NEC iLO 5, User Manual

Page: 240 / 335

234
Administering SSL certificates
SSL protocol is a standard for encrypting data so that it cannot be viewed or modified while in
transit on the network. This protocol uses a key to encrypt and decrypt the data. Generally, the
longer the key, the better the encryption.
A certificate is a small data file that connects an SSL key to a server. The certificate contains the
server name and the server public key. Only the server has the corresponding private key, and
this is how it is authenticated.
A certificate must be signed to be valid. If it is signed by a Certificate Authority (CA), and that CA
is trusted, all certificates signed by the CA are also trusted. A self-signed certificate is one in
which the owner of the certificate acts as its own CA.
By default, iLO creates a self-signed certificate for use in SSL connections. This certificate enables
iLO to work without additional configuration steps.
IMPORTANT:
Using a self-signed certificate is less secure than importing a trusted certificate. NEC
Corporation recommends importing a trusted certificate to protect the security of the iLO
processor.
Viewing SSL certificate information
Procedure
To view certificate information, click Security in the navigation tree, and then click the SSL
Certificate tab.
SSL certificate details
• Issued To—The entity to which the certificate was issued.
• Issued By—The CA that issued the certificate.
• Valid From—The first date that the certificate is valid.
• Valid Until—The date that the certificate expires.
• Serial Number—The serial number that the CA assigned to the certificate.
Obtaining and importing an SSL certificate
iLO allows you to create a Certificate Signing Request that you can send to a Certificate
Authority to obtain a trusted SSL certificate to import into iLO.
An SSL certificate works only with the keys generated with its corresponding CSR. If iLO is reset
to the factory default settings, or another CSR is generated before the certificate that
corresponds to the previous CSR is imported, the certificate does not work. In that case, a new
CSR must be generated and used to obtain a new certificate from a CA.
Prerequisites