Managing SSL certificates

When managing large amounts of iLO interfaces, the constant SSL warnings are a nuisance. Workarounds like sslhazard for firefox help, but it’s much better to hapve proper SSL certificates. This script will make that easy to do for you by taking care of all the CA work.

First thing to do is configure the CA. Add something like the following to your ~/.ilo.conf:

[ca]
path = ~/.hpilo_ca

This path can point to an existing CA, the only requirement is that openssl.cnf for this CA lives inside that directory. If the CA does not yet exist, you can create it as follows:

$ hpilo_ca init
Generating RSA private key, 2048 bit long modulus
.+++
..................+++
e is 65537 (0x10001)
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [NL]:
State or Province Name (full name) [Flevoland]:
Locality Name (eg, city) [Lelystad]:
Organization Name (eg, company) [Kaarsemaker.net]:
Common Name (eg, your name or your servers hostname) [hpilo_ca]:

This generates the needed directories, an openssl config and a self-signed certificate for your CA.

When your CA is set up, you can start signing certificates. hpilo_ca will check several things:

• Firmware is upgraded if necessary
• The hostname is set to the name you use to connect to it, if needed
• iLO2 is configured to use FQDN’s for certificate signing requests

It will then download the certificate signing request, sign it and upload the signed certificate. Here’s an example of it at work:

$ ./hpilo_ca sign example-server.int.kaarsemaker.net
(1/5) Checking certificate config of example-server.int.kaarsemaker.net
(2/5) Retrieving certificate signing request
(3/5) Signing certificate
Using configuration from /home/dennis/.hpilo_ca/openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 0 (0x0)
        Validity
            Not Before: Mar 10 13:38:11 2012 GMT
            Not After : Mar  9 13:38:11 2017 GMT
        Subject:
            countryName               = US
            stateOrProvinceName       = Texas
            organizationName          = Hewlett-Packard Development Company
            organizationalUnitName    = ISS
            commonName                = example-server.int.kaarsemaker.net
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            X509v3 Subject Key Identifier:
                85:7A:FB:A1:14:46:BA:EF:50:21:92:F9:36:E5:D4:F7:2D:97:F4:01
            X509v3 Authority Key Identifier:
                keyid:D5:C4:82:D2:92:28:D0:D9:39:0A:81:69:23:2C:76:4B:7D:2C:E2:2E

            Netscape Comment:
                Certificate generated by iLO CA
Certificate is to be certified until Mar  9 13:38:11 2017 GMT (1825 days)

Write out database with 1 new entries
Data Base Updated
(4/5) Uploading certificate
(5/5) Resetting iLO