Go to main content

Oracle® ILOM Security Guide For Firmware Releases 3.x and 4.x

Exit Print View

Updated: May 2019
 
 

Regenerate Self-Signed Default SSL Certificate Issued By Oracle

As of firmware version 3.2.8, each Oracle ILOM SP, CMM, and FMM ships with a unique self-signed Default SSL Certificate. The Default SSL Certificate is used by Oracle ILOM whenever a Custom SSL Certificate is not configured.

The unique Default SSL Certificate is initially generated at the factory with a unique host certificate fingerprint value. Oracle ILOM automatically regenerates a new version of the Default SSL Certificate and fingerprint whenever its configuration properties are reset to defaults. System administrators, at any time, can choose to replace the existing Default SSL Certificate and fingerprint with a newer version. For instructions for regenerating the Default SSL Certificate and fingerprint in Oracle ILOM, see the following information.

Before You Begin

  • Admin (a) role is required to regenerate the Default SSL Certificate.

  • Oracle ILOM firmware version 3.2.8 or later must be in use.

  • By default, the Oracle ILOM Default SSL Certificate is generated with a 3072 bit key size. Optionally, you can change default key size (3072) to either 2048 or 4096.

  • All Oracle ILOM web interface and KVMS console user connections are immediately disconnected upon regenerating a new Default SSL Certificate.

  • When the Default (self-signed) SSL Certificate is used in Oracle ILOM, additional certificate checks will take place to protect Oracle ILOM from man-in-the-middle attacks. For instance:

To regenerate the Default (self-signed) SSL Certificate in Oracle ILOM, follow these steps:

  1. In the Oracle ILOM web interface, click ILOM Administration > Management Access > SSL Certificate.

    The SSL Certificate page appears.

  2. In the Default Certificate section of the SSL Certificate page, perform the following steps:
    1. (Optional) To modify the Default SSL Certificate Key Size (3072), click the Key Size list box and select the appropriate key size.
    2. To regenerate the Default SSL Certificate and the host fingerprint value, click Create.

      A message appears confirming that you want to regenerate a new Default SSL Certificate and fingerprint.

  3. In the Confirmation Message dialog box, click OK to proceed.
  4. View the Create SSL Certificate Results field to track the creation status.

    For instance, one or more of the following status messages might appear:

    • Running — This status message appears when Oracle ILOM is in the process of creating a new Default SSL Certificate and fingerprint.

      Upon creating the new Default SSL Certificate and fingerprint, all Oracle ILOM web interface and KVMS console user connections will be disconnected. KVMS and web interface users can immediately log in to Oracle ILOM after being disconnected.

    • New Cert Has Been Created — This status message appears after a new Default SSL Certificate was generated by a user.
    • Certificate Creation Failed —This status message appears when Oracle ILOM was unable to process the request to create a new Default SSL Certificate and fingerprint.
    • (None) — This status message appears when the last Default SSL Certificate was generated by Oracle ILOM, or when a user changed the Default SSL Certificate key size in the ILOM CLI but did not regenerate the Default SSL Certificate.

Related Information