How best to deal with NMC SSL certificate expiration

[marting]

We have several hundred APC devices across many sites and started switching from HTTP/telnet to HTTPS/SSH a while back (apparently two years ago).

What we started seeing recently is not being able to get to certain devices via HTTPS.  Tried both via StruxureWare DCE and a standard browser.

Thankfully, SSH still worked on these devices and I was able to enable HTTP and do some more investigation on this.

It looks like the certificates that were created by the devices when HTTPS was initially enabled had a 2-year lifespan and are starting to expire...

It looks like I can work around this by deleting the certificate which forces creation of a new one on NMC reboot but that one looks to have a lifespan of only 1 year.

Needless to say, doing this process on all our devices once a year is not going to be sustainable.

Has anyone found a good way of dealing with this?

I found this thread about bulk-creating CSRs and then bulk-uploading certs.  Is this the easiest way to deal with this?

Was not expecting to have to go through this type of project 2 years after we enabled HTTPS...

[Matt-B]

Hello,

The expiration date has since been updated in v7.x firmware to be 2035 for self signed certificates - more info in the KB article here: https://www.apc.com/us/en/faqs/FAQ000233142/

All you would need to do is upgrade the firmware, then delete the cert and reboot the NMC. When the card turns back on, the newly generated certificate will be valid until 2035. 

[marting]

Thanks, that's great news!

I know I can push out the updated firmware via StruxureWare but...  is there any way to automate the deletion of the existing SSL certificate across many devices?

StruxureWare supports running custom console commands across many devices so if there is a console command that could be run to do this, I could do it that way.

Also open to other options!

[BillP · Accepted solution]

@marting 

You should upgrade the cards to firmware 7.0.4 to resolve the issue. 

If the UPS are Smart-UPS go to

https://www.apc.com/shop/us/en/products/UPS-Network-Management-Card-v7-0-4-Firmware-for-Smart-UPS-Ga...

If the UPS is a Symmetra 3 phase go to 

https://www.apc.com/shop/us/en/products/UPS-Network-Management-Card-v7-0-4-Firmware-for-Symmetra-1-P...

[RicR]

Deleting the Cert and rebooting is fairly simple unless you have 250 devices.  We have both NMC2 and NMC3 devices. Looking for the most efficient way to automate the process as much as possible.  I have been looking at scripting the commands through CLI but having trouble with deleting the existing certificate.
Any suggestions on the best way to update this many devices?  

[PERI · Accepted solution]

This worked for us:

cd ssl

delete defaultcert.p15

reboot

[marting]

Thanks @PERI !

Was able to bulk-deploy that to our devices using the Custom Command function in SNMP Device Configuration in DCE (after upgrading firmware).

[EPacey]

Hi Marting,

Could you share the steps you used to bulk-deploy the custom command?

Thanks in advance.

[marting]

In DCE:

• Device > APC SNMP Device Configuration
• User Configuration...
• Select the devices you want to target
• Click Add Custom Command and add in each of the commands in PERI's post
• Click Finish to deploy

I would test on one or two devices to make sure you have the process down before mass-deploying.

[tcrowe]

There are a few ways to deploy SSL certs.

We're using a powershell script via SSH. You'll need the Posh-ssh module.