PowerEdge: How to resolve SSL Certificate Replacement Issues in iDRAC9

When the SSL certificate expiration banner appears on the iDRAC9 Dashboard, the installed certificate is nearing or has reached the end of its validity period. Replace the certificate with a newly issued, valid SSL/TLS certificate to ensure continued secure communication and compliance with organizational security policies.

Generate a Certificate Signing Request (CSR)

A Certificate Signing Request (CSR) is a prerequisite for obtaining a valid SSL/TLS certificate from a trusted Certificate Authority (CA). The CSR contains encoded information about the server and organization that the CA uses to issue the certificate.

1. Log in to the iDRAC9 web interface.
2. From the main Dashboard, click iDRAC Settings.
3. Select Services.
4. Under the SSL/TLS section, select Certificate Signing Request.
5. Enter the required information, including the appropriate key size (for example, 2048-bit RSA).
6. Click Generate to create the CSR.
7. Click Download to save the CSR file.

Store the CSR file securely. Submit this file to the Certificate Authority for signing.

Upload the Signed SSL/TLS Certificate

After the Certificate Authority processes the CSR and issues the signed certificate, upload it to iDRAC9 to replace the expiring certificate and restore trusted HTTPS access.

1. Obtain the signed certificate file from the Certificate Authority. Also obtain any intermediate or root CA certificates if required.
2. Log in to the iDRAC9 web interface.
3. Navigate to iDRAC Settings and then Services and then Web Server.
4. Select Upload SSL/TLS Certificate.
5. Browse and select the signed certificate file provided by the CA.
6. If applicable, also upload the CA intermediate chain certificate.
7. Confirm the upload and allow iDRAC to apply the new certificate.
8. Refresh the browser session and verify that the certificate details reflect the new validity period and issuer.

Verify the Certificate with RACADM

Use the racadm command-line interface to review the installed SSL certificate. This verifies that the new certificate was applied correctly and helps identify any errors introduced during replacement.

Run the following command to view the installed certificate details:

racadm sslcertview -t 1

Confirm that the certificate details, including the issuer and validity period, match the newly issued SSL certificate from the CA.

Reset SSL Configuration (Fallback)

If errors during certificate deletion or upload prevent successful replacement, use the racadm sslresetcfg command to reset the SSL configuration to factory defaults. This command removes all custom SSL certificates and restores the default self-signed certificate generated by iDRAC.

Recommended Procedure

1. Attempt standard removal first. Run the following command to delete the old certificate:

   racadm sslcertdelete -t 1

2. Upload the new certificate using the iDRAC web interface or racadm commands.
3. If errors persist, run the SSL reset command:

   racadm sslresetcfg

4. Verify the reset. After the iDRAC web server restarts, confirm that iDRAC has reverted to the default self-signed certificate by running:

   racadm sslcertview -t 1

   Verify that the certificate details reflect the default configuration.
5. Reload the new certificate. Generate a new CSR if required, then upload the signed SSL certificate from the Certificate Authority.

Best Practices

• Test certificates in a staging environment before applying them in production.
• Maintain a record of CSR and private key files for verification.
• Use strong encryption standards (RSA 2048-bit or higher, SHA-256).
• Replace certificates proactively before expiration to avoid downtime.
• Use trusted Certificate Authorities when issuing certificates.
• Document any SSL reset actions for audit and compliance purposes.
• After a reset, upload the new certificate promptly to minimize exposure to the default self-signed certificate.