HP Integrated Lights-Out 2 User Guide

• The SSL Key Length button to choose between 2048 or 1024 bit private key length for CSR.
• The Customized CSR radio button to choose between CSR with custom or default subject fields.
• The Country field for configuring the CSR subject country name.
• The State or Province field for configuring the CSR subject state name.
• The Organization Name field for configuring the CSR subject organization name.
• The Organization Unit field for configuring the CSR subject organization unit name.
• The City or Locality field for configuring the CSR subject city or locality name.
• The Common Name field for configuring the CSR subject common name.
The following options are available on the SSL Certificate tab:
• Apply Button – When you click the Apply button, custom CSR data is validated and stored in
iLO2. During the certificate generation request, the stored CSR settings are used by iLO2.
• Create Certificate Request – Use this button to create a certificate request. When you click
this button, a CR is created (in PKCS #10 format) that can be sent to a CA. This certificate
request is Base64-encoded. A CA processes this request and returns a response (X.509
certificate) that can be imported into iLO 2.
The CR contains a public/private key pair that validates communications between the client
browser and iLO 2. The generated CR is held in memory until a new CR is generated, iLO 2
is reset, or a certificate is imported by the generation process. You can generate the CR and
copy it to the client clipboard, leave the iLO 2 website to retrieve the certificate, and then
return to import the certificate.
When submitting the request to the CA, be sure to perform the following tasks:
1. Use the iLO 2 name as listed on the System Status screen as the URL for the server.
2. Request that the certificate is generated in the RAW format.
3. Include the Begin and End certificate lines.
Every time you click Create Certificate Request, a new certificate request is generated, even
though the iLO 2 name is the same. Generally SSL keys pairs are pre-generated. The CSR is
generated immediately on clicking the Create Certificate Request button. However, the
certificate request generation button is grayed out while the key generation is in progress. In
this scenario, you can close all active Remote Console sessions and try again later (around
2 minutes for a 1024-bit key, and 10 minutes for 2048-bit key).
• Import Certificate – Use this button when you are returning to the Certificate Administration
page with a certificate to import. Click Import Certificate to go directly to the Certificate Import
screen without generating a new CR. A certificate only works with the keys generated for the
original CR from which the certificate was generated. If iLO 2 has been reset, or another CR
was generated since the original CR was submitted to a CA, then a new CR must be generated
and submitted to the CA.
You can customize and create a CR or import an existing certificate using RIBCL XML commands.
These commands enable you to script and automate certificate deployment on iLO 2 servers instead
of manually deploying certificates through the browser interface. For more information, see HP
Integrated Lights-Out Management Processor Scripting and Command Line Resource Guide at
http://h20000.www2.hp.com/bizsupport/TechSupport/DocumentIndex.jsp?
contentType=SupportManual&lang=en&cc=us&docIndexId=64179&taskId=135&
prodTypeId=18964&prodSeriesId=1146658.
Two-factor authentication
Access to iLO 2 requires user authentication. This firmware release provides an enhanced
authentication scheme for iLO 2 using two factors of authentication: a password or PIN, and a
private key for a digital certificate. Using two-factor authentication requires that you verify your
Security 45