Veritas Access Appliance 8.4 Initial Configuration Guide

To create and implement a minimal self-signed certificate

1. On a Linux computer, type the following command to generate the private key:

   openssl genrsa -out ipmi.key 2048

   In this case, the private key is named ipmi.key.

2. Type the following command to generate a certificate signing request (ipmi.csr) using ipmi.key:

   openssl req -new -key ipmi.key -out ipmi.csr

   Fill in each field with the appropriate values. To leave a field blank, enter a period (.).

   Note:

   To avoid extra warnings in your browser, set the common name to the fully qualified domain name of the IPMI interface.

3. Type the following command to sign ipmi.csr with ipmi.key and create a certificate called ipmi.crt that is valid for 1 year:

   openssl x509 -req -in ipmi.csr -out ipmi.crt -signkey ipmi.key -days 365

4. Type the following command to concatenate ipmi.crt and ipmi.key to create a certificate in PEM format called ipmi.pem:

   cat ipmi.crt ipmi.key > ipmi.pem

5. Log on to the Veritas Remote Management Console.

   Note:

   If you need to access the Veritas Remote Management Console from another computer, copy the ipmi.pem file to that computer.

6. On the Configuration tab, select SSL from the left pane.

   Next to New SSL Certificate, click Browse... and select the ipmi.pem file.

   Click Upload.

   Note:

   A warning may appear that says an SSL certificate already exists. Press OK to continue.

7. Click Browse... again to import the privacy key. (Note that it now says New Privacy Key next to the button instead of New SSL Certificate.)

   Select the ipmi.pem file and click Upload.

   When the confirmation dialog appears, click OK to restart the web service.

8. (Optional) Close and reopen the Veritas Remote Management Console to verify that the new certificate is being presented.