Primera 4.5.11

[Scott Caryer]

I am trying to add SSL certificate to my Primera arrays. I was able to setup LDAP, and add my domain CA cert. However, I do not see where or how I create the CSR to submit to my CA for a Cert. Please advise...Thanks, Scott

[Satish04]

Hi Scott Caryer,

Follow the below steps to generate and install the SSL certificate for HPE Primera storage:

1. Login to the HPE Primera User Interface using the IP address of the HPE Primera Storage.
2. Select "Settings" from the main menu, and click on "Array Certificates".
3. Select the "Create" (+) icon at the top right corner. Enter the required information and click on "Add".

Hope this helps.

Regards,
Satish

[Dardan]

Hi Scott,

Below a step-by-step procedure: https://www.storcom.com/implementing-ca-certificates-on-primera-ui/

Hope this helps.

Dardan

[Scott Caryer]

@Satish04 Awesome!

Thanks Satish. Since I am getting a cert from my windows CA, what should I select for the "Array Service"? I am not familiar with the CIM, CLI, ekm-client, etc selections...

It always looks like I am forced to use a SAN as well...interesting...

I am getting the below error message regardless of which Array Certificate selection I use:

Error: unable to create CSR extension X509v3 Subject Alternative Name with value PRIM-COLO1,PRIM-COLO1.HCBOCC.AD.

Thanks in advance, Scott

[Scott Caryer]

Hello Dardan, Thanks for the link. I get the same error message when I try it from the CLI. Oh welll....

[Satish04]

Hi Scott Caryer,

The error message is saying that you are having an issue creating CSR (Certificate Signing Requests) for your HPE Primera array. There is a problem with the value you are trying to set in the X509v3 Subject Alternative Name field.
The correct Subject Alternative Name (SAN) value must be specified carefully to resolve this issue. Additional host names and IP addresses may be specified in the SAN field beyond the HPE Primary common name (CN) of the certificate.
Your SAN values in your certificate will be "PRIM-COLO1" and "PRIM-COLO1.HCBOCC.AD", and when creating the CSR, make sure that you enter these values correctly.
A certificate's "Array Service" should also match its purpose. In case you are not sure, consult the documentation for your HPE Primera array or contact HPE support for guidance.

Hope this helps.

Regards,
Satish

[Scott Caryer]

@Satish04 Great feedback Satish,

It is interesting that the SAN field is actually required to have information entered. Typically, the SAN is an optional value when I generate any other HPe related certs. Regardless, I have tried adding excatly what you suggested and used a comma with no spaces. I then tried the same information with a space after the comma. I keep getting this same error message. 

I am not sure what you are indicating with your below statement: 

A certificate's "Array Service" should also match its purpose. In case you are not sure, consult the documentation for your HPE Primera array or contact HPE support for guidance. 

I am simply trying to create a signed cert against my Window Domain CA which I have done countless times. So I am not sure which option to choose under the Array Service. I did review what the names actually mean from the documentation. However, the documentation does NOT spell out which one I should use to simply sign a cert against my Windows Domain CA. 

Thanks, Scott

[Satish04]

Hi Scott Caryer,

You have to select the WSAPI (Web Services Application programming interface) for the "Array Services".

Please refer to the below link for the same.

URL - https://support.hpe.com/hpesc/public/docDisplay?docId=a00114827en_us&docLocale=en_US&page=GUID-9C5EC999-3AE5-477B-8B79-55230626DF7B.html

Hope this helps.

Regards,
Satish

[Sunitha_Mod]

Hello @Scott Caryer,

Let us know if you were able to resolve the issue.

If you have no further query and you are satisfied with the answer then kindly mark the topic as Solved so that it is helpful for all community members.