Invite a Co-worker
Send a co-worker an invite to the Exchange portal.Just enter their email address and we’ll connect them to register. After joining, they will belong to the same company.
Send Invite Cancel
80810members
346871posts

How best to deal with NMC SSL certificate expiration

marting
Ensign
Ensign
0 Likes
5
791

How best to deal with NMC SSL certificate expiration

We have several hundred APC devices across many sites and started switching from HTTP/telnet to HTTPS/SSH a while back (apparently two years ago).

 

What we started seeing recently is not being able to get to certain devices via HTTPS.  Tried both via StruxureWare DCE and a standard browser.

Thankfully, SSH still worked on these devices and I was able to enable HTTP and do some more investigation on this.

 

It looks like the certificates that were created by the devices when HTTPS was initially enabled had a 2-year lifespan and are starting to expire...

 

It looks like I can work around this by deleting the certificate which forces creation of a new one on NMC reboot but that one looks to have a lifespan of only 1 year.

 

Needless to say, doing this process on all our devices once a year is not going to be sustainable.

 

Has anyone found a good way of dealing with this?

 

I found this thread about bulk-creating CSRs and then bulk-uploading certs.  Is this the easiest way to deal with this?

Was not expecting to have to go through this type of project 2 years after we enabled HTTPS...

 

Tags (2)
5 Replies 5
Matt-B
Ensign Ensign
Ensign
0 Likes
3
787

Re: How best to deal with NMC SSL certificate expiration

Hello,

 

The expiration date has since been updated in v7.x firmware to be 2035 for self signed certificates - more info in the KB article here: https://www.apc.com/us/en/faqs/FAQ000233142/

 

All you would need to do is upgrade the firmware, then delete the cert and reboot the NMC. When the card turns back on, the newly generated certificate will be valid until 2035. 

Tags (1)
marting
Ensign
Ensign
0 Likes
0
771

Re: How best to deal with NMC SSL certificate expiration

Thanks, that's great news!

 

I know I can push out the updated firmware via StruxureWare but...  is there any way to automate the deletion of the existing SSL certificate across many devices?

 

StruxureWare supports running custom console commands across many devices so if there is a console command that could be run to do this, I could do it that way.


Also open to other options!

 

Tags (1)
BillP
Administrator Administrator
Administrator
0 Likes
0
749

Re: How best to deal with NMC SSL certificate expiration

@marting 

 

You should upgrade the cards to firmware 7.0.4 to resolve the issue. 

If the UPS are Smart-UPS go to

https://www.apc.com/shop/us/en/products/UPS-Network-Management-Card-v7-0-4-Firmware-for-Smart-UPS-Ga...

If the UPS is a Symmetra 3 phase go to 

https://www.apc.com/shop/us/en/products/UPS-Network-Management-Card-v7-0-4-Firmware-for-Symmetra-1-P...

Tags (1)
RicR
Cadet
0 Likes
1
549

Re: How best to deal with NMC SSL certificate expiration

Deleting the Cert and rebooting is fairly simple unless you have 250 devices.  We have both NMC2 and NMC3 devices. Looking for the most efficient way to automate the process as much as possible.  I have been looking at scripting the commands through CLI but having trouble with deleting the existing certificate.
Any suggestions on the best way to update this many devices?  

 

Tags (1)
PERI
Cadet
0 Likes
0
348

Re: How best to deal with NMC SSL certificate expiration

This worked for us:

 

cd ssl

delete defaultcert.p15

reboot

Tags (1)