PDU 7800B - No new support materials & SSL Issues

[Anonymous user]

Since the 7800 is EOL, APC has released the 7800B to replace it.

Firstly, the firmware on the support page is not supported by the 7800B. It is listing the older firmware meant for the 7800. I have already mentioned this to support, hopefully they will fix it.

I've been trying to get a CA-signed SSL certificate loaded onto this product with no luck. The process I used on the 7800 does not work anymore and support has been useless. They told me just to use a self-signed certificate... thanks!

The Security Wizard seems to be working fine (with both 1024 and 2048 key sizes) and completes the process of generating a key, csr, and ssl cer with no errors. Though I still believe that there must have been some changes since 2010 with SSL that are causing the newer firmware to not accept the certificate as when I import this certificate onto the APC unit through the web gui, it sits at "loading certificate..." forever.

The "new" manual for the Security Wizard is useless as it is simply a copy + paste version of the older manual, with the same errors and all. It also states a specific command to transfer the p15 cert via scp, but this command is incorrectly written and scp throws an error. Trying to upload the cert to the root directory fails, whereas uploading the cert to the /ssl/ directory succeeds, but causes the unit to regenerate the self-signed cert on reboot.

I really don't want to use a self-signed certificate as it's super annoying to deal with. Can I get some real help?

[BillP]

Hi,

What are you using for your CA? If it is a Microsoft Windows Server CA, then this is an issue I am actively working on and there are a few threads about this on this forum. I have also asked that this be noted in most release notes for APC Network Management Card enabled products. In summary, we have a problem with certs from Microsoft CA and are working on addressing them as I type this (and have been but it has been one thing after another with fixing). I actually just finished doing some more tests on this problem since sometimes you're able to import a certificate through the security wizard utility and the web interface won't take it or other times you see -32 error in the utility. Sometimes these results differ by product/firmware version depending on which version of the cryptography library is embedded.

If it is a different CA you're using, let me know because it could be a different problem or maybe same problem with different criteria.

The general process to make certs on AP7800 (Network Management Card 1 platform) and AP7800B (Network Management Card 2 platform) is generally the same though the key lengths and a few other little things are different. Thus, you'll find the user's guide and steps to be similar. I did just recently (last week) submit some feedback to get some typos/mis-steps in the security handbook addressed that someone else noted. I can certainly submit further feedback if you had other comments.

Lastly, do you have a case number on when you called in so I can look into how this case was handled? If you shared the user's guide questions/typos/issues in the case, I can also hopefully see them in there to make sure they get addressed.

[Anonymous user]

Hi Angela,

Thanks for the quick reply!

Yes, I am using a Microsoft CA, though I am not experiencing any of the errors that I've read about in the KBs. I got the latest firmware from support last week, v6.4.6 and am currently running this version. I did not receive any release notes with this, as the page for the 7800B product doesn't even list the correct firmware.

I did not call in earlier, it was through the support chat instead. I did not get a case number as I was fed up with the agent telling me to use a self-signed certificate and hence, ended my chat.

Thanks for looking into the documentation as well. In addition to the errors with the scp commands, the section about using a 3rd party CA lists instructions for generating SSH keys instead of actually generating a key and csr.

Looking forward to testing your hotfixes, and hoping they will be released sooner than later.

edit: One more thing regarding the certificates: I am adding the SAN additional parameter when generating the certificate, as this is a required field on all certificates as of a few months ago when all modern browsers started throwing errors when this field was missing

[BillP]

Hi again,

I have seen the 'Loading Certificate...' thing you've mentioned before as part of what I've been working on. I have replicated these problems across Server 2008R2/2012R2, and most recently Server 2016.

Can you let me know if you're using a cert template? If so, is it WebServer or a custom template, perhaps based on WebServer? I would just like to understand further specifics if you can share to help rule out that we need to look at anything beyond what I've been doing and replicating based on other customer reports.

On 10/16/2017 4:08 PM, D said:

Thanks for looking into the documentation as well. In addition to the errors with the scp commands, the section about using a 3rd party CA lists instructions for generating SSH keys instead of actually generating a key and csr.

The part I submitted feedback on was the 3rd party CA instructions list SSH key creation commands. I admittedly haven't checked errors with scp commands. Do you mind sharing those? I'll submit a new feedback about that to the document owner.

On 10/16/2017 4:08 PM, D said:

I did not receive any release notes with this, as the page for the 7800B product doesn't even list the correct firmware.

I will check if we already know about this part as well. If not, I'll ask the product manager to see about fixing it. I checked the AP7900B SKU (switched outlet version) and it looks OK there. Was checking to see if it was all B SKUs or what. The 6.4.6 release notes are here and this item is generically covered on page 3: http://www.apc.com/salestools/MLAN-AD7HL8/MLAN-AD7HL8_R1_EN.pdf 

*Edit* - forgot to comment, I am aware of the SAN requirement now so I will bring that up again too.

[Anonymous user]

1. Windows Server 2008 R2
   • Web Server Template as well as a custom template based off the Web Server Template
   • When generating the certificate from the request, in the Additional Attributes: box, I am also typing the SAN information `san:dns=cname&dns=cname.domain`. This addition properly sets the SAN (Subject Alt Name) in the generated certificate so that Chrome & Firefox do not display errors regarding this attribute not being set (within the generated csr)
2. From my initial post: Trying to upload the cert to the root directory fails, whereas uploading the cert to the /ssl/ directory succeeds, but causes the unit to regenerate the self-signed cert on reboot.
   • Page 16 (as well as others) of Security Handbook Network-Enabled Devices:
     You can use FTP or Secure CoPy (SCP) instead to transfer the server certificate. For SCP, the command to transfer a certificate named cert.p15 to a Management Card or device with an IP address of 156.205.6.185 would be: scp cert.p15 apc@156.205.6.185
     • This is incorrect, as you do not provide a remote path to save the local "cert.p15" file. The command needs to look something like `scp cert.p15 apc@156.205.6.185:/ssl/.` or something similar (depending on wherever the certificate bundle needs to be placed). It seems like writing to the root / directory is disabled, so a command like `scp cert.p15 apc@156.205.6.185:/.` will not work because of this.
     • Thanks for the release notes, I will review them.

[BillP]

On 10/16/2017 4:50 PM, D said:

Windows Server 2008 R2

• Web Server Template as well as a custom template based off the Web Server Template
• When generating the certificate from the request, in the Additional Attributes: box, I am also typing the SAN information `san:dns=cname&dns=cname.domain`. This addition properly sets the SAN (Subject Alt Name) in the generated certificate so that Chrome & Firefox do not display errors regarding this attribute not being set (within the generated csr)

When I do this, or at least duplicate WebServer template and change nothing beyond the name or modify the validity, I get a -32 error code on the Security Wizard tool when I import Signed Certificate. I will have to look at this again if that is not happening for you, especially on v6.4.6. I admittedly haven't used Server 2008 R2 lately and mostly 2012R2 and Server 2016 but I remember and noted down 2008R2 being the same as 2012R2 in my testing. I will also have to try the SAN attribute as well. Only time I have seen success with WebServer template with zero issues is pre-6.4.0 AOS (APC OS) which is not supported with AP7800B.

On 10/16/2017 4:50 PM, D said:

From my initial post: Trying to upload the cert to the root directory fails, whereas uploading the cert to the /ssl/ directory succeeds, but causes the unit to regenerate the self-signed cert on reboot.

• Page 16 (as well as others) of Security Handbook Network-Enabled Devices:
  You can use FTP or Secure CoPy (SCP) instead to transfer the server certificate. For SCP, the command to transfer a certificate named cert.p15 to a Management Card or device with an IP address of 156.205.6.185 would be: scp cert.p15 apc@156.205.6.185
  • This is incorrect, as you do not provide a remote path to save the local "cert.p15" file. The command needs to look something like `scp cert.p15 apc@156.205.6.185:/ssl/.` or something similar (depending on wherever the certificate bundle needs to be placed). It seems like writing to the root / directory is disabled, so a command like `scp cert.p15 apc@156.205.6.185:/.` will not work because of this.

    OK, thanks for re-stating that as I know you sent it to support. I added a document feedback in just now. 

[Anonymous user]

When I do this, or at least duplicate WebServer template and change nothing beyond the name or modify the validity, I get a -32 error code on the Security Wizard tool when I import Signed Certificate. I will have to look at this again if that is not happening for you, especially on v6.4.6. I admittedly haven't used Server 2008 R2 lately and mostly 2012R2 and Server 2016 but I remember and noted down 2008R2 being the same as 2012R2 in my testing. I will also have to try the SAN attribute as well. Only time I have seen success with WebServer template with zero issues is pre-6.4.0 AOS (APC OS) which is not supported with AP7800B.

So are you saying that you can create a custom template which allows you to create a valid certificate that will be accepted by a gui >v6.4? If so, what are the details for such template?

[BillP · Accepted solution]

Negative. WebServer template works pre-6.4.0. Post 6.4.0, WebServer is not working nor are any of the custom templates, even if I just do a duplicate of WebServer and change nothing beyond the name of the template. We are working on comparing the content of the files and it appears there is some difference in the object identifiers in the file, not sure why yet..