UCS KVM Certificate

[mattpickering]

Hi there - 

We have a UCS, running 3.1(2e) firmware.   I've been able to install an ssl certificate on the https interface, so I'm not getting certificate errors on the login, however I'm still looking for a way to install a trusted certificate on the KVM sessions.  I can't seem to find any way to install a trusted certificate there. 

Anyone? 

Matt

[Wes Austin · Accepted solution]

Hey Matt,

I don't think you can accomplish this with the CIMC KVM IP address, since it may change, and trusted certificates typically rely on the DNS name vs the IP address. The certificates are generated with ip-address in subjectName/SubjectAltName and there is no DNS entry mapping available.

We are moving towards the HTML5 KVM and it should be available within the next major release.

HTH,

Wes

[mattpickering]

I see, that makes some sense.  An HTML solution would be great.  

In the mean time, is there some way to disable the need for a certificate then?  Java doesn't play well with untrusted certificates, as I'm sure you're aware...

Matt

[TRITInfrastructure]

Hi Wes,

Do you have any update on if this is possible yet?

Thanks,

Tobias

[Wes Austin]

3.1.3 and 3.2 releases introduce HTML5 KVM. You can use that moving forward if it will work better for you.

[TRITInfrastructure]

Hi Wes,

I'm still getting the certificate error, see image here - https://i.imgur.com/ljhnLl0.png

I can't see anywhere that I can apply my own self signed certificate, is this possible?

Thanks,

Tobias

[Pom Ham]

There have been some changes since last time you posted the inquiry.

For the m5 series, 3.2(2x) has the enhancement to add self-signed cert to the cimc. For the m4 and m3 blades, it requires 4.0 our latest firmware.
Please see the bug below.

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCva19420/?reffering_site=dumpcr

[joeharb]

I am trying to apply a certificate for the CIMC on M4 blades.  We generated a Certificate from our CA as a .pfx.  I have exported both the key and the cert from the .pfx.  I attempted change the certificate but a major error rose "Remote-Invocation-Error: Cannot send x509 information to bmc".

Does anyone have an better information on how to apply a CA signed certificate to the CIMC, this continually shows up on our Audit Scans.

Thanks,

Joe

[Pom Ham]

Hi Joe,

What is the server firmware? It requires 4.0 for m4 series to use self signed cert. Please take a read on the link above. 

[joeharb]

We are running version 4.0(1a).  I have read the documentation, but I am not clear on the process of generating the certificate.  I had a certificate generated in a .pfx form.  I exported the certificate and key and attempted to load on a blade.  The CIMC wouldn't boot.  Is there a specific type or format the certificate has to be?

Thanks,

Joe

[Pom Ham]

It must be in x.509 format. Please take a look at the doc below.

The certificate must be in Base64 encoded X.509 (CER) format.
https://www.cisco.com/c/en/us/support/docs/servers-unified-computing/ucs-c-series-rack-servers/200666-UCS-Install-server-certificate-to-CIMC.html

https://www.cisco.com/c/en/us/td/docs/unified_computing/ucs/ucs-manager/GUI-User-Guides/Admin-Management/4-0/b_Cisco_UCS_Admin_Mgmt_Guide_4-0/b_Cisco_UCS_Admin_Mgmt_Guide_4-0_chapter_0110.html

[joeharb]

We were provided a .pfx certificate, I assume this will need to be converted the an x.509?  I am able to export the private key as I know the password but I have not been able to provided the proper format.

It appears the cert and key are mandatory...

Please advise,

Joe