Renews the iLO HTTPS certificate through Redfish using a path selected by firmware version.
What happens
- The appliance connects to HPE iLO through Redfish on port 443.
- Discovery reads firmware, the current HTTPS certificate, CSR and enrollment. The package checks the new certificate, chain and matching key or controller CSR before import.
- Redfish imports the certificate. iLO resets automatically; the package waits for the management interface to return.
- Verification: a fresh TLS connection and Redfish session verify the served leaf certificate and every supplied intermediate. If it fails: Rollback restores the previous certificate from retained matching material when the new installation can be identified. Another administrator's certificate is preserved.
Technical details
- Connection
- The package runs on the appliance, which connects over HTTPS to Redfish, port 443. No agent is installed.
- Service ports
- 443
- You need
- iLO account with login for discovery and Configure iLO Settings (iLOConfigPriv) for certificate changes. The appliance requires Python 3 and OpenSSL.
- Platform
- HPE iLO 5, 6 and 7
- Actions
- Discovery, CSR generation, Installation, Verification, Rollback
- Packages
-
hpe-ilo-api1.0.0 - Note
-
- The imported key algorithm must match the iLO KeyType. The package leaves that setting unchanged.
- iLO 5 from 2.78, iLO 6 from 1.30 and iLO 7 import a matching certificate and unencrypted private key. Earlier firmware uses the controller CSR; the certificate source must issue from that CSR without receiving the controller key.
- iLO does not expose its private HTTPS key. First-deployment rollback requires a retained previous certificate with its matching key or an unchanged matching controller CSR. The package retains subsequent managed keys in protected appliance backup storage.
- TLS verification is the default. Shared MANAGEMENT_TLS_PIN_SHA256, MANAGEMENT_TLS_CA_BUNDLE and explicit MANAGEMENT_TLS_INSECURE are supported. After import in pin mode, an administrator must trust the new returned fingerprint in the appliance before the next run. CA verification continues automatically when the new certificate is trusted.
- Manual import requires legacy SCEP enrollment to be disabled. The package changes only the iLO HTTPS certificate; the host operating system and other certificates are unaffected.
- On iLO 5/6 each DER certificate must be at most 3072 bytes and the chain at most 20 KB. Supply the complete intermediate chain; the root is optional.