Integrated Dell Remote Access Controller 9 User's Guide

Configuring services using web interface

1. In the iDRAC Web interface, go to iDRAC Settings > Services.
   The Services page is displayed.
2. Specify the required information and click Apply.
   For information about the various settings, see the iDRAC Online Help.
   NOTE:Do not select the Prevent this page from creating additional dialogs check-box. Selecting this option prevents you from configuring services.

   You can configure SEKM from iDRAC Settings page. Click iDRAC Settings > Services > SEKM Configuration.

   NOTE:For detailed step by step procedure for configuring SEKM, see the iDRAC Online Help.

   NOTE:When Security (Encryption) mode is changed from None to SEKM, Real-Time job is not available. But it will be added to Staged job list. However, Real-Time job is successful when the mode is changed from SEKM to None.

   Verify the following when changing the value of the Username Field in Client Certificate section on the KeySecure server (for ex: changing the value from Common Name (CN) to User ID (UID))

   1. While using an existing account:
      • Verify in the iDRAC SSL certificate that, instead of the Common Name field, the User name field now matches the existing username on the KMS. If they don't, then you will have to set the username field and regenerate the SSL certificate again, get it signed on KMS and re-upload to iDRAC.
   2. While using a new user account:
      • Make sure the User name string matches the username field in the iDRAC SSL certificate.
      • If they don't match, then you will need to reconfigure the iDRAC KMS attributes Username and Password.
      • Once the certificate is verified to contain the username, then the only change that needs to be made is to change the key ownership from the old user to the new user to match the newly created KMS username.

   While using Vormetric Data Security Manager as KMS, ensure that the Common Name (CN) field in iDRAC SSL certificate matches with the host name added to Vormetric Data Security Manager. Otherwise, the certificate may not import successfully.

   NOTE:

   • Rekey option will be disabled when racadm sekm getstatus reports as Failed.
   • SEKM only supports Common name, User ID, or Organization Unit for User Name field under Client certificate.
   • If you are using a third party CA to sign the iDRAC CSR, ensure that the third party CA supports the value UID for User Name field in Client certificate. If it is not supported, use Common Name as the value for User Name field.
   • If you are using Username and Password fields, ensure that KMS server supports those attributes.

   NOTE:For KeySecure key management server,

   • while creating an SSL certificate request, you must include at least one of the IP addresses or DNS name of the key management server in Subject Alternative Name field.
   • the IP address must be in the following format: IP:xxx.xxx.xxx.xxx.