# Managing SSL certificates

When managing large amounts of iLO interfaces, the constant SSL warnings are a nuisance, so let’s make sure we have proper SSL certificates. This script will make that easy to do for you by taking care of all the CA work. All you need to do is add the CA’s certificate to your browsers trusted CA list.

First thing to do is configure the CA. Add something like the following to your `~/.ilo.conf`:

    [ca]
    path = ~/.hpilo_ca
    country = NL
    state = Flevoland
    locality = Lelystad
    organization = Kaarsemaker.net
    organizational_unit = Sysadmin

This path can point to an existing CA, the only requirement is that `openssl.cnf` for this CA lives inside that directory. The other config values are used when generating the certificates for the iLOs and are all optional, they default to what HP puts in there.

If the CA does not yet exist, you can create it as follows:

    $ hpilo_ca init
    Generating RSA private key, 2048 bit long modulus
    .+++
    ..................+++
    e is 65537 (0x10001)
    You are about to be asked to enter information that will be incorporated
    into your certificate request.
    What you are about to enter is what is called a Distinguished Name or a DN.
    There are quite a few fields but you can leave some blank
    For some fields there will be a default value,
    If you enter '.', the field will be left blank.
    -----
    Country Name (2 letter code) [NL]:
    State or Province Name (full name) [Flevoland]:
    Locality Name (eg, city) [Lelystad]:
    Organization Name (eg, company) [Kaarsemaker.net]:
    Common Name (eg, your name or your servers hostname) [hpilo_ca]:

This generates the needed directories, an openssl config and a self-signed certificate for your CA.

When your CA is set up, you can start signing certificates. `hpilo_ca` will check several things:

> - Firmware is upgraded if necessary

> - The hostname is set to the name you use to connect to it, if needed

> - iLO2 is configured to use FQDN’s for certificate signing requests

It will then download the certificate signing request, sign it and upload the signed certificate. Here’s an example of it at work:

    $ ./hpilo_ca sign example-server.int.kaarsemaker.net
    (1/5) Checking certificate config of example-server.int.kaarsemaker.net
    (2/5) Retrieving certificate signing request
    (3/5) Signing certificate
    Using configuration from /home/dennis/.hpilo_ca/openssl.cnf
    Check that the request matches the signature
    Signature ok
    Certificate Details:
            Serial Number: 4 (0x4)
            Validity
                Not Before: Oct  5 09:48:26 2015 GMT
                Not After : Oct  3 09:48:26 2020 GMT
            Subject:
                countryName               = NL
                stateOrProvinceName       = Flevoland
                organizationName          = Kaarsemaker.net
                organizationalUnitName    = Sysadmin
                commonName                = example-server.int.kaarsemaker.net
            X509v3 extensions:
                X509v3 Basic Constraints:
                    CA:FALSE
                X509v3 Subject Key Identifier:
                    59:E5:B8:37:C5:30:8D:38:47:29:3E:C1:0E:B3:0A:97:95:48:3E:D1
                X509v3 Authority Key Identifier:
                    keyid:89:17:37:C5:E3:2D:EA:5C:83:0A:52:36:79:B0:EC:B7:A4:D5:D4:EF

                Netscape Comment:
                    Certificate generated by iLO CA
                X509v3 Subject Alternative Name
                    DNS:example-server.int.kaarsemaker.net, DNS:example-server, IP Address:10.4.2.13
    Certificate is to be certified until Oct  3 09:48:26 2020 GMT (1825 days)

    Write out database with 1 new entries
    Data Base Updated
    (4/5) Uploading certificate
    (5/5) Resetting iLO