This video demonstrates how to replace a self-signed certificate with
a CA-signed certificate in HPE OneView.
First, let's get familiar with a few concepts.
HPE OneView uses HTTPS for secure communication with managed devices
and remote servers.
HTTPS is based on Transport Layer Security or TLS, which offers
much needed integrity and confidentiality to prevent man-in-the-middle attacks.
Public key cryptography, which is used to authenticate HTTPS and TLS,
uses public and private key pairs to encrypt and decrypt data.
In our example of Bob and Alice here, both communicating parties have two keys
of their own. Each party has their own public key, which they share
with the world and their own private key, which they keep a secret.
A message which is encrypted with a public key, can only be decrypted
with the private key.
Bob will encrypt his message with Alice's public key. While everybody
knows Alice's public key, they will not be able to decrypt the message.
Only Alice, using her secret private key, can decrypt the message.
In a public key system, digital certificates certify the ownership
of the public key.
Digital certificates also help verify the identity of the server so that
visitors know they are not sending their information to the wrong person or
device.
To extend the analogy of Alice, she now goes to a trusted authority to which
she presents a public key and her proof of identity. The authority
digitally signs Alice's key, producing a signed certificate.
Now, instead of just presenting her public key, when she wants to communicate,
Alice presents her certificate.
The authority's signature itself is guaranteed by another certificate
signed by yet another authority, until we get a certificate whose authority
is well-known.
Alice's public key is now vouched for not only by a single certificate
but a chain of certificates.
HPE OneView supports the use of both self-signed certificates and CA-signed
certificates. All managed devices in HPE OneView start life with a self-signed
certificate. A self-signed certificate is generated free of cost
by an end user or a device and is signed by its own private key.
A self-signed certificate offers encryption but not trust.
A signed certificate, on the other hand, is issued and signed by a publicly trusted
third-party certificate authority and therefore is the preferred
method of authentication.
A CA-signed certificate is trusted automatically by all popular
operating systems.
This ensures that users can access the appliance without experiencing
any security errors.
Hewlett Packard Enterprise recommends that you use CA-signed certificates
for your managed devices.
You can use self-signed certificates for an intranet or development server
for testing purposes.
There are many tools such as OpenSSL, that you can use to set up your own
CA infrastructure.
For this demonstration, we have used Microsoft Windows Server 2016
as an example.
To replace the default self-signed certificate with the CA-signed
certificate, you must first install and configure Certificate Authority
on Microsoft Windows Server 2016. Next, generate a certificate signing request,
or CSR, in HPE OneView to obtain an SSL certificate from a certificate
authority.
Submit the CSR to a certificate authority to obtain a signed certificate
in base-64-encoded format.
Finally, import the signed certificate along with the CA chain certificates
into HPE OneView.
Let's go to the details.
Before you begin. Ensure you have configured Microsoft Active Directory
Service with Certificate Authority Role enabled. You must have infrastructure
administrative privileges on this appliance.
Start by creating a template for HPE OneView appliances.
Click Start on the operating system and then Select Control Panel.
Go to Administrative Tools and then click Certification Authority. Right-click
Certificate Templates and then click Manage. Scroll down to Web Server and
right-click to select Duplicate Template.
In General, enter a template name. For example, OneView Appliance.
Select a validity period. Under Extensions, click Application Policies and then
click Edit. Include both client and server authentication policies.
Select Server Authentication and then click OK and Apply. You can view
the template you created in the certificate templates console.
Back in the Certification Authority window, right-click Certification Template.
Click New and then select Certificate Template To Issue.
Select OneView Appliances Template and then click OK. You can view the custom
template you created under Certificate Templates. Certificate Authority is now
successfully installed and configured on Windows Server 2016.
Next, generate an Appliance Certificate Signing Request. Log into HPE OneView.
From the main menu. Select Settings. Click Security, select Actions and then
click Create Appliance Certificate Signing Request. Supply the data requested
on the screen. By default, the HPE OneView applying certificate
in a VM, HPE Synergy Composer, or HPE Synergy Composer 2, is a FIPS-compliant
SHA256 certificate with 2048-bit key length. If you require
a CNSA-strength digital certificate, select the Generate CNSA-Compatible
Signing Request check box.
To process a CNSA-strength CSR, your entire CA infrastructure must
support a minimum of 3072-bit key length and the minimum of SHA384
signature algorithm. Click OK.
Save the certificate information in a Notepad file.
Use a Web browser to navigate to Microsoft Active Directory Certificate
Service. Select Request a Certificate.
Click Advanced Certificate Request. Click Submit a Certificate Request
by using a base-64-encoded CMC. Copy and paste the code you had saved earlier
in the base-64-encoded certificate request box.
Select OneView Appliances as the certificate template.
Click Submit.
Select the base-64-encoded option and then download the certificate.
Save the certificate with a .cer extension.
Open the certificate and make sure that application policies include
both server and client authentication policies.
Open the new certificate on a Notepad file and copy the certificate
information.
In HPE OneView, select Settings. Click Security.
Select Actions and then click Import Applying Certificate.
Paste the certificate information and click OK. Once successfully imported,
the CA certificate chain is stored in the HPE OneView Trust Store.
This completes a demonstration of replacing a self-signed certificate
with a CA-signed certificate in HPE OneView.