To update the web (HTTPS) certificate on your Cisco UCS Manager (UCSM) platform running version 4.2(3i), youāll follow a process to generate a Certificate Signing Request (CSR) or directly upload a new certificate and private key, depending on your certificate authority (CA) setup.
Hereās a step-by-step guide:
Step-by-Step: Updating the Web Certificate on UCSM 4.2(3i)
1. Access UCSM via GUI or CLI
Open UCS Manager GUI in a browser or SSH into a Fabric Interconnect for CLI access.
Use the Admin tab for certificate-related operations.
2. Go to Key Management Section
In UCSM GUI:
Navigate to:
Admin ā Key Management
Select:
Default Key Ring
Or create a new custom key ring if needed.
3. Generate a CSR (if using external CA)
If you want to use a certificate signed by an external CA:
Click Generate Certificate Request (CSR)
Fill in:
Common Name (FQDN of UCSM)
Organization, Country, etc.
Copy the generated CSR and submit it to your CA.
After receiving the signed certificate from the CA, import it back into UCSM:
Choose the Key Ring used when CSR was created
Click Import Certificate
4. Alternatively: Upload Web Certificate & Private Key (PEM)
If you already have a private key and certificate (e.g. from an internal CA):
Convert the certificate and key into PEM format if needed.
Go to:
Admin ā Communication Services ā HTTPS
Click Import Certificate
Upload:
Server Certificate (.pem)
Private Key (.pem)
Make sure the private key is unencrypted (no passphrase), or UCSM wonāt accept it.
5. Apply and Save
After importing, click Save Changes
Restart the HTTPS service (or reboot UCSM if required) for the new certificate to take effect.
6. Verify
Open UCSM in a browser and check the new HTTPS certificate
Ensure it matches the domain and is trusted
Tips
Backup existing certificate before replacing it.
UCSM does not support wildcard certificates in some versions.
Ensure the FQDN used in the certificate matches the UCS Manager access URL.
If accessing UCSM through IP but cert is FQDN-based, browsers will still show a mismatch warning unless you update your DNS or hosts file.
