Website's Security Certificate Error Page When Connecting to iLO1 & iLO2 through Internet Explorer 7

[Phong Lam]

Hello IT Professionals,

I am just wondering if someone have experienced this same issue and hopefully someone had resolved this problem before. The problem is that when I opened up Internet Explorer 7 and typed in the web address to one of my iLO servers (iLO1 or iLO2), this is even before the Logon page is shown up. It displays the following error message (red 'X' security shield) on the page:

"There is a problem with this website's security certificate.

The security certificate presented by this website was not issued by a trusted certificate authority.

Security certificate problems may indicate an attempt to fool you or intercept any data you send to the server.

We recommend that you close this webpage and do not continue to this website.

- Click here to close this webpage.
- Continue to this website (not recommended).
- More information."

When I clicked on "Continue to this website (not recommended)" link, it brought me to the logon page and I am able to log onto both of my iLO 1 & 2 servers without any problems. I have updated all of my firmware to the latest versions on both types of my iLO (iLO1 is currently at v1.92 & iLO2 is at v1.50) as of this writing. I have also tried Microsoft's support that is provided at this link:

http://support.microsoft.com/kb/931850

It is still giving me the same issue. I have also activated/installed the licensing for the "Advanced features". If someone had this same issue before or have any other possible solutions to this type of problem, please help.

Thank you very much in advance for your help!

[barnett chan]

After you install the certificate, then use the iLO dns name to logon to iLO. If you use the IP, the ip does not match the DNS name on the certificate, so you still get the warning.

[Phong Lam]

I always log on through DNS name, such as http://ilo-SERVERNAME or https://ilo-SERVERNAME. I even tried http://static_IPAddress. All give me same issue. Thanks for the help!

[KarloChacon]

hi

As far as I remember there is no way to avoid only if you get a real certificate and you have to install it I mean I real digital certificate from companies like VeriSign otherwise you have to press continue all the time

regards

[acartes]

Examine the certificate details and take a look at the certificate subject. This is the network name that is conflicting with the browser URL and causing the warning.

[R Smitty]

While I don't have a solution, I too have the same problem.

Utilizing the iLo Administration site, I generate a Certificate Request and export to my certificate authority. After approving and installting the certificate, I notice the Subject name is only https://.. and not the required FQDN to access the ilo. Therefore, accessing the ilo via the https:// warns me with the above mentioned security prompt.

This appears to be an issue with the certificate request generation, and I'm not knowledgeable enough to hack it apart with OpenSSL tools... any idea why the cert request tool isn't taking the full FQDN as the subject (as it should)??

[misterm]

I am having this same certicate error for all of my Laserjet P4014 printers. I do not have this issue for any my other HP models.
Is it a problem with the firmware?

[acartes]

This is not a problem with the firmware.

The devices (like iLO) that accept secured connections (SSL) exchange certificates with the client (browser). The certificates are part of the security exchange, and in part they help prove the authenticity of the site (i.e., not a trojan horse).

Your browser is reacting to the iLO certificate - it was issued by iLO to iLO, a self-signed certificate. This is suspicious to the browser, so it flags it and makes you decide whether to trust the site.

You have a few options
- accept and import the certificate
- allow it for the current session
- install a certificate that was issued by a trusted certificate authority (CA). (details on the iLO 2 Administration/Security/SSL Certificate tab)

The best practice would be to install certificates from a trusted CA.

[misterm]

I had accepted the certificate in the default location but that did not work. Here is how I did fix it.
1. Logged in to PC as a domain administrator. View Cert/Install Cert/Next/
2. Choose "Place all certificates in the following store'
3. Browse /ï Show physical stores. / Enterprise Trust/Group Policy / Next Finished.

[misterm]

Follow up: I discovered you can have the printer not require https but use http by going to Networking/Mngt. Protocals/ and unchecking the box that says: "Encrypt All Web Communications (not including IPP)

[Chuck O.]

Hello all,

We have a lab with >1000 ILOs, which are accessed during classes by students from a bank of Windows 2003 servers (via Terminal Services) on an isolated classroom network.

We wish to upgrade our Win2003 TS platforms to use IE7, but see the warning message as noted in this thread when connecting to the ILOs. Since these ILOs and systems are used for training delivery, we would prefer to not throw the students off with this warning every time they connect.

It is not practical for us to install valid "trusted root" certs onto each of the >1000 ILOs - likewise, installing the ~1000 non-trusted ILO certs onto each Win2003 TS system. Is there any way, on these isolated classroom Win2003 TS servers, to configure IE7 on the systems to accept "all certs issued by HP" (as the ILO certs are) as "trusted root" certs? I believe this would be the cleanest solution for our classroom/lab environment, but being cert-challenged, I'm not sure if it's possible.

Many thanks, Best regards,

-Chuck O.

[kbnet]

Hi all:

You can sign your certificates for iLO with a self generated CA which you import in all browsers. Unfortunately it doesn't solve the problem because the CSR does not consider the FQDN.

[anthony11]

---

@acartes wrote:
This is not a problem with the firmware.

The devices (like iLO) that accept secured connections (SSL) exchange certificates with the client (browser). The certificates are part of the security exchange, and in part they help prove the authenticity of the site (i.e., not a trojan horse).

Your browser is reacting to the iLO certificate - it was issued by iLO to iLO, a self-signed certificate. This is suspicious to the browser, so it flags it and makes you decide whether to trust the site.


- accept and import the certificate
- allow it for the current session

How?  I can do this readily with Firefox, but video console redirection effectively requires MSIE running on an MS Windows VM and I can find no way there to accept the cert.

[Dennis Handly]

>I can do this readily with Firefox, ... requires MSIE and I can find no way there to accept the cert.

Hmm, I thought IE had a link in the find print on the warning page that would accept it.

But if that's not here, you can do the obvious.  Export the certificate in firefox and import it into IE.

[anthony11]

Figuring out how to do that in MSIE is far from obvious.

[Dennis Handly]

>Figuring out how to do that in MSIE is far from obvious.

On IE7 anyway:

Tools > Internet Options > Content > Certificates > X > Import

I'm not sure if X should be Intermediate or Trusted.

But if firefox saves in with the right suffix, you should be able to open it and use the wizard to import it.

[Unlisted]

Reply originally by  Gobinda_Sahukar

Simply Just add the IP or hostname of the ILO address to the IE trusted list.