Search <book_title>...

Symantec NetBackup™ Appliance Security Guide

Last Published: 2018-01-31

Product(s): Appliances (3.1.1 (5340), 3.1.1 (5330), 3.1.1 (5240), 3.1.1 (5230), 3.1.1 (5220))

Replacing the default IPMI SSL certificate

Veritas recommends that the default IPMI SSL certificate used to access the IPMI web interface be replaced with either a certificate signed by a trusted internal or external Certificate Authority (in PEM format), or by a self-signed certificate. You can use the following procedure to create a minimal self-signed certificate on a Linux computer and import it into the IPMI web interface:

To create a minimal self-signed certificate on a Linux computer and import it into the IPMI web interface:

Run the following command to generate the private key called ipmi.key:

$ openssl genrsa -out ipmi.key 2048
	
Generating RSA private key, 2048 bit long modulus
	
.....+++

	.+++

	e is 65537 (0x10001)

Generate a certificate signing request called ipmi.csr using ipmi.key, filling in each field with their appropriate values:

Note:

To avoid extra warnings in your browser, set the CN to the fully qualified domain name of the IPMI interface. You are about to enter is what is called a Distinguished Name or a DN.

$ openssl req -new -key ipmi.key -out ipmi.csr

Refer to the following guidelines to enter information to be incorporated into your certificate request:

Country Name (2 letter code) [AU]:	Enter your Country's name. For example, US.
State or Province Name (full name) [Some-State]:	Enter your State's or Province's name. For example, OR.
Locality Name (eg, city) []:	Enter your Locality name. For example, Springfield.
Organization Name (eg, company) [Internet Widgits Pty Ltd]:	Enter your Organization's name. For example, Veritas.
Organizational Unit Name (eg, section) []:	Enter your Organization Unit's name.
Common Name (eg, YOUR name) []:	Enter `hostname.your.company`.
Email Address []:	Enter your email address. For example, `email@your.company` .
A challenge password []:	Enter the appropriate challenge password, which is the extra attribute to be sent with your certificate request.
An optional company name []:	Enter the appropriate optional company name, which is the extra attribute to be sent with your certificate request.

Note:

Enter '.', to leave any field blank.

Sign ipmi.csr with ipmi.key and create a certificate called ipmi.crt that is valid for 1 year:

$ openssl x509 -req -in ipmi.csr 

-out ipmi.crt -signkey ipmi.key 

-days 365

	Signature ok

	subject=/C=US/ST=OR/L=Springfield

/O=Veritas/OU=Your OU/

CN=hostname.your.company/

emailAddress=email@your.company
	

Getting Private key

Concatenate ipmi.crt and ipmi.key to create a certificate in PEM format called ipmi.pem.
```
$ cat ipmi.crt ipmi.key > ipmi.pem
```
Copy ipmi.pem to a host that has access to the appliance's IPMI web interface.
Login to your Veritas Remote Management (IPMI web interface).
Click Configuration > SSL.
The appliance displays the SSL Upload page.
From the SSL Upload page, click Choose File to import the certificate.
Select the ipmi.pem and click Upload.
A warning may appear that says an SSL certificate already exists, press OK to continue.
To import the key, click Choose File again (notice it says New Privacy Key next to the button).
Select the ipmi.pem and click Upload.
A confirmation appears stating that the certificate and key were uploaded successfully, press OK to restart the Web service.
Close and reopen the Veritas Remote Management (IPMI web interface) interface to verify that the new certificate is being presented.