Unable to establish trusted communication with the server -> HPE OneView 4.00.07.02

[MarioE]

Hello

I upgraded HPE OneView from Verion 4.00.07 to 4.00.07.02.
Since I have installed this update .02, I receive about 20 messages every day:

Unable to establish trusted communication with the server. The iLO certificate does not have any IP address or host name specified.

Some of these alarms are "Locked".
When I do a refresh of the server, the alarm is mostly cleared again. Sometimes I have to do the refresh 2 or 3 times.

However, most alarms will be cleared right away:

I only have ProLiant DL Server in the HPE OneView. This error I have over all servers (G7, Gen8, Gen9) with all iLO FW versions and over again. Only with the Gen10 servers I do not have this problem.

Does anyone else have this problem?

[peyrache]

Only update ? nor Ilo Ip address change ?

[MarioE]

I only did the updates of the HPE OneView. Before the update, I had never seen this error. I did not make any changes to the iLOs.

[peyrache]

Shall you post exact error message (complete screen)
Thanks

[MarioE]

Unable to establish trusted communication with the server. The iLO certificate does not have any IP address or host name specified.

Resolution Ensure that the iLO is set up with a certificate that has a valid ip address or host name specified. After setting up iLO with the certificate as specified, in case of a CA signed certificate, ensure that the root certificate and the appropriate intermediate certificates are present in OneView's trust store. In case a new iLO self-signed certificate was generated to correct the issue, add the same into OneView's trust store. Refresh the server and retry the operation. Use the link provided below to add certificate(s) to OneView's trust store.

Event details
certificateMismatch true
clearPriorEvents true
correctiveAction Ensure that the iLO is set up with a certificate that has a valid ip address or host name specified. After setting up iLO with the certificate as specified, in case of a CA signed certificate, ensure that the root certificate and the appropriate intermediate certificates are present in OneView's trust store. In case a new iLO self-signed certificate was generated to correct the issue, add the same into OneView's trust store. Refresh the server and retry the operation. Use the link provided below to add certificate(s) to OneView's trust store.
locked     true
resourceUri   /rest/server-hardware/32333536-3030-5A43-3234-323730484452

[peyrache]

Should be related to:
https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-a00042194en_us&docLocale=en_US
or
Certificate expiration alerts reported during HPE OneView 4.0 upgrade

HPE OneView has a new certificate-related security setting: "Check for expiration of self-signed certificates". The setting is disabled by default. When disabled, a warning alert is displayed for any device with an expired certificate on the device's resource screen. For example, server hardware screen. Additionally, separate alerts for expired certificates are displayed on the Settings > Activity screen.

After HPE OneView 4.0 upgrade, under certain circumstances, warning alerts for expired iLO certificates are not displayed on the corresponding server hardware screen. Note that any server hardware warning alerts will be displayed on the Settings > Activity screen.

The certificate expiration alerts displayed on the Settings > Activity screen are created incorrectly as critical, locked alerts (red alerts) instead of warning alerts.

Suggested action

Communications with devices is not impacted by these specific critical alerts. Both warning and critical alerts are cleared automatically when the corresponding expired certificates are fixed. The certificate alert can be fixed by either generating a new self-signed certificate for the device and placing that in the HPE OneView certificate trust store or by performing a certificate signing request and using a certificate authority-issued certificate for the device. For more information on regenerating iLO certificates, see Correcting expired certificates for an iLO.

[MarioE]

I have no self-signed certificates. All iLO certificate are Trusted SSL Certificate signed by our Certification Authority (CA).
All certificates are valid and have not expired.

[peyrache]

So the best is to open a case to HPE support
For Oneview dump analysis

[ChrisLynch]

If you have not already, please add your Issuing and all chain CA certs to your appliance.  Please see this help link about this topic and to navigate other supporting documentation.

[ChrisLynch]

Just as a quick follow up, 4.00.07.02 was only released to address an SNMPv3 issue with Gen10 and the recently released iLO 1.20 firmware.