ASRock EPYCD8-2T [6/66] Certificates to import the certificate

Logging in to Web using SSL mutual authentication

You can also login to the IPMI via SSL mutual authentication without entering

username/password.

Before you login as SSL mutual authentication, ensure that:

1. Upload CA certificate(.pem), server certificate(.pem) and server private

key(.pem) to BMC

2. Install the client certificate(.p12) into the browser

• Chrome: Using “//settings/” to open Manager certificates to import the

certificate.

• IE11: Using “Tools>Internet Options>Certificates” to import the certificate.

• Firefox: Using “Tools > Options > Advanced > Certificates” to import the

certificate.

3. Login to IPMI using the link https://[IP address]:[ mutual port number].

Note:

1. The default mutual port number is 4433. You can modify it in Services page.

2. If you want to generate SSL certificate yourself, please follow the steps below.

• Install OpenSSL in your Linux machine.

• Generate CA certificate:

(1) Type openssl genrsa -out ./private/ca.key 1024 to generate a private key

(2) Type openssl req -new -x509 -days 365 -key ./private/ca.key -out ./certs/ca.crt to

generate a certificate file(contain public key)

(3) Type cat ./certs/ca.crt > ./certs/ca.pem to transfers the file format to .pem.

• Generate server certificate:

(1) Type openssl genrsa -out ./private/server.key 1024 to generate a server key.

(2) Type openssl req -new -key ./private/server.key -out ./certs/server.csr to generate

the csr file.

(3) Type openssl x509 -req -days 365 -in ./certs/server.csr -CA ./certs/ca.crt

-CAkey ./private/ca.key -set_serial 01 -out ./certs/server.crt to sign the file and

generate a server certificate

(4) Type cat ./certs/server.crt > ./certs/server.pem to transfers the file format to .pem.

(5) Type cat ./private/server.key > ./private/server_key.pem to transfers the file format

to .pem.

• Generate client certificate:

(1) Type openssl genrsa -out ./private/client.key 1024 to generate a client key.

(2) Type openssl req -new -key ./private/client.key -out ./certs/client.csr to generate the

csr file.

(3) Type openssl x509 -req -days 365 -in ./certs/client.csr -CA ./certs/ca.crt

-CAkey ./private/ca.key -set_serial 02 -out ./certs/client.crt to sign the file and