Remote Support problem

[Bart Korsten]

Installation works OK. Remote Support settings also work and I am able to update my data to isee. But when I open the "Remote Support Services" tab in Remote Support Configuration and Services I get the following :

HTTP Error: cURL ERROR: 60: SSL certificate problem, verify that the CA cert is OK. Details:
error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failedurl: https://127.0.0.1:50002/mxsoap/services/MxpiMain5_1http_code: 0header_size: 0request_size: 0filetime: -1ssl_verify_result: 0redirect_count: 0total_time: 0namelookup_time: 0connect_time: 0pretransfer_time: 0size_upload: 0size_download: 0speed_download: 0speed_upload: 0download_content_length: 0upload_content_length: 0starttransfer_time: 0redirect_time: 0

[U. Rasmussen]

I'm afraid I don't have a solution for this one, but I'm experiencing a similar issue. When i go into "Remote Support Services", I get the following message:

"HTTP Error: CURL Extension, or OpenSSL extension w/ PHP version >= 4.3 is required for HTTPS"

No servers are shown in the list either, and no entitlement icons like before.

I've tried this on IE on several different versions and also directly on the server, same issue. Anyone have a solution for this one?

[Martin Kers]

Anybode who has a solution for this problem ? Do have the exact same error.
Already switched over from a proxy-connection to a direct connection to HP.

Bart, do you use your own certificates in HPSIM ?

[Bart Korsten]

Hi,

I do not use my own cert's because this results in a nonfunctional VMM service. But that's an other problem :) The weird thing is that if I use the command "Contract and warranty Data Collection" on the option menu, the machines get identified correctly and support contracts are found at HP.

[L Davis]

I too have the exact same error. I have logged a job with HP and they are trying to help me out. Just wondering if any of you guys worked out what the problem was? Or did you go for the rebuild. If HP figure out what is going on I will post it here. Cheers.

[Clancy]

Any news on this thread? I am experiencing this problem and I *did* install our own certificate.

[IRS4Ever]

As you may or may not know, this error is generated by the System Management Home page when there is a Cert failure or mismatch. You can get around this error by opt'ing to not check the cert. To do this perform the following steps:

On the CMS:
1. Locate the file isee-soap-calls.php in the c:\hp\hpsmh\data\htdocs\isee\ directory.

2. Make a copy of this file as a backup.

3. Using Notepad, open the
isee-soap-calls.php file and locate the following line:

$cert['verifyhost'] = 0;

4. Insert the following line after the line lcoated in step 3:

$cert['verifypeer'] = 0;

The updated file should now contain:

$cert['verifyhost'] = 0;
$cert['verifypeer'] = 0;

5. Save the file and either refresh the page in SIM or logout and back in again.

6. If this fails to resolve the problem or casues additional problems, restore the original file.

[John Hossbach]

Has anyone been able to actually fix this problem yet?

[John Hossbach]

Ok.

I HAVE A FIX!!!

This problem will occur when you give SIM any certificate that is not self-signed. This includes VeriSign-signed certificates as well as company CA-signed (e.g. Windows Certificate Authority) certificates.

These actions need to be carried out on the HP SIM server.

1. Export the CA certificate in base-64 format and save the file and take note of the path (e.g. c:\myca.cer).

2. Open the C:\hp\hpsmh\data\htdocs\isee\unified-collector\xml\uc-configuration.xml and locate the line that begins with
Example:


3. Move your myca.cer file to the directory specified in the value on this line (e.g. c:\hp\sslshare).

Now, the full path to your myca.cer file should be c:\hp\sslshare\myca.cer

NOTE: In the XML file, you should use the forward-slash (/). Windows normally specifies path names with a backslash (\).

4. Update the "value" value on the
Syntax:


Example:


5. Open the C:\hp\hpsmh\data\htdocs\isee\xml\isee-gui-configuration.xml and locate the line that begins with
Example:


6. Update the "value" value on the
Syntax:


Example:


------------------
DONE!

The isee-gui-configuration.xml file fixes the problem on the Entitlement tab.
The uc-configuration.xml file fixes the problem with all the other tabs.

[John Lernihan]

Has anyone managed to resolve this issue yet using either of the fixes above?

[John Hossbach]

John,

The problem with SIM is that although it allows you to use your own certificate, it assumes whatever certificate you provide is self-signed. Of course, what's the point in using your own certifcate if the it is self-signed aside from simply having your name on it -- no one trusts it unless you install it on all your clients.

The 'verifypeer' "fix" (the first one listed) is actually not a fix at all. Setting verifypeer to 0 simply tells SIM not to validate the certificate against trusted sources (or untrusted sources). You'll never know if the certificate is bad or good. If you do go this route, make sure you also edit the uc-soap-calls.php file in C:\hp\hpsmh\data\htdocs\isee\unified-collector to "fix" the other tabs. However, for security, I don't recommend disabling the security checking on certificates as this is the point to certificates in the first place.

The second fix (the one I posted) corrects SIM's assumption of self-signed certificates. There are two entries in the XXX-configuration.xml file to take note of: SMHCERTFILE and SMHCACERTFILE. SMHCERTFILE (should not be changed) points to the certificate file you uploaded to SIM. SMHCACERTFILE points to the same file. This is the problem. When SIM tries to validate the CERTFILE, it uses the CACERTFILE. For self-signed certificates, these should be the same. For CA-signed certificates, the CACERTFILE needs to point to the CA's certificate. SIM currently provides no interface for updating this value, so you must edit it yourself when you upload a new certificate that uses a different signer (self or CA).

As far as the two different directories, that's just the way they designed the remote support pack. The entitlement tab is separate from all the other tabs. No clue why. :-)

[Juan de Los Palotes]

Hi John

I tried your response, the first and the second but no working for me. Anybody has a solution to this problem??

Regards
CF

[John Hossbach]

Are you using your own certificate? If you switch back to the HP SIM certificate does it work fine?

[Juan de Los Palotes]

Hi John

Really I don't known wich certificate copy, I found this certificate and use this to make your troubleshooting. This is the certificate C:\Program Files\HP\Systems Insight Manager\config\certstor\hpsimwbem.cert. This not work to me, then I use the backup. Which certificate do you use it?. Thanks a lot for your response.

Regards
CF

[SmooshedFace76]

Fix in this thread was for another SSL error..

http://forums13.itrc.hp.com/service/forums/questionanswer.do?threadId=1367073