These certificates are imported as part of the automatic initial trust established between HPE OneView and Image
Streamer appliances.
Certificate Revocation Lists
A certificate authority-signed (CA) certificate can be revoked when the CA issues an improper certificate or if the private
key of the certificate is compromised. Information about revoked certificates is published by a CA as a Certificate
Revocation List (CRL). A CRL file for the certificate is specified in the CRL Distribution Points (CRL DP) field of the
certificate. CRLs are accessible using HTTP and are digitally signed by the issuing CA.
Image Streamer enables users to import CRL files downloaded from a CA to the appliance. Image Streamer then validates
all certificates signed by the CA against this CRL. CRLs have an expiration date and must be uploaded into the appliance
before their expiration.
Certificate revocation checking is enabled by default. A revoked certificate cannot be imported into the appliance.
However, if the CA-issued CRL for the certificate is not imported into Image Streamer or if the imported CRL has expired,
certificate revocation check is skipped by default.
Image Streamer raises alerts when CRLs are about to expire or have expired. By default, these notifications are disabled.
For CRL revocation checking of the certificate that belongs to www.hpe.com, you must upload CRLs for the following:
• VeriSign Class 3 Public Primary CA
• VeriSign Universal Root CA
• Symantec Class 3 Secure Server CA
• Symantec Class 3 Secure Server SHA256 SSL CA
• DigiCert Root CA - DigiCert Global Root G2
• DigiCert Intermediate CA - DigiCert Global CA G2
See Locate CRL Distribution Points in the
HPE OneView Help for HPE Synergy provides details on how to locate the CRL
DPs for these certificates.
Certificate status checks
Image Streamer performs periodic status checks on certificates. A scheduled job runs every hour at the top of the hour
within Image Streamer. The job checks the status (Expired, About to expire, Revoked, or Untrusted) of all certificates
within the Image Streamer trust stores.
Appliance Discovery
Image Streamer appliances are identified using LLDP. The enclosure management interface uses the LLDP messages to
establish an identity for Image Streamer appliances and HPE OneView reads the identities from the enclosure
management interface.
Data Protection
HPE OneView protects Image Streamer artifacts from unauthorized access. The Image Streamer OS deployment server
executes the Plan Scripts in a contained environment that protects the appliance from malicious scripts.
The iSCSI protocol has an access control mechanism based on initiator and target IQN’s which restricts unauthorized
access to iSCSI storage volumes. The OS volumes are supported by the appliance’s internal SAN technology. The SAN
data storage is not encrypted.
Security
79