Larrydnail,

With creating the self-signed cert via the drac you are actuall already on the right track. You set all the objects under cfgRacSecurity Group. Then you set object "cfgRacSecCsrKeySize" to "2048". From there you would need to do the following;

Generate the CSR file on the iDRAC using the command-    racadm sslcsrgen -g

Then you can download the CSR using the command - racadm sslcsrgen -f

Let me know if this helps answer your question.

Chris,

I'm trying to avoid generate CSR, getting a new cert, uploading a new cert, etc...

Is there a way set the drac to 2048 by default so it gens a self-signed cert with the SSLRESET command?

I am also trying to re-generate the same 2048-bit self-signed certificate within the iDRAC without the use of an external signing authority.  If the original cert was automatically generated for the iDRAC, it stands to reason another can be generated similarly.  Any help to do this would be greatly appreciated.

This has not worked for me.

PowerEdge R620, Server 2012 R2, iDRAC 7 Enterprise 2.63.60.62 > 2.65.65.65

SSL certificate is still expired after the update and when trying to use the racadm sslresetcfg command to renew it, I get the following errors:

Command Prompt:

'racadm' is not recognized as an internal or external command,
operable program or batch file.

PowerShell:

racadm : The term 'racadm' is not recognized as the name of a cmdlet, function, script file, or operable program. Check the spelling of the name, or
if a path was included, verify that the path is correct and try again.
At line:1 char:1
+ racadm sslresetcfg
+ ~~~~~~
+ CategoryInfo : ObjectNotFound: (racadm:String) [], CommandNotFoundException
+ FullyQualifiedErrorId : CommandNotFoundException

Should I be running this command in another tool?

You need to install iDRAC Tools or OMSA on the server operating system to run racadm commands. You can also SSH to iDRAC IP and run the racadm command. What operating system you have on the server?

The current update for Idrac 7 certificate expired in June of 2021, when is Dell going to create and new firmware updating the certificate?

Hi @Kelyn,

The self sign certificate is autogenerated after expiry. If you still face the expired certificate, please contact us supports to check for updates. 

Can you try below command and see whether a new certificate get generated

racadm sslresetcfg