HPE Community
ProLiant Servers (ML,DL,SL)
1825045 Members
3037 Online
109678 Solutions
New Discussion

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

 
AlexPotter
Advisor

‎02-23-2023 11:47 PM - last edited on ‎02-24-2023 12:09 AM by

‎02-23-2023 11:47 PM - last edited on ‎02-24-2023 12:09 AM by

Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

Just wanted to let everyone know the automatic certificate enrollment using Microsoft NDES (SCEP) server doesn't work (despite documentation says it is supposed to). At least on the current 2.78 iLO. Don't spend time trying to get it working. Dissapointed with HP. Works perfectly with with Dell iDRAC.

0 Kudos
Reply
14 REPLIES 14
techin
Valued Contributor

‎02-24-2023 12:00 AM

‎02-24-2023 12:00 AM

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

@AlexPotter ,

 

Did you check with HPE Support?

0 Kudos
Reply
AlexPotter
Advisor

‎02-24-2023 12:07 AM

‎02-24-2023 12:07 AM

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

I did. The answer was "It works in our lab so suppose to work". No details or explanations how they managed to get it working. I have my environment configured as per MS standard and other devices are working fine. SO definitely problem with on HP side. 

0 Kudos
Reply
Suman_1978
HPE Pro

‎02-27-2023 11:28 PM

‎02-27-2023 11:28 PM

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

Hi,

May we know the error message you get during certificate enrolment?

Automatic certificate enrollment

NOTE:  This feature is not supported when iLO is in CNSA security state.

Disabling the CNSA security state

Thank You!
I work with HPE but opinions expressed here are mine.
Recent Support Video Releases



I work at HPE
HPE Support Center offers support for your HPE services and products when and how you need it. Get started with HPE Support Center today.
[Any personal opinions expressed are mine, and not official statements on behalf of Hewlett Packard Enterprise]
Accept or Kudo
0 Kudos
Reply
AlexPotter
Advisor

‎03-01-2023 08:47 PM - last edited on ‎03-02-2023 09:31 PM by

‎03-01-2023 08:47 PM - last edited on ‎03-02-2023 09:31 PM by

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

@Suman_1978 

2023-03-02_12-44-39.png2023-03-02_12-46-33.png

0 Kudos
Reply
Suman_1978
HPE Pro

‎03-02-2023 10:49 PM

‎03-02-2023 10:49 PM

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

Hi,

Please contact HPE Support and log a ticket to get this checked.

Thank You!
I work with HPE but opinions expressed here are mine.
Recent Support Video Releases



I work at HPE
HPE Support Center offers support for your HPE services and products when and how you need it. Get started with HPE Support Center today.
[Any personal opinions expressed are mine, and not official statements on behalf of Hewlett Packard Enterprise]
Accept or Kudo
0 Kudos
Reply
thutchings
HPE Pro

‎03-08-2023 08:03 AM

‎03-08-2023 08:03 AM

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

Is the certificate being supplied to the iLO using SCEP an intermediate cert? If so, then this is likely related to a known problem that is resolved in an upcoming iLO 5 firmware.



I work at HPE
HPE Support Center offers support for your HPE services and products when and how you need it. Get started with HPE Support Center today.
[Any personal opinions expressed are mine, and not official statements on behalf of Hewlett Packard Enterprise]
Accept or Kudo
Reply
AlexPotter
Advisor

‎03-12-2023 08:30 PM

‎03-12-2023 08:30 PM

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

Finally some useful info. Yes, you absolutely right - it is Intermediate sert. And I had support case open with support - they were useless, telling me "it is suppose to work because it works in our lab".

Thank you for your comment.

0 Kudos
Reply
drehstrom79
Advisor

‎09-19-2023 02:31 AM

‎09-19-2023 02:31 AM

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

We're just installing and configuring about 200 servers using HPE OneView. Of course I don't want to rollout every certificate manually. Is using an MS SCEP-Server with an intermediate certificate working with iLO 2.96 yet?

Regards
Stephan

0 Kudos
Reply
Sunitha_Mod
Honored Contributor

‎09-20-2023 11:32 PM

‎09-20-2023 11:32 PM

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

Hello @drehstrom79,

Thank you for posting! We would recommend you to create a new topic using the create a "New Discussion" button, so the experts can check and assist you further. 

0 Kudos
Reply
drehstrom79
Advisor

‎09-22-2023 04:53 AM

‎09-22-2023 04:53 AM

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

Hi,

I don't really see why I should create a new topic containing the exact same problem!?
Meanwhile I have my SCEP-Server working and can confirm that problems with iLO 2.96 are still the same. I also use an intermediate certificate and get the same error message as AlexPotter.

iLO-SCEP.JPG

I got about 200 servers to configure, so please HPE get going! Can't be that difficult if DELL got it working!?

0 Kudos
Reply
jnc277
Regular Visitor

‎10-02-2023 02:14 AM

‎10-02-2023 02:14 AM

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

Hi,

I have the same problem. Switching to http the wireshark trace says "Bad request" when sending: http://x.x.x.x/certsrv/mscep/mscep.dll?operation=GetCACaps

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd">
<HTML><HEAD><TITLE>Bad Request</TITLE>
<META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD>
<BODY><h2>Bad Request - Invalid Verb</h2>
<hr><p>HTTP Error 400. The request verb is invalid.</p>
</BODY></HTML>

 

0 Kudos
Reply
drehstrom79
Advisor

‎10-02-2023 02:47 AM

‎10-02-2023 02:47 AM

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

Hi,

I can confirm this. My wireshark-trace shows the exact same error.
Pretty disappointing that there is obviously no rush to fix this error by HPE. All in all I'm very displeased with HPE OneView. There are so many bugs and missing features. All my 200 servers are claiming security risks that are pre-configured ex factory as for instance
- Login for RBSU
- SNMPv1 enabled
- Password Complexity disabled
but none of them can be adjusted with the OneView template. If there is no real improvement over the next years we'll be forced to move to DELL...

0 Kudos
Reply
jnc277
Regular Visitor

‎10-02-2023 03:17 AM

‎10-02-2023 03:17 AM

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

Thanks for confirming.

Move to DELL - we will consider that as well.

 

0 Kudos
Reply
AlexPotter
Advisor

‎10-02-2023 03:20 AM

‎10-02-2023 03:20 AM

Re: Automatic Certificate enrollment using Microsoft NDES (SCEP) doesnt work

+1 with the same conclusion. Has already started migration.

0 Kudos
Reply
The opinions expressed above are the personal opinions of the authors, not of Hewlett Packard Enterprise. By using this site, you accept the Terms of Use and Rules of Participation.