Deploying customized server certificates to Lenovo XClarity Administrator

You can choose to generate a certificate signing request (CSR) for signing by your organization’s certificate authority or a third-party certificate authority. The CSR creates a full certificate chain that you can import and use in place of the unique default internally signed certificates.

Procedure

To generate and deploy a customized externally signed server certificate to Lenovo XClarity Administrator, complete the following steps.

1. Create and download a certificate signing request (CSR) for XClarity Administrator.
   1. From the XClarity Administrator menu bar, click Administration > Security to display the Security page
   2. Click Server Certificate under the Certificate Management section to display the Server Certificate page.
   3. Click the Generate Certificate Signing Request (CSR) tab.
   4. Fill in the fields for the request.

      • Country or Region

      • State or Province

      • City or Locality

      • Organization

      • Organization Unit (optional)

      • Common Name

      Attention

      Select a common name that matches the IP address or hostname that XClarity Administrator uses to connect to the managed device. Failure to select the correct value might result in connections that are not trusted.
   5. Optional: Customize, add, and delete subject alternative names in the X.509 subjectAltName extension when the CSR is generated. All subject alternative names that are listed in the table are validated, saved, and added to the CSR only after you generate the CSR in the next step.

      By default, XClarity Administrator automatically defines subject alternative names for the CSR based on the IP address and hostname that are discovered by the XClarity Administrator guest operating system's network interfaces.

      Attention

      The subject alternative names must include the fully-qualified domain name (FQDN) or IP address of the management server, and the subject name be set to the FQDN of the management server. Verify that these required fields are present and correct before beginning the CSR process to ensure that the resulting certificate is complete. Missing certificate data might result in connections that are not trusted when attempting to connect the XClarity Administrator instance to Lenovo XClarity Orchestrator.

      The name that you specify must be valid for the selected type.

      • directoryName (for example, cn=lxca-example,ou=dcg,dc=company,dc=com)

      • dNSName (for example, lxca-example.dcg.company.com)

      • ipAddress (for example, 192.0.2.0)

      • registeredID (for example, 1.2.3.4.55.6.5.99)

      • rfc822Name (for example, example@company.com)

      • uniformResourceIdentifier (for example, https://lxca-dev.dcg.company.com/example)

      Note

      All SANs that are listed in the table are validated, saved, and added to the CSR only after you generate the CSR in the next step.
   6. Click Generate CSR File. The server certificate is displayed in the Certificate Signing Request dialog.
      Important

      • Verify that the newly generated certificate contains the FQDN and IP address as part of the subject alternative names.

      • If this XClarity Administrator instance is managed by XClarity Orchestrator, ensure that the generated certificated based on the CSR is configured to be used as both a server certificate and as a client certificate.

   7. Click Save to File to save the server certificate to the host server.
2. Provide the CSR to a trusted certificate authority (CA). The CA signs the CSR and responds with a server certificate.
3. Upload the externally signed server certificate to XClarity Administrator. The certificate content must be a bundle containing the CA’s root certificate, any intermediate certificates, and the server certificate.
   1. From the XClarity Administrator menu bar, click Administration > Security to display the Security page.
   2. Click Server Certificate under the Certificate Management section.
   3. Click the Upload Certificate tab.
   4. Click Upload Certificate to display the Upload Certificate dialog.
   5. Specify a certificate bundle file in PEM, DER or PKCS7 format, or paste the certificate bundle in PEM format.
   6. Click Upload to upload the server certificate and store the certificate in the XClarity Administrator trust store.