Why do I need certificates for HPSIM?

[BeltwayBenny]

Hi all, we're getting ready to roll out HPSIM and update the SNMP settings on all our servers so we can get our hardware alerting setup.

I have a question of whether or not I need to roll out a self-signed certificate for the CMS server and all agents. What are the major advantages of using using certificates?

We don't plan on using SSH for remote command execution, we have commercial package that allows us to distribute software and run commands on remote systems. We currently use OS authentication when going to the SMH on each server.

Do I need to use certificates for the version control repository to work correctly?

I read the HPSIM security doc and it says:
"The Insight Management Agents should be configured to trust by certificate." That's fine, but what do I gain by implementing this feature?

Thanks!

Ben

[Rich Purvis · Accepted solution]

You gain two things:

1) Single-Sign-On from your CMS. From HPSIM if you want to do drill down into the SMH if you have a certificate trust setup you will not have to repeatedly sign in to the SMH when you want to access it from HPSIM.

2) Secure Task Execution from your CMS. If you would like to use features like "Replicate Agent Settings" within HPSIM, it requires that you have a trust setup.

If you do *not* care about either of these things the most secure thing to do is install the SMH with the default trust setting, which is by certificate but do not deploy a cert - that way the trust is broken until you decide to setup certificates.

If you do want either of these options then you can setup a cert trust as it is the most secure and only recommended trust setup from HP.

-Rich