 - they have to keep is going. True or false, who know this is HP.

[John Bigg]

To upload a CRL file, go to Settings -> Manage certificates and then click on the little green pen icon on the certificate where the CRL is expired. You can then either drag and drop the CRL file you downloaded or browse to it in order to upload it.

Note that the CRL file takes effect immediately, although it can take up to an hour for the manage certificates page to show an OK state rather than CRL Expired.

[Todd_Bowden]

John,

Im in total agreement with the person who started this thread.  OneView is so quirky, getting these obscure error messages.

I have tried to upload this .CRL file and stupid OneView says, I need a .CRL file

[Todd_Bowden]

Here is the fix, delete the CRL that it is complaining about, in this case "VeriSign Class 3 Public Primary Certification Authority - G5"

I found a Symantec website that you can copy and paste the key to put it back in.

https://knowledge.symantec.com/support/mpki-for-ssl-support/index?page=content&id=SO5624&actp=LIST&viewlocale=en_US

Just copy and paste the key, and BOOM, all is well.

Hope it helps

[Dennis Handly]

> I don't know how much clearer I can get

The problem isn't you, it's in the message.  :-)

CRLs don't "expire".  And the message doesn't say how to fix it, AFTER you get the CRL from the web.

Is your appliance connected to the Internet?

[John Bigg]

Todd, I believe that the issue you saw with OneView reporting that a .crl file is needed even when a .crl file was selected is a known issue with certain versons of Firefox. Try using a different browser and you shouldn't see this and the crl file should work.

[Lionel_Jullien]

The best is to use a PowerShell script using the OneView library so that you can automate all the process.

See https://github.com/jullienl/HPE-Synergy-OneView-demos/blob/master/Powershell/OneView/Update%20all%20existing%20OneView%20CRLs.ps1

This script updates all existing CRLs present in Oneview identified as expired.