Replace DellEMC OpenManage Enterprise self signed certificat

I guess I replied to this and maybe saw where I was experiencing similar issues the error code I am receiving is CSEC9002.

If you, on your (windows) computer, import the RootCA into "Trusted Root Certification Authorites", and if you have an intermediate ca, import that into "Trusted Intermediate Certification Authorites" it should be accepted and in your browser.

OME itself doesn't include roo/intermediate CA etc in the certificate it presents to your browser. But the includes the subject name of the issuer, and you have to have a trust on that one.

 This issue seems to be still relevant so i am posting here a solution that worked for me.

Check your certificate template's key usage extensions.

It appears that the key encipherment must be enabled (option to allow key exchange only with key encryption) for dell openmanage to accept new cert. Otherwise i am getting the same error as you folks. 

There is no need to paste root/inter certs into the public cert file. Just use the public cert in ASCII format (base64) that was output by your CA.

Sadly the clowns that work in Dell Technical support didn't exactly help here.

Solution for me was to boot the appliance with an alternative Linux distribution (I use systemrescuecd), mount the LVM root partition and replace the two files 'localhost.crt' and 'localhost.key' with the x509 wildcard cert and key respectively, which I already had signed before installing Openmanage..

For anyone still struggling with the garbage interface, this is the way I did it. Worked great.

Thanks man!  This solution worked for me!

Confirmed, this worked for me as well.

However 2 catches:

1) In replacing the certs offline, it breaks SELINUX because you can't reset the SELINUX attributes in 'offline mode', and HTTPD cannot access the certificates

2) If you have a self-signed CA, it needs to get loaded manually, because you can't simply run 'update-ca-trust'

Booted to linuxrecoverycd.iso (added CDROM to the CentOS7 VM):

mkdir /mnt/LVRoot
sudo mount /dev/OMCAppVG/LVRoot /mnt/LVRoot

find . -name localhost.crt

	* should find /mnt/LVRoot/etc/pki/tls/certs/localhost.crt

find . -name localhost.key

	* should find /mnt/LVRoot/etc/pki/tls/private/localhost.key

cd /mnt/LVRoot/tmp

smbclient /// -U 
cd Certificates/ExtractedP12InBase64
get cachain.cer
get server.cer
get server.key
exit

mv /mnt/LVRoot/tmp/cachain.cer /mnt/LVRoot/etc/pki/ca-trust/source/anchors/PrivateCAChain.crt
mv /mnt/LVRoot/tmp/server.cer /mnt/LVRoot/etc/pki/tls/certs/localhost.crt
mv /mnt/LVRoot/tmp/server.key /mnt/LVRoot/etc/pki/tls/private/localhost.key

vim /mnt/LVRoot/etc/pki/ca-trust/source/anchors/PrivateCAChain.crt
	ggVG
	y
	:q!
chmod 666 /mnt/LVRoot/etc/pki/ca-trust/extracted/pem/*.pem
vim /mnt/LVRoot/etc/pki/ca-trust/extracted/pem/email-ca-bundle.pem
	P
	
		Bag Attributes
			friendlyName: 
		subject=/CN=
		issuer=/CN=
	
		# 
	
	
		Bag Attributes
			friendlyName: 
		subject=/CN=
		issuer=/CN=
	
		# 
	
	
	gg
	V
	" all the way down to "-----END CERTIFICATE-----" just above "# ACCVRAIZ1">
	y
	
	:x
vim /mnt/LVRoot/etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem
	P
	:x
vim /mnt/LVRoot/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
	P
	:x
chmod 444 /mnt/LVRoot/etc/pki/ca-trust/extracted/pem/*.pem

vim /mnt/LVRoot/etc/selinux
	
	change 'enforcing' to 'permissive'
	
	:x
*** We need to do the above because the certs are locked, and we can't restore SELINUX permissions using restorecon -RvF /mnt/LVRoot/etc/pki/ca-trust/extracted/pem/ ***

cd /

umount /mnt/LVRoot

reboot
 
 
I looked into the SSH terminal, but without Dell, you can't generate the key to putty your way into the live server...
 
Of course SELINUX could be turned on if you could simply run restorecon.. Not recommended to run with it disabled, but, the server is internal only..
 
This would be SO MUCH EASIER if we could just upload a bloody PFX/P12 file and be done with it!
 
I even ran a test. I loaded my CA certs. Then I did a user-generated signing from the server, signed the cert using my CA, and tried to load the PEM. Nada. Still barks about the private key and CA or something (the error in this thread).
 
I'll stick with this method for now until Dell gets their stuff together.