Unable to update SSL cert on TrueNAS Mini X+ IPMI

[cmh]

I've got a TrueNAS Mini X+ and am getting it set up, and I can't get the SSL cert to update. I can upload the certificate and the key, and that's fine, and it says it's uploaded, but when I reset, the certificate has reverted to the default that ships with the IPMI - that has also expired in 2020.

To be clear, the IPMI is only on my local network, so the argument could be made to just disable the SSL to the http interface, which is what I had to do with my previous FreeNAS Mini - the https was too old for modern browsers to connect to it, but with this new one, it should be good, and I've got a valid letsencrypt cert that I could install if the installation actually worked.

I contacted iXsystems and they said my system doesn't have software support, and I made the argument that the OS is completely unrelated to the IPMI, and the IPMI configuration is hardware, but that didn't get me any help there, so I'm in this sorta grey area in between. Have searched online but IPMI is a thing that's been around for a long time and there's a whole bunch of useless information out there. Hoping maybe someone has some experience they can share.

So I login to the IPMI interface, dismiss the "OMG your connection is insecure", login, go to Configuration -> SSL Certification (sic) and upload my cert and private key. Click OK, confirm I want to overwrite the existing cert, and then get a message indicating success. While that's displaying, I see the valid start and end date for my current cert, so it has definitely worked, but when I click OK to restart - or cancel and manually retstart - when the UI loads again it's reverted.

I think this might be possible with ipmitool, but I'm not sure how, and it looks like there have been many variations on that tool over the years. Manpage is no help, although I admit I haven't read the entire thing, just looked for key stuff like "cert", "ssl", https, etc.

 

[danb35]

I just ran into something similar with my new Supermicro motherboard--it would act like it took the uploaded cert, but when the BMC restarted it was still using the old one. In my case, the problem was that the cert I uploaded was using a ECDSA key rather than RSA. Changing to use a RSA key in the cert fixed it for me.

 

[cmh]

Get my certs from acme.sh and it is indeed ECDSA. Guess I'll look into getting an RSA key and see how that goes. Fun that it accepts it and shows the right dates, then silently rejects it on reboot!

 

[cmh]

Oh my god, @danb35 you are a god walking amongst mere mortals. Got me a RSA cert with acme.sh and whaddya know it WORKED.

Not sure whether to say "thank you" or sacrifice a bull in your honor. Maybe I'll just stick with "thank you".

 

[danb35]

Yeah, that had me spinning my wheels for a while too. I don't know that it's your issue, but the behavior sounds very similar.

 

[danb35]

It's possible to automate updates to the IPMI cert, too:

Supermicro IPMI certificate updater

Supermicro IPMI certificate updater. GitHub Gist: instantly share code, notes, and snippets.

gist.github.com

 

[cmh]

It's possible to automate updates to the IPMI cert, too:

Supermicro IPMI certificate updater

Supermicro IPMI certificate updater. GitHub Gist: instantly share code, notes, and snippets.

gist.github.com

That's even better, since I'm gonna have to do this every 90 days-ish. Thank you even more!

 

[danb35]

I'm gonna have to do this every 90 days-ish

I use a local CA that issues very short-lived certs, so I need to do it daily. Automation is definitely key.

 

[cmh]

I use a local CA that issues very short-lived certs, so I need to do it daily. Automation is definitely key.

Daily OMG some of the other sysadmins at my day job misplace their feces that they have to do it once a year. :D

 

[danb35]

I would too if I had to do it manually--hence the script. I was already used to using automation in general, thanks to Let's Encrypt (which I've been using for 7+ years now), but I've been using a local CA for a while now and trying to use it for most of my LAN-only certs rather than Let's Encrypt. It's been a fun project:

Build a Tiny Certificate Authority For Your Homelab

Let's make a tiny, standalone CA! We'll use a Raspberry Pi 4, YubiKey 5 NFC, and Infinite Noise TRNG.

smallstep.com

I also have it issuing SSH user and host certs, letting me use OpenID Connect SSO (which I also self-host) for most of my stuff.

 

[cmh]

I'm still ramping up on automating all my cert deploys. I know the commands that have to run in each place so that's easy peasy but have to figure out how to have it integrated with acme.sh so it'll call all the relevant scripts. Have started looking at the docs on that but have been focused on getting my NAS migrated (and a bunch of other stuff making my home network less awful) and then maybe I'll get there.