HPE Storage Users Group

A Storage Administrator Community




Post new topic Reply to topic  [ 1 post ] 
Author Message
 Post subject: Certificate Management (3.3.1 MU5) and your OWN CA
PostPosted: Thu May 06, 2021 2:13 am 

Joined: Wed Mar 12, 2014 11:27 am
Posts: 25
Hi all,

was picking up an issue with a customer 3PAR which began generating alarms with regard to expired certificates. On inspection it appears that at some point the customer has created their own signed certs for specfiic services (wsapi/cim/cli) but have left the old unified-server entry as self signed. Also I don't believe any cleanup was done during the cert replacement process for wsapi, cli and cim which has resulted in these expired certs being left behind.

edited example below. It seems some signed certs were installed for CIM, CLI and WSAPI but not for unified-server. Also no cleanup was done of the old self signed (MY3PAR.domain.com) certs which are now alarming due to expiry

Service Commonname Type Enddate Fingerprint
cim* MY3PAR.domain.com intca Jul 14 15:23:26 2019 GMT xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
cim* domain-issuing-ca-01 intca Jun 20 07:54:11 2022 GMT xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
cim* domain-RCA-01 rootca Jun 20 07:50:07 2027 GMT xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
cli* MY3PAR.domain.com intca Jul 14 15:23:26 2019 GMT xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
cli* domain-issuing-ca-01 intca Jun 20 07:54:11 2022 GMT xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
cli* domain-RCA-01 rootca Jun 20 07:50:07 2027 GMT xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
wsapi* MY3PAR.domain.com intca Jul 14 15:23:26 2019 GMT xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
wsapi* domain-issuing-ca-01 intca Jun 20 07:54:11 2022 GMT xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
wsapi* domain-RCA-01 rootca Jun 20 07:50:07 2027 GMT xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
unified-server* MY3PAR.domain.com cert Nov 26 08:54:06 2022 GMT xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

The oddest thing of all is that from what i can tell wsapi (which i can test by connecting the URL) is still using the self signed 'unified-server' cert.

So my question is really the following..

I believe the correct approach would to remove everything in the first instance.

so would issue

removecert

removecert unified-server

once this has been done the next steps would be install new certs. This is where i require clarification. If the customer wishes to use their own certificate chain do i just need to create a signing request for 'unified-server' as it appears this is what gets served up anyway? Or do I need to create signing requests for each service INCLUDING unified-server.

My gut feeling is all that is needed is the following.

If just following the self-signed route then all i need is

createcert unified-server -selfsigned -CN "<CERT CN>"

However if going down my own CA route then I would need to get a CSR for unified-server created and signed.

createcert unified-server -csr -keysize 2048 -C Country -ST Country -L City -O "MyOrg" -OU "MyOU" -CN MY3PAR.Name -SAN DNS:DNSNAME,IP:xxx.xxx.xxx.xxx myCERT.txt
Once I had this MyCert.txt I'd get that signed by my cert authority.

Once done I need to import everything back in

Import root CA

importcert unified-server -ca RootCA_B64.pem

Import Intermediate CA if needed

importcert unified-server -ca IssuingCA.pem

Finally import the array cert

importcert unified-server MY3PAR.name.pem


Oh and I guess you'd need to stop wsapi and start it again before and after these steps to ensure it gets the new cert.

I believe that's all that's needed and you don't need to go down the route of creating signed certs of wsapi, cli and cim individually.

I did reach out to support to confirm the steps but its been some time and we're not getting anything useful so i thought I'd try here.

It is slightly confusing as the 3PAR manual says "The unified-server establishes a common certificate among CIM, CLI, and WSAPI." however it then shows examples of importing certificates for individual services

"cli% importcert cli cli-service.pem ca.pem"

for example. A bit confusing...

Hopefully someone will confirm these steps are broadly correct and only the signed unified-server cert is needed along with any root and issuing CA for the company.

(this was posted on HPE forums but go zero replies so I'm hoping someone on here can confirm if this is the correct approach)

thanks in advance.


< UPDATE>

Typical! I post on here and 10 minutes later someone finally replies elsewhere. So it would appear only UNIFIED-SERVER CERT is needed for everything so will get a CSR generated for that and I should be golden.


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 1 post ] 


Who is online

Users browsing this forum: No registered users and 52 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group | DVGFX2 by: Matt