Unsolved
This post is more than 5 years old
21 Posts
1
63233
March 14th, 2016 09:00
iDRAC6 SSL certificate upload failing
Hello,
On a Poweredge R610 with iDRAC6 v. 1.97 (Build 02), I export the CSR via the webgui :
myServer.csr
Then on the server that manages our own CA, using easy-rsa, I have copied this csr into the easy-rsa/keys directory, then ran :
./sign-req myServer
and it is generating :
myServer.crt
that I tried to upload via the webgui SSL tab.
It is failing with the error :
"Certificate upload failed."
I then tried to upload this same file via the racadm command line :
PS C:\temp> racadm -r myServer -u root -p xxxxx sslcertupload -t 1 -f myServer.crt
Security Alert: Certificate is invalid - Certificate is not signed by Trusted Third Party
Continuing execution. Use -S option for racadm to stop execution on certificate-related errors.
ERROR: Unable to perform requested operation.
When I'm trying to use "-t 2", it seems to work with no error, but does not seem to do anything more (when viewing the cert. after a racadm racreset, it is still showing Dell's default cert.)
Questions :
- Why is the upload failing through webgui ? is there a simple filename extension check ?
- According to what I read, I should use -t 1, but this one is failing. What should I use ?
- In my browser, I've added our company CA. May someone confirm that what I'm trying to achieve is possible ? (use our own CA and our own self-signed certificate)
DELL-Chris H
7 Practitioner
•
9.7K Posts
•
48K Points
0
March 14th, 2016 11:00
Nicolasecarnot,
The issue is possible due to the iDrac 6 being a few updates back on firmware. I would suggest walking the iDrac as well as the BIOS up to current and then try the upload again.
What is the current BIOS version, that way I can get you the proper updates. As you don't want to update it to the latest if it is server versions back, as that can cause issues.
Let me know.
nicolasecarnot
21 Posts
0
March 15th, 2016 03:00
Hi Chris,
thanks for answering.
The iDRAC is version 1.97 (Build 02), the BIOS is 6.4.0, which I suppose is quite the maximum version I can get on the R610.
About the iDRAC, I saw there were a 2.85 version which I'm upgrading now, and keep you aware.
nicolasecarnot
21 Posts
0
March 15th, 2016 05:00
OK, I successfully upgraded the iDRAC to 2.85.
I hit the bug of being unable to log in the web gui, so I was forced to ssh then run a sslresetcfg, then was able to log in.
I then followed the exact same path as described above, and witnessed the exact same failure (either via the web gui or the racadm command line).
What should I try next?
DELL-Shine K
6 Operator
•
3K Posts
0
March 15th, 2016 05:00
Is SSL certificate you generated is in Base 64 format? iDRAC only support uploading SSL certificate in Base64 format
nicolasecarnot
21 Posts
0
March 15th, 2016 07:00
Yes, it is in BASE 64.
What are the mandatory values of the different fields one has to fill in when generating the csr ?
nicolasecarnot
21 Posts
0
April 1st, 2016 06:00
Hello,
I made some progress since last try.
As I wrote, I used the webgui and generated a CSR.
Then, using our own CA created via Easy-RSA, I used the following command :
openssl x509 -req -in my_server.csr -out my_server.pem -set_serial 101 -CA ca.crt -CAkey ca.key
The "set-serial" is only there to bypass the lack of a SRL management at this point.
I also took the time to specify a 2048 bits size key using racadm config options, but I doubt this would have changed anything.
Anyway, now, using this ".pem" file, the upload via the webgui is successful.
Now, when connecting on the iDRAC server, I get another error, but that is an evidence my certificate upload has been sucessful.
May I still ask you for some more help please?
Firefox is telling me :
my_server is using an invalid security certificate.
The certificate is only valid for my.domain.com
Error code : SSL_ERROR_BAD_DOMAIN
The details are showing :
Emitted for
CN : my.domain.com
bla bla
bla bla
Emitted by
CN : *.my.domain.com
bla bla
bla bla
I'd like to understand if the problem is :
1 - the CN of the CA and the CN of the certificate are different
or
2 - the CN of the certificate is different from the FQDN of the iDRAC : my_server.my.domain.com
or
3 - something else
???
SeanDonaghey
18 Posts
0
December 7th, 2016 07:00
Did you ever get this to work?
nicolasecarnot
21 Posts
0
December 7th, 2016 07:00
No, just like any other Dell web GUI.
HTTPS does not seem to be their concerns.
antonio.olivar.
1 Message
0
September 17th, 2017 18:00
Same issue here.
pvtcompyle
1 Message
0
July 31st, 2020 10:00
I had this issue too. I was using pfsense for my CA. I made sure the CSR common name and the actual cert common names matched exactly, with no spaces (I replaced spaces with underscores). I had no issue uploading the certs after that.