All my servers iDRAC ports use the same certificate.

Question

I have three servers on an offline domain. I just wanted to get rid of the certificate error. I was able to do it the first one by installing the certificate from the browser into the trusted root certification authorities folder and add a DNS Host record with the name in the certificate “idrac-svctag“ for the iDRAC IP address but they all use the same certificate and the “idrac-svctag” name so I don’t see a way to get rid of the certificate error on the other two.

____________________________

So it looks like default certificate on all three iDRAC cards was “idrac-svctag“.

Looking at each iDRAC and checking the DNS iDRAC Name under "iDRAC Settings -> Connectivity -> Network -> Common Settings" page they all have the service tag based DNS name and not "idrac-svctag".

I then had to run these commands through the SSH connection to each iDRAC. This worked but wondering why this was not already set up this way?

racadm sslresetcfg

racadm racreset

DELL-Shine K · Accepted Answer

Ok. Then can you ssh to one iDRAC and run below commands to regenerate certificate and see whether name on certificate is getting changed with service tag racadm sslresetcfg racadm racreset

DELL-Joey C · Answer

Hi,   What certificate error are your referring? Do you have a screenshot of the error?

DELL-Shine K · Answer

Can you let me know the server model and iDRAC FW version. All iDRAC will have different certificate with different name. Are you seeing all three iDRAC having same name on the certificate?

Tanquen1 · Answer

It’s a DD3300 Data Domain and two Dell R640 servers. All three issue the same 'idrac-svctag' certificate. Maybe there is a setting to make them unique? The name it is using makes it look like it should be 'idrac-' plus the Dell service tag. It already knows the unique Dell service tags so I’m not sure why they all would not use them by default.

Tanquen1 · Answer

The one in the browser that gives you the 'This site is not secure' you have to click details and then the 'Go on to the webpage (Not recommended)' link and then you can login.

DELL-Shine K · Answer

I hope you did not upload any custom certificate to iDRAC and you are using default iDRAC self signed certificate.  Can you login to iDRAC and check DNS iDRAC Name under 'iDRAC Settings -> Connectivity -> Network -> Common Settings' page and see whether all iDRAC have DNS name of 'idrac-svctag'. If yes can you change it do different unique names and run racadm sslresetcfg command from SSH. this will regenerate iDRAC self signed certificate with the new DNS name. You need to perform 'racadm racreset' command to apply new certificate.

Tanquen1 · Answer

I did not upload any custom certificates, don't know how. The DNS iDRAC Name seems to be correct 'iDRAC-#######' and not ''idrac-svctag'.

Tanquen1 · Answer

This worked on the two servers but the DD3300 iDRAC did not come back. I can get to the DD System Manager and it now shows both power supplies absent! ???&#xa0;

Tanquen1 · Answer

The power errors are now gone and IO can ping the DD3300 iDRAC port but can't open the web page or make an SSH connection.

DELL-Shine K · Answer

I am not able to see the picture you provided in last 2 messages. Can you let me know what error message you are getting when you try to connect to GUI/SSH

Tanquen1 · Answer

After restarting the DD3300 everything was ok for about 20minutes and then I saw power error messages in DD manger that then went away. The picture is of the DD Manager -> Hardware -> Chassis and it showed both power supplies red. Very strange.

Then I noticed I could no longer connect to the iDRAC web page. I had already connected and gotten the new certificate. Then it just stopped working.

I then tried to make a SSH connection with PuTTY to the iDRAC and it shows a “Network error: Connection refuies” but I can sometimes connect and enter the user and password before it disconnects.

___________________________________________________________

After letting it set over the weekend everything seem to be ok today. The Dell Data Domain DD3300 seems to be a little odd. It took about 30 minutes after a reboot before I could ping it or connect to it. Then it showed the power supplies as failed and I could not make a SSH connection until days latter. ???

I’ve not worked with a Data Domain before but it taking so long to settle is very disconcerting.

Systems Management General

All my servers iDRAC ports use the same certificate.

Was this post helpful?